278 lines
10 KiB
Python
Executable File
278 lines
10 KiB
Python
Executable File
import argparse
|
|
import os
|
|
import re
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
|
|
from pydantic import BaseModel, ValidationError
|
|
|
|
import yaml
|
|
|
|
|
|
class BuildSpec(BaseModel):
|
|
context: str
|
|
dockerfile: str
|
|
args: dict[str, str] = {}
|
|
|
|
|
|
class Service(BaseModel):
|
|
build: str | BuildSpec | None = None
|
|
image: str | None = None
|
|
volumes: list[str] | None = None
|
|
command: str | None = None
|
|
depends_on: list[str] | None = None
|
|
entrypoint: list[str] | None = None
|
|
env_file: str | None = None
|
|
environment: dict[str, str] | None = None
|
|
|
|
|
|
class ComposeSpec(BaseModel):
|
|
services: dict[str, Service]
|
|
|
|
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--dry", action="store_true", default=False)
|
|
parser.add_argument("--root", default=".", type=str)
|
|
parser.add_argument("--snapshot-root", default="snapshot", type=str)
|
|
parser.add_argument("--network", default="cloud", type=str)
|
|
parser.add_argument("--volume-parent", type=str, required=True)
|
|
|
|
args = parser.parse_args()
|
|
dry_run = args.dry
|
|
root = args.root
|
|
snapshot_root=args.snapshot_root
|
|
network = args.network
|
|
vol_parent = args.volume_parent
|
|
|
|
has_error = False
|
|
|
|
|
|
def err(msg: str):
|
|
global has_error
|
|
has_error = True
|
|
print(msg)
|
|
|
|
|
|
userNamePattern = r"^[a-z0-9]+$"
|
|
|
|
users: list[tuple[int, str]] = []
|
|
for userDir in os.listdir(f"{root}/users"):
|
|
spl = userDir.split("-", 1)
|
|
if len(spl) != 2:
|
|
err(f"ERR: Valid priority isn't set for userDir {spl}")
|
|
continue
|
|
elif not spl[0].isdigit():
|
|
err(f"ERR: UserDir {spl} has an invalid priority.")
|
|
continue
|
|
elif not re.match(userNamePattern, spl[1]):
|
|
err(f"ERR: Name {spl[1]} doesn't match {userNamePattern}")
|
|
continue
|
|
users.append((int(spl[0]), spl[1]))
|
|
|
|
users.sort(key=lambda x: x[0])
|
|
|
|
serviceNamePattern = r"^[a-z0-9]+$"
|
|
|
|
def validate_compose_spec(spec: ComposeSpec, workdir: str):
|
|
invalid_services = [serviceName for serviceName, _ in spec.services.items() if
|
|
not re.match(serviceNamePattern, serviceName)]
|
|
if len(invalid_services) > 0:
|
|
err(f"ERR: Invalid service names: {', '.join([x for x in invalid_services])}")
|
|
for invalid_service in invalid_services:
|
|
spec.services.pop(invalid_service)
|
|
for key, svc in spec.services.items():
|
|
validate_service_spec(svc, workdir, key)
|
|
|
|
depended_services = [(svc.depends_on or []) for _name, svc in spec.services.items()]
|
|
depended_services = [item for sublist in depended_services for item in sublist]
|
|
for serviceName in depended_services:
|
|
if serviceName not in spec.services:
|
|
err(f"ERR: Service {serviceName} is depended on but not defined in the compose spec")
|
|
|
|
|
|
|
|
# Fields recognized by our Pydantic models — anything else in the YAML
|
|
# is silently dropped by Pydantic and could interfere with our injection.
|
|
_TOP_LEVEL_KNOWN = {"services"}
|
|
_SERVICE_KNOWN = {"build", "image", "volumes", "command", "depends_on",
|
|
"entrypoint", "env_file", "environment"}
|
|
_BUILD_KNOWN = {"context", "dockerfile", "args"}
|
|
|
|
|
|
def detect_injected_fields(path_: str, data: dict):
|
|
"""Warn about YAML keys not captured by the Pydantic model — these would
|
|
be silently dropped and could interfere with network injection."""
