isoloom_render/configure/
dockerfile.rs

1//! The Dockerfile Isoloom generates from a container's recipe (design §2.2–§2.3): `FROM` its
2//! OS's official image (pinned by digest), the project folder (`/opt/isoloom`, the same path a
3//! VM has) as its working folder, then each step in order. Scripts and copies are the
4//! Dockerfile's own `COPY` and `RUN`, a template a `COPY` of the file Isoloom filled in, and every
5//! other step one `RUN` of the shell library's call. A service doesn't run at build: Isoloom's
6//! runner ([`super::runner`]) is the image's entrypoint, and starts it. The project folder is the
7//! build context.
8
9use isoloom_plan::configure::{ContainerProcess, Resource, RunPlan, TemplatePlan};
10use isoloom_plan::{Build, Environment, Image, MachineShape};
11use isoloom_spec::syntax::Mode;
12
13use super::{Configured, rendered_path, runner, shell};
14use crate::steps::PROJECT_DIR;
15use crate::{GeneratedFile, header};
16
17/// Where the shell library is in the image.
18const LIBRARY: &str = "/usr/local/lib/isoloom/configure.sh";
19
20/// Where the runner is in the image.
21const RUNNER: &str = "/usr/local/bin/isoloom-run";
22
23/// The generated Dockerfiles of `env`'s containers, each at its path (its base image pulled
24/// through the registry mirrors), with what each builds from: the shell library, the runner
25/// and the templates filled in.
26#[must_use]
27pub fn files(env: &Environment) -> Vec<GeneratedFile> {
28    let mut out = Vec::new();
29    for (name, mp) in &env.machines {
30        let (
31            Some(Image::Container {
32                build: Some(Build::Generated { dockerfile, base, process }),
33                ..
34            }),
35            Some(c),
36            MachineShape::Container,
37        ) = (&mp.image, Configured::of(env, name), mp.shape)
38        else {
39            continue;
40        };
41        out.push(GeneratedFile {
42            path: dockerfile.clone(),
43            contents: render(&c, &env.images.pull(base), process),
44        });
45        if super::uses_library(c.recipe()) && !out.iter().any(|f| f.path == shell::LIBRARY_PATH) {
46            out.push(shell::library_file());
47        }
48        out.extend(runner::file(&c, process));
49        out.extend(templates(&c));
50    }
51    out
52}
53
54/// The Dockerfile of machine `c`'s image, from `base`, running `process`.
55#[must_use]
56pub fn render(c: &Configured<'_>, base: &str, process: &ContainerProcess) -> String {
57    let library = if super::uses_library(c.recipe()) {
58        format!("COPY {} {LIBRARY}\n", shell::LIBRARY_PATH)
59    } else {
60        String::new()
61    };
62    // `start` is the runner's, at each start; the build installs and configures.
63    let recipe = c.recipe();
64    let steps: String = recipe.install.iter().chain(&recipe.configure).filter_map(|r| instructions(c, r)).collect();
65    let entrypoint = if process.is_runner() {
66        // The image's own command stays its arguments, which the runner hands its entrypoint.
67        let command = match process {
68            ContainerProcess::Started { command, .. } => serde_json::to_string(command).unwrap_or_else(|_| "[]".to_owned()),
69            _ => "[]".to_owned(),
70        };
71        format!(
72            "{}COPY --chmod=0755 {} {RUNNER}\nENTRYPOINT [\"{RUNNER}\"]\nCMD {command}\n",
73            start_files(c),
74            runner::path(c.machine())
75        )
76    } else {
77        String::new()
78    };
79    format!(
80        "{}# The container form of machine `{}`: its OS's image and its steps.\nFROM {base}\nWORKDIR {PROJECT_DIR}\n{library}{steps}{entrypoint}",
81        header("#"),
82        c.machine()
83    )
84}
85
86/// The project files the recipe's `start` steps read when the runner runs them at each start
87/// (their scripts, their copies' sources), copied into the image's project folder.
88fn start_files(c: &Configured<'_>) -> String {
89    c.recipe()
90        .start
91        .iter()
92        .filter_map(|r| match r {
93            Resource::Run(run) => Some(run.script.as_str()),
94            Resource::Copy(cp) => Some(cp.from.as_str()),
95            _ => None,
96        })
97        .map(|path| format!("COPY {path} {path}\n"))
98        .collect::<Vec<_>>()
99        .concat()
100}
101
102/// One step's instructions; `None` for a step a container doesn't run at build (a service, which
103/// the runner starts; a firewall, which a container doesn't have).
104fn instructions(c: &Configured<'_>, step: &Resource) -> Option<String> {
105    let lines = match step {
106        Resource::Run(run) => script(run),
107        Resource::Copy(cp) => {
108            let owner = cp.owner.as_ref().map(|o| format!("--chown={o} ")).unwrap_or_default();
109            let mode = cp.mode.map(|m| format!("--chmod={m} ")).unwrap_or_default();
110            format!("COPY {owner}{mode}{} {}\n", cp.from, cp.to)
111        }
112        Resource::Template(t) => template(c, t),
113        Resource::Service(_) | Resource::Firewall(_) | Resource::Reboot | Resource::Playbook(_) => return None,
114        other => {
115            let call = shell::call(c, other)?;
116            let ignore = if shell::literal_dollar(&call) { "# hadolint ignore=SC2016\n" } else { "" };
117            format!("{ignore}RUN . {LIBRARY} && {call}")
118        }
119    };
120    Some(lines)
121}
122
123/// A project script, copied and run (behind its `creates`).
124fn script(run: &RunPlan) -> String {
125    let script = &run.script;
126    let line = match &run.creates {
127        Some(path) => format!("[ -e {path} ] || sh {script}"),
128        None => format!("sh {script}"),
129    };
130    format!("COPY {script} {script}\nRUN {line}\n")
131}
132
133/// A template: the file Isoloom filled in, copied with its owner, group and mode (`0644` when it
134/// gives none); a template that can't be filled in fails the build, saying why.
135fn template(c: &Configured<'_>, t: &TemplatePlan) -> String {
136    if let Err(why) = c.template(&t.from) {
137        return format!("RUN . {LIBRARY} && {}\n", shell::words("isoloom_fail", [why]));
138    }
139    let chown = match (&t.owner, &t.group) {
140        (Some(o), Some(g)) => format!("--chown={o}:{g} "),
141        (Some(o), None) => format!("--chown={o} "),
142        (None, Some(g)) => format!("--chown=root:{g} "),
143        (None, None) => String::new(),
144    };
145    let mode = t.mode.unwrap_or(Mode::CONFIG);
146    format!("COPY {chown}--chmod={mode} {} {}\n", rendered_path(c.machine(), &t.from), t.to)
147}
148
149/// The templates machine `c` builds with, filled in: one file each, at
150/// [`rendered_path`] (those that can't be filled in fail the build instead).
151fn templates(c: &Configured<'_>) -> Vec<GeneratedFile> {
152    c.recipe()
153        .resources()
154        .filter_map(|r| match r {
155            Resource::Template(t) => Some(GeneratedFile {
156                path: rendered_path(c.machine(), &t.from),
157                contents: c.template(&t.from).ok()?,
158            }),
159            _ => None,
160        })
161        .collect()
162}
163
164#[cfg(test)]
165mod tests;
isoloom_render/configure/dockerfile.rs

isoloom_render/configure/
dockerfile.rs
