Documentation
¶
Overview ¶
Package dockerclient wraps the moby Go SDK (github.com/moby/moby/client) to manage sandbox containers for the docker sandbox backend. The client is configured from the process environment (DOCKER_HOST, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH, DOCKER_API_VERSION) via client.FromEnv; DOCKER_CONTEXT is intentionally not supported — it's a CLI-only concept.
Index ¶
- Constants
- func CleanupOrphanedContainers(ctx context.Context, c *Client, stellaHome string)
- type API
- type Client
- func (c *Client) Close() error
- func (c *Client) ContainerAlive(ctx context.Context, containerID string) (bool, error)
- func (c *Client) ContainerList(ctx context.Context, opts mobyclient.ContainerListOptions) (mobyclient.ContainerListResult, error)
- func (c *Client) CreateAndStart(ctx context.Context, opts CreateOptions) (string, error)
- func (c *Client) EnsureImageReady(ctx context.Context, image, containerName string) error
- func (c *Client) Exec(ctx context.Context, opts ExecOptions) (*ExecResult, error)
- func (c *Client) ImageExists(ctx context.Context, image string) (bool, error)
- func (c *Client) InspectContainerState(ctx context.Context, containerRef string) (*ContainerState, error)
- func (c *Client) InspectSelf(ctx context.Context, ref string) (*SelfContainer, error)
- func (c *Client) PullImage(ctx context.Context, image string) error
- func (c *Client) StartExec(ctx context.Context, opts ExecOptions) (*ExecHandle, error)
- func (c *Client) Stop(ctx context.Context, containerID string) error
- func (c *Client) Version(ctx context.Context) (*VersionInfo, error)
- func (c *Client) VolumeCreate(ctx context.Context, opts mobyclient.VolumeCreateOptions) (mobyclient.VolumeCreateResult, error)
- func (c *Client) VolumeList(ctx context.Context, opts mobyclient.VolumeListOptions) (mobyclient.VolumeListResult, error)
- func (c *Client) VolumeRemove(ctx context.Context, name string, opts mobyclient.VolumeRemoveOptions) error
- type ContainerState
- type CreateOptions
- type ExecHandle
- type ExecOptions
- type ExecResult
- type Mount
- type MountType
- type NetworkMode
- type SelfContainer
- type SelfNetwork
- type VersionInfo
Constants ¶
const ( LabelSessionID = "stella.sandbox.session_id" // LabelStellaHome scopes orphan cleanup. It stores a daemon-visible STELLA_HOME // path for bind mounts, or "volume:<name>" for named-volume mode. LabelStellaHome = "stella.sandbox.stella_home" LabelCreatedAt = "stella.sandbox.created_at" // RFC3339 LabelOwnerPID = "stella.sandbox.owner_pid" // PID of the creating stella process )
Variables ¶
This section is empty.
Functions ¶
func CleanupOrphanedContainers ¶
CleanupOrphanedContainers force-removes stella-labeled containers whose owning process is clearly gone:
- dead-state containers (exited, dead, created) are always removed
- running / paused containers are removed only when their owner_pid label points to a process that no longer exists on this host — this keeps peer stella processes with live sessions safe from another stella startup
- transitional states (restarting, …) fall back to an age cutoff so truly-hung containers eventually clear
Best-effort: errors are logged, not returned.