|
|
if not isinstance(data, dict):
|
|
return
|
|
extra_toplevel = set(data.keys()) - _TOP_LEVEL_KNOWN
|
|
if extra_toplevel:
|
|
err(f"WARN: {path_} has unexpected top-level keys (ignored by model): "
|
|
f"{', '.join(sorted(extra_toplevel))}. "
|
|
f"These may interfere with injected networks/config.")
|
|
services = data.get("services")
|
|
if not isinstance(services, dict):
|
|
return
|
|
for svc_name, svc_data in services.items():
|
|
if not isinstance(svc_data, dict):
|
|
continue
|
|
extra_svc = set(svc_data.keys()) - _SERVICE_KNOWN
|
|
if extra_svc:
|
|
err(f"WARN: {path_} service '{svc_name}' has unexpected keys "
|
|
f"(ignored by model): {', '.join(sorted(extra_svc))}")
|
|
build = svc_data.get("build")
|
|
if isinstance(build, dict):
|
|
extra_build = set(build.keys()) - _BUILD_KNOWN
|
|
if extra_build:
|
|
err(f"WARN: {path_} service '{svc_name}' build block has "
|
|
f"unexpected keys: {', '.join(sorted(extra_build))}")
|
|
|
|
|
|
for prio, name in users:
|
|
workdir = f"{root}/users/{prio}-{name}/"
|
|
path = f"{workdir}compose.yml"
|
|
with open(path) as csf:
|
|
data = yaml.safe_load(csf)
|
|
detect_injected_fields(path, data)
|
|
try:
|
|
spec = ComposeSpec(**data)
|
|
except ValidationError as e:
|
|
err(f"Cannot validate compose spec at {path}")
|
|
print(e.errors())
|
|
continue
|
|
validate_compose_spec(spec, workdir)
|
|
|
|
|
|
def validate_env_file(path_: str) -> bool:
|
|
try:
|
|
with open(path_, "r") as f:
|
|
for idx, raw in enumerate(f, start=1):
|
|
line = raw.strip()
|
|
if not line or line.startswith("#"):
|
|
continue
|
|
if line.startswith("export "):
|
|
line = line[len("export "):].strip()
|
|
if "=" not in line:
|
|
err(f"ERR: Invalid line {idx} in env file {path_}: no '=' found")
|
|
return False
|
|
key, _ = line.split("=", 1)
|
|
key = key.strip()
|
|
if not re.match(r"^[A-Za-z_][A-Za-z0-9_]*$", key):
|
|
err(f"ERR: Invalid env var name '{key}' in {path_} at line {idx}")
|
|
return False
|
|
return True
|
|
except Exception as e:
|
|
err(f"ERR: Cannot read env_file {path_}: {e}")
|
|
return False
|
|
|
|
|
|
def validate_service_spec(serv: Service, workdir: str, name: str):
|
|
if serv.image is None and serv.build is None:
|
|
err(f"ERR: Service {name} doesn't have an image or build spec")
|
|
if isinstance(serv.build, str) and not os.path.exists(f"{workdir}/{serv.build}/Dockerfile"):
|
|
err(f"ERR: Service {name}: Dockerfile doesn't exist at {workdir}/{serv.build}/Dockerfile")
|
|
for volume in (serv.volumes or []):
|
|
spl = volume.split(":")
|
|
if (len(spl) != 2 and len(spl) != 3) or \
|
|
not os.path.normpath(spl[0]).startswith(vol_parent) or \
|
|
(len(spl) == 3 and spl[2] != "ro"):
|
|
err(f"ERR: Invalid volume spec {volume} in service {name}")
|
|
if serv.env_file and not os.path.exists(f"{workdir}/{serv.env_file}") \
|
|
and not os.path.exists(f"{workdir}/{serv.env_file}.gpg"):
|
|
err(f"ERR: Service {name}: env_file {serv.env_file} (or .gpg) doesn't exist in {workdir}")
|
|
elif serv.env_file and os.path.exists(f"{workdir}/{serv.env_file}"):
|
|
validate_env_file(f"{workdir}/{serv.env_file}")
|
|
if isinstance(serv.build, BuildSpec) and not os.path.exists(f"{workdir}/{serv.build.dockerfile}"):
|
|
err(f"ERR: Service {name}: Dockerfile {serv.build.dockerfile} doesn't exist in {workdir}")
|
|
|
|
if has_error:
|
|
print("Errors found during validation. Exiting.")
