Documentation
¶
Overview ¶
Package engineclient owns the long-lived cavet-engine container for one repository: lifecycle, exec plumbing, report copy-out, and path translation (cli-spec §10). It knows Docker and paths; it never parses findings.
Index ¶
- func ContainerName(root string) string
- func ContainerToHost(root, containerPath string) string
- func HostToContainer(root, hostPath string) string
- func RepoRelative(containerPath, target string) string
- type Client
- func (c *Client) CopyOut(ctx context.Context, containerPath string) ([]byte, error)
- func (c *Client) EnsureRunning(ctx context.Context) error
- func (c *Client) Exec(ctx context.Context, cmd []string) (ExecResult, error)
- func (c *Client) ImageDigest(ctx context.Context, ref string) (string, error)
- func (c *Client) ImagePresent(ctx context.Context) error
- func (c *Client) Name() string
- func (c *Client) NextScanDir() string
- func (c *Client) Ping(ctx context.Context) error
- func (c *Client) Prune(ctx context.Context, all bool) ([]PruneEntry, error)
- func (c *Client) Pull(ctx context.Context, ref string) (io.ReadCloser, error)
- func (c *Client) Remove(ctx context.Context) error
- func (c *Client) Status(ctx context.Context) (running, healthy bool, imageID string, err error)
- type ExecResult
- type PruneAction
- type PruneEntry
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ContainerName ¶
ContainerName derives the stable per-repository container name.
func ContainerToHost ¶
ContainerToHost maps a /workspace-relative container path back to the host.
func HostToContainer ¶
HostToContainer maps a host path under the repository root into the container mount. Paths outside the mount map to "".
func RepoRelative ¶
RepoRelative strips a scan target prefix (/workspace or /scan/<n>) from a container path, yielding a repository-relative slash path. Already-relative paths pass through with any leading slash trimmed.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
func New ¶
New builds a client. pinnedDigest may be empty in development (local image tag, no drift enforcement); production always pins (spec §3.4).
func (*Client) CopyOut ¶
CopyOut retrieves a single file's bytes from the container. Reports are megabytes at worst (spike §5); read into memory and discard (cli-spec §10.3).
func (*Client) EnsureRunning ¶
EnsureRunning guarantees a healthy container: create if absent, restart if stopped (transparently, spec §7.1), verify the digest first. Digest drift is a hard stop, never silent scanning on a stale engine (cli-spec §10.2).
func (*Client) Exec ¶
Exec runs cmd in the container with stdout/stderr demultiplexed. Workdir is /workspace. Exit codes are data (gitleaks exits 1 on leaks — cli-spec §7); transport errors are the only error returns.
func (*Client) ImageDigest ¶
ImageDigest returns the image's registry digest when it has one (locally built images have none) — the pin `cavet init` records.
func (*Client) ImagePresent ¶
ImagePresent reports whether the engine image exists locally.
func (*Client) NextScanDir ¶
NextScanDir allocates a fresh staging directory inside the container. The name mixes the clock (unique across processes — the container outlives CLI invocations, so a bare counter would collide across commands) with a local counter (Windows clock granularity can repeat adjacent nanoseconds — measured). Dirs die with the container (cli-spec §6).
func (*Client) Prune ¶
Prune classifies every cavet-* container and force-removes the ones the classification marks for removal. HostConfig.Binds (not the summary's Mounts) is the source of truth: Docker Desktop rewrites mount sources to in-VM paths, while Binds keeps the host path as created. Containers outside the cavet- prefix are invisible to prune, and the calling repository's own container is never touched.
func (*Client) Pull ¶
Pull streams the image from its registry. Progress reporting is the caller's job; drain the reader to completion or the pull aborts.
type ExecResult ¶
ExecResult carries a container command's captured streams and exit code.
type PruneAction ¶
type PruneAction string
PruneAction is prune's decision for one cavet-* container, phrased for the report line the CLI prints.
const ( PruneRemovedOrphan PruneAction = "removed as orphan" // bind source no longer exists on the host PruneRemovedAll PruneAction = "removed (--all)" // --all, not the calling repository's PruneKept PruneAction = "kept, root exists" // nothing to do PruneKeptSelf PruneAction = "kept, current repository" // never touched, --all included PruneSkippedNoBind PruneAction = "skipped, no /workspace bind" // conservative on ambiguity PruneSkippedStat PruneAction = "skipped, root stat failed" // ambiguity is never a removal )
type PruneEntry ¶
type PruneEntry struct {
Name string
Root string // host path bound at /workspace; "" when there is none
Action PruneAction
}
PruneEntry is one cavet-* container and what prune decided about it.
Source Files