arcbox-docker 0.6.3

Docker REST API compatibility layer for ArcBox
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

//! Network handlers that keep host DNS in sync.
//!
//! `POST /networks/{id}/connect` and `/disconnect` change a running
//! container's IP and reachable aliases, so after proxying them to guest
//! dockerd the container's host DNS entry must be refreshed — otherwise
//! resolving the container by name keeps returning the pre-connect address.
//! All other network operations proxy through the fallback untouched (host
//! routing uses one static container-subnet route, not per-network state).

use super::container::{
    canonical_id_or_fallback, extract_container_dns_info, extract_container_name,
};
use super::proxying::proxy_to_system_vm;
use crate::api::AppState;
use crate::error::{DockerError, Result};
use axum::body::Body;
use axum::extract::{OriginalUri, State};
use axum::http::{Request, Uri};
use axum::response::Response;

/// Connect a container to a network, then refresh its host DNS entry.
///
/// # Errors
///
/// Returns an error if VM readiness fails or proxying to guest dockerd fails.
#[tracing::instrument(
    name = "docker.network.connect",
    skip(state, req),
    fields(uri = %uri, utility_vm = "native"),
    err
)]
pub async fn network_connect(
    State(state): State<AppState>,
    OriginalUri(uri): OriginalUri,
    req: Request<Body>,
) -> Result<Response> {
    proxy_then_refresh_dns(&state, &uri, req).await
}

/// Disconnect a container from a network, then refresh its host DNS entry.
///
/// # Errors
///
/// Returns an error if VM readiness fails or proxying to guest dockerd fails.
#[tracing::instrument(
    name = "docker.network.disconnect",
    skip(state, req),
    fields(uri = %uri, utility_vm = "native"),
    err
)]
pub async fn network_disconnect(
    State(state): State<AppState>,
    OriginalUri(uri): OriginalUri,
    req: Request<Body>,
) -> Result<Response> {
    proxy_then_refresh_dns(&state, &uri, req).await
}

/// Buffers the request body (to learn which container is affected), proxies
/// the operation, and on success re-derives the container's DNS entry from a
/// fresh inspect.
async fn proxy_then_refresh_dns(
    state: &AppState,
    uri: &Uri,
    req: Request<Body>,
) -> Result<Response> {
    let (parts, body) = req.into_parts();
    let body_bytes = http_body_util::BodyExt::collect(body)
        .await
        .map_err(|e| DockerError::Server(format!("failed to read body: {e}")))?
        .to_bytes();
    let container = container_from_network_body(&body_bytes);

    let req = Request::from_parts(parts, Body::from(body_bytes));
    let response = proxy_to_system_vm(state, uri, req).await?;

    if response.status().is_success() {
        match container {
            Some(token) => refresh_container_dns(state, &token).await,
            None => tracing::debug!(
                uri = %uri,
                "network operation body had no Container field; skipping DNS refresh"
            ),
        }
    }

    Ok(response)
}

/// Re-derives a container's host DNS entry from a fresh inspect.
///
/// The old entry is removed first: after a disconnect the container may have
/// no IP left at all, in which case nothing is re-registered (a stale address
/// would otherwise linger).
async fn refresh_container_dns(state: &AppState, token: &str) {
    let Some(inspect) = crate::guest_query::inspect_container(state.proxy.client(), token).await
    else {
        tracing::debug!(
            container = token,
            "could not inspect container after network change; DNS entry left unchanged"
        );
        return;
    };
    let canonical = canonical_id_or_fallback(token, &inspect);
    state.runtime.deregister_dns_by_id(&canonical).await;
    // Deregistration also cleared the name alias — re-register it so later
    // lifecycle calls by name still resolve.
    if let Some(name) = extract_container_name(&inspect) {
        state
            .runtime
            .register_container_alias(&name, &canonical)
            .await;
    }
    if let Some((aliases, ip)) = extract_container_dns_info(&inspect) {
        state.runtime.register_dns(&canonical, &aliases, ip).await;
    }
}

/// Extracts the `Container` field (name or ID) from a network
/// connect/disconnect request body.
fn container_from_network_body(body: &[u8]) -> Option<String> {
    let value: serde_json::Value = serde_json::from_slice(body).ok()?;
    value
        .get("Container")?
        .as_str()
        .filter(|s| !s.is_empty())
        .map(String::from)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn container_field_from_connect_body() {
        let body = br#"{"Container":"web","EndpointConfig":{"IPAMConfig":{}}}"#;
        assert_eq!(container_from_network_body(body).as_deref(), Some("web"));
    }

    #[test]
    fn container_field_from_disconnect_body() {
        let body = br#"{"Container":"abc123","Force":true}"#;
        assert_eq!(container_from_network_body(body).as_deref(), Some("abc123"));
    }

    #[test]
    fn missing_or_empty_container_field_is_none() {
        assert_eq!(container_from_network_body(br#"{"Force":true}"#), None);
        assert_eq!(container_from_network_body(br#"{"Container":""}"#), None);
        assert_eq!(container_from_network_body(b"not json"), None);
    }
}