|
|
sys.exit(1)
|
|
|
|
# ── Snapshot: copy userdir + inject networks into compose.yml ──────────
|
|
print(f"Snapshot target: {snapshot_root}")
|
|
|
|
snapshot_dirs: list[tuple[str, str]] = [] # (dst_dir, name) for compose-up later
|
|
|
|
for prio, name in users:
|
|
src_dir = f"{root}/users/{prio}-{name}"
|
|
dst_dir = f"{snapshot_root}/{prio}-{name}"
|
|
|
|
if dry_run:
|
|
print(f" [dry] would snapshot {src_dir} -> {dst_dir}")
|
|
print(f" [dry] inject networks: .networks.{network}.external=true, "
|
|
f".networks.{name}.name={name}, services[].networks=[{network}, {name}]")
|
|
snapshot_dirs.append((dst_dir, name))
|
|
continue
|
|
|
|
print(f" Snapshotting {src_dir} -> {dst_dir}")
|
|
try:
|
|
if os.path.exists(dst_dir):
|
|
shutil.rmtree(dst_dir)
|
|
os.makedirs(dst_dir, exist_ok=True)
|
|
|
|
for item in os.listdir(src_dir):
|
|
src_item = os.path.join(src_dir, item)
|
|
dst_item = os.path.join(dst_dir, item)
|
|
if item == "compose.yml":
|
|
# Rewrite with injected network configuration
|
|
with open(src_item) as f:
|
|
compose_data = yaml.safe_load(f)
|
|
compose_data.setdefault("networks", {})
|
|
compose_data["networks"][network] = {"external": True}
|
|
compose_data["networks"][name] = {"name": name}
|
|
for svc_name, svc in (compose_data.get("services") or {}).items():
|
|
svc["networks"] = [network, name]
|
|
print(f" Injected networks into service '{svc_name}': "
|
|
f"[{network}, {name}]")
|
|
with open(dst_item, "w") as f:
|
|
yaml.dump(compose_data, f, default_flow_style=False, sort_keys=False)
|
|
print(f" Wrote {dst_item} (networks injected)")
|
|
elif item.endswith(".gpg"):
|
|
# Decrypt .gpg file → output without .gpg suffix
|
|
plain_name = item[:-4] # strip ".gpg"
|
|
dst_plain = os.path.join(dst_dir, plain_name)
|
|
print(f" Decrypting {item} -> {plain_name}")
|
|
subprocess.run(
|
|
["gpg", "--decrypt", "--batch", "--output", dst_plain, src_item],
|
|
check=True,
|
|
)
|
|
elif os.path.isdir(src_item):
|
|
shutil.copytree(src_item, dst_item)
|
|
else:
|
|
shutil.copy2(src_item, dst_item)
|
|
|
|
snapshot_dirs.append((dst_dir, name))
|
|
print(f" Done snapshotting {name}")
|
|
except Exception as e:
|
|
err(f"ERR: Snapshot failed for {name}: {e}")
|
|
|
|
# ── Compose up in each snapshot ────────────────────────────────────────
|
|
if has_error:
|
|
print("Snapshot errors detected — skipping compose up.")
|
|
sys.exit(1)
|
|
|
|
if dry_run:
|
|
for dst_dir, name in snapshot_dirs:
|
|
print(f" [dry] would run: docker compose -f {dst_dir}/compose.yml "
|
|
f"up --remove-orphans --build --detach")
|
|
else:
|
|
for dst_dir, name in snapshot_dirs:
|
|
print(f" Starting services for {name} in {dst_dir} …")
|
|
try:
|
|
subprocess.run(
|
|
["docker", "compose", "-f", f"{dst_dir}/compose.yml",
|
|
"up", "--remove-orphans", "--build", "--detach"],
|
|
cwd=dst_dir, check=True,
|
|
)
|
|
print(f" ✓ {name} started")
|
|
except subprocess.CalledProcessError as e:
|
|
err(f"ERR: docker compose up failed for {name}: {e}")
|
|
|
|
if has_error:
|
|
print("Errors during compose up. Exiting.")
|
|
sys.exit(1)
|
|
|
|
|
|
|