Types ¶
type API ¶
type API interface {
ServerVersion(ctx context.Context, opts mobyclient.ServerVersionOptions) (mobyclient.ServerVersionResult, error)
ImageInspect(ctx context.Context, image string, opts ...mobyclient.ImageInspectOption) (mobyclient.ImageInspectResult, error)
ImagePull(ctx context.Context, ref string, opts mobyclient.ImagePullOptions) (mobyclient.ImagePullResponse, error)
ContainerCreate(ctx context.Context, opts mobyclient.ContainerCreateOptions) (mobyclient.ContainerCreateResult, error)
ContainerStart(ctx context.Context, container string, opts mobyclient.ContainerStartOptions) (mobyclient.ContainerStartResult, error)
ContainerStop(ctx context.Context, container string, opts mobyclient.ContainerStopOptions) (mobyclient.ContainerStopResult, error)
ContainerRemove(ctx context.Context, container string, opts mobyclient.ContainerRemoveOptions) (mobyclient.ContainerRemoveResult, error)
ContainerInspect(ctx context.Context, container string, opts mobyclient.ContainerInspectOptions) (mobyclient.ContainerInspectResult, error)
ContainerList(ctx context.Context, opts mobyclient.ContainerListOptions) (mobyclient.ContainerListResult, error)
VolumeCreate(ctx context.Context, opts mobyclient.VolumeCreateOptions) (mobyclient.VolumeCreateResult, error)
VolumeList(ctx context.Context, opts mobyclient.VolumeListOptions) (mobyclient.VolumeListResult, error)
VolumeRemove(ctx context.Context, volumeID string, opts mobyclient.VolumeRemoveOptions) (mobyclient.VolumeRemoveResult, error)
ExecCreate(ctx context.Context, container string, opts mobyclient.ExecCreateOptions) (mobyclient.ExecCreateResult, error)
ExecAttach(ctx context.Context, execID string, opts mobyclient.ExecAttachOptions) (mobyclient.ExecAttachResult, error)
ExecInspect(ctx context.Context, execID string, opts mobyclient.ExecInspectOptions) (mobyclient.ExecInspectResult, error)
Close() error
}
API is the subset of moby/moby/client.APIClient this package uses. Kept narrow so tests can substitute a fake without pulling the full SDK surface.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client wraps a moby SDK client. Constructed from environment (DOCKER_HOST, DOCKER_API_VERSION, DOCKER_CERT_PATH, DOCKER_TLS_VERIFY); see the moby client docs for the full list.
func New ¶
New returns a Client configured from the process environment. API-version negotiation is enabled by default in the moby SDK.
func NewWithAPI ¶
NewWithAPI constructs a Client with an injected API implementation. The moby SDK's *client.Client already satisfies API; callers typically use New() instead. Exported for tests and advanced callers that want to override the SDK client (e.g. to inject a TLS-wrapped instance).
func (*Client) ContainerAlive ¶
ContainerAlive reports whether the container is running. Returns (false, nil) when the container no longer exists.
func (*Client) ContainerList ¶ added in v0.60.0
func (c *Client) ContainerList(ctx context.Context, opts mobyclient.ContainerListOptions) (mobyclient.ContainerListResult, error)
func (*Client) CreateAndStart ¶
CreateAndStart creates a container with an always-up sentinel entrypoint (`sh -c 'tail -f /dev/null'`), starts it, and returns the container ID. If the image is not present locally it is pulled automatically.
func (*Client) EnsureImageReady ¶ added in v0.60.0
EnsureImageReady makes sure image exists locally, pulling it once per Client when needed. Concurrent callers for the same image share the same inspect/pull.
func (*Client) Exec ¶
func (c *Client) Exec(ctx context.Context, opts ExecOptions) (*ExecResult, error)
Exec runs a blocking exec, collecting stdout/stderr into memory.
func (*Client) ImageExists ¶
ImageExists reports whether the image exists locally. Returns false (no error) when the daemon reports not-found; any other error surfaces.
func (*Client) InspectContainerState ¶
func (c *Client) InspectContainerState(ctx context.Context, containerRef string) (*ContainerState, error)
InspectContainerState returns the running state and exit code of a container referenced by ID or name. Returns (nil, nil) when the container does not exist.
func (*Client) InspectSelf ¶ added in v0.49.2
InspectSelf inspects the container referenced by ref — typically os.Hostname(), which Docker defaults to the short container ID — and reports its networks so a sibling sandbox can be attached and pointed back at this process. Returns (nil, nil) when ref is not a known container (e.g. stellad runs on the host), so callers fall back to explicit configuration or loopback.
func (*Client) PullImage ¶
PullImage pulls an image, draining the JSON progress stream into slog.Info.
