93 lines
3.9 KiB
Bash
93 lines
3.9 KiB
Bash
# Shared by the I1 human-proof spike scripts (row 87 research note). Sourced, never run.
|
|
# Same rules and helpers as ../i1-spikes/lib.sh (row 86), minus the proxy and CLI-image helpers.
|
|
#
|
|
# Rules it enforces for every spike (docs/plans/2026-10-12_i1-containerized-install.md):
|
|
# - every docker call goes through D, which names the rootless endpoint;
|
|
# - the first step refuses unless that endpoint reports name=rootless;
|
|
# - everything a spike creates carries the label mosaic.i1human=<spike>;
|
|
# - on exit, pass or fail, the spike's containers, networks, built images and
|
|
# scratch directory are removed, and the script checks that nothing is left.
|
|
#
|
|
# Exit codes: 0 the observed behavior matched the assertions, 1 it did not,
|
|
# 2 a rule refused the run (wrong daemon, leftovers). Output is also saved to
|
|
# out/<spike>.out.
|
|
|
|
EP=unix:///run/user/1000/docker.sock
|
|
# node:24-bookworm-slim, linux/amd64, pulled 2026-10-12T19:09Z, re-pulled 20:08Z after s0 removed it. The worker's base.
|
|
NODE_IMG=node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
|
|
HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
REPO=$(cd "$HERE/../../../.." && pwd)
|
|
|
|
D() { docker --host "$EP" "$@"; }
|
|
|
|
FAILS=0
|
|
say() { printf '%s\n' "$*"; }
|
|
# check DESCRIPTION CONDITION-EXIT-STATUS: records one assertion.
|
|
check() {
|
|
if [ "$2" -eq 0 ]; then say "ok $1"; else say "FAIL $1"; FAILS=$((FAILS + 1)); fi
|
|
}
|
|
|
|
# spike_begin NAME: pin the endpoint, set up output, scratch and cleanup.
|
|
spike_begin() {
|
|
SPIKE=$1
|
|
mkdir -p "$HERE/out"
|
|
exec > >(tee "$HERE/out/$SPIKE.out") 2>&1
|
|
say "# $SPIKE $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
local sec
|
|
if ! sec=$(D info --format '{{json .SecurityOptions}}' 2>&1); then
|
|
say "refused: $EP does not answer: $sec"; trap - EXIT; exit 2
|
|
fi
|
|
case $sec in
|
|
*'"name=rootless"'*) say "endpoint $EP: name=rootless" ;;
|
|
*) say "refused: $EP does not report name=rootless: $sec"; trap - EXIT; exit 2 ;;
|
|
esac
|
|
LABEL="mosaic.i1human=$SPIKE"
|
|
# The scratch parent is mktemp's 0700 directory; spikes mount only subdirectories.
|
|
SCRATCH=$(mktemp -d "${TMPDIR:-/tmp}/i1human-$SPIKE.XXXXXX")
|
|
say "scratch $SCRATCH"
|
|
trap spike_end EXIT
|
|
}
|
|
|
|
# Labels and the --rm flag a spike adds to every container it starts.
|
|
RUNFLAGS() { printf '%s\n' --label "$LABEL"; }
|
|
|
|
spike_end() {
|
|
local rc=$?
|
|
trap - EXIT
|
|
set +e
|
|
local ids
|
|
ids=$(D ps -a -q --filter "label=$LABEL")
|
|
[ -n "$ids" ] && D rm -f $ids >/dev/null 2>&1
|
|
ids=$(D network ls -q --filter "label=$LABEL")
|
|
[ -n "$ids" ] && D network rm $ids >/dev/null 2>&1
|
|
ids=$(D image ls -q --filter "label=$LABEL")
|
|
[ -n "$ids" ] && D image rm -f $ids >/dev/null 2>&1
|
|
# Rootless uid 0 in a container is the host user; other container uids map into
|
|
# the subuid range and may have left files this user cannot remove. Remove them
|
|
# from inside a throwaway container as container root (host jwoltje).
|
|
rm -rf "$SCRATCH" 2>/dev/null
|
|
if [ -e "$SCRATCH" ]; then
|
|
D run --rm --label "$LABEL" -v "$SCRATCH:/s" "$NODE_IMG" sh -c 'rm -rf /s/* /s/.[!.]* 2>/dev/null' >/dev/null 2>&1
|
|
rm -rf "$SCRATCH" 2>/dev/null
|
|
fi
|
|
local left=0
|
|
[ -n "$(D ps -a -q --filter "label=$LABEL")" ] && left=1
|
|
[ -n "$(D network ls -q --filter "label=$LABEL")" ] && left=1
|
|
[ -n "$(D image ls -q --filter "label=$LABEL")" ] && left=1
|
|
[ -e "$SCRATCH" ] && left=1
|
|
if [ "$left" -eq 0 ]; then
|
|
say "cleanup: no container, network, image or scratch directory labelled $SPIKE is left"
|
|
else
|
|
say "cleanup: LEFTOVERS for $SPIKE"; rc=2
|
|
fi
|
|
if [ "$rc" -eq 0 ] && [ "$FAILS" -ne 0 ]; then rc=1; fi
|
|
if [ "$rc" -eq 0 ]; then say "result: pass"; else say "result: exit $rc ($FAILS failed assertion(s))"; fi
|
|
exit "$rc"
|
|
}
|
|
|
|
# Pull the pinned base image if the rootless daemon does not hold it. The image
|
|
# is shared by the spikes and removed by s0-clean-images.sh, not per spike.
|
|
need_node_image() {
|
|
D image inspect "$NODE_IMG" >/dev/null 2>&1 || D pull -q "$NODE_IMG" >/dev/null
|
|
}
|