func (*Client) StartExec ¶
func (c *Client) StartExec(ctx context.Context, opts ExecOptions) (*ExecHandle, error)
StartExec is the streaming variant: returns stdout/stderr pipes and a Wait() that blocks until the exec finishes and returns its exit code.
func (*Client) Stop ¶
Stop sends SIGTERM with a 2-second grace period, then removes the container. Missing-container errors are swallowed so Close is idempotent.
func (*Client) Version ¶
func (c *Client) Version(ctx context.Context) (*VersionInfo, error)
Version queries the daemon for server + client version info. Used by preflight to confirm daemon reachability.
func (*Client) VolumeCreate ¶
func (c *Client) VolumeCreate(ctx context.Context, opts mobyclient.VolumeCreateOptions) (mobyclient.VolumeCreateResult, error)
func (*Client) VolumeList ¶ added in v0.60.0
func (c *Client) VolumeList(ctx context.Context, opts mobyclient.VolumeListOptions) (mobyclient.VolumeListResult, error)
func (*Client) VolumeRemove ¶ added in v0.60.0
func (c *Client) VolumeRemove(ctx context.Context, name string, opts mobyclient.VolumeRemoveOptions) error
type ContainerState ¶
ContainerState holds the container running state and last exit code.
type CreateOptions ¶
type CreateOptions struct {
Image string
WorkspaceHost string // absolute host path (daemon-side)
WorkspaceMount string // absolute in-container path (e.g. "/workspace")
ExtraMounts []Mount // additional host -> container mounts; ReadOnly is honored per mount
NetworkMode NetworkMode // disabled | allow_all
Network string // optional Docker network to join (e.g. to reach stellad in DooD); ignored when NetworkMode is disabled
Env map[string]string
User string // optional container user override
Labels map[string]string // must include LabelSessionID + LabelStellaHome + LabelCreatedAt
Name string // optional; caller builds "stella-sandbox-<session-id>"
}
CreateOptions configures a new sandbox container.
type ExecHandle ¶
type ExecHandle struct {
// Stdin is non-nil only when opts.Stdin was nil (i.e. we opened a pipe for the caller).
Stdin io.WriteCloser
Stdout io.ReadCloser
Stderr io.ReadCloser
// Wait blocks until the exec finishes and returns the exit code.
Wait func() (int, error)
// Kill terminates the underlying exec attach.
Kill func() error
}
ExecHandle is the streaming variant returned by StartExec.
type ExecOptions ¶
type ExecOptions struct {
ContainerID string
Command []string // argv — not a shell string
Cwd string // absolute in-container path
Env map[string]string
User string // optional override
Stdin io.Reader // optional
Tty bool // default false
}
ExecOptions configures a docker exec call.
type ExecResult ¶
ExecResult holds the result of a blocking Exec call.
type Mount ¶
type Mount struct {
HostPath string
ContainerPath string
ReadOnly bool
Type MountType
// VolumeSubpath selects a sub-path within the named volume to mount.
// Only valid when Type is MountTypeVolume. Requires Docker Engine 25+.
VolumeSubpath string
}
Mount represents a mount from a daemon-visible source to a container path. Bind mount sources are interpreted by the daemon, so when stella runs inside a container they must already be translated to daemon-visible paths before reaching this struct. Volume mount sources are Docker volume names.
type MountType ¶
type MountType string
MountType identifies how Docker should mount Source into the container.
type NetworkMode ¶
type NetworkMode string
NetworkMode controls the container's network access.
const ( NetworkDisabled NetworkMode = "disabled" NetworkAllowAll NetworkMode = "allow_all" )
type SelfContainer ¶ added in v0.49.2
type SelfContainer struct {
ID string
Name string // without the leading slash docker prepends
Networks []SelfNetwork
BridgeIP string
}
SelfContainer describes the container the current process runs in, so a sibling sandbox can be wired to reach it. Networks holds the user-defined networks (DNS-capable; a sandbox can reach this container by Name on them), sorted by name. BridgeIP is the address on the default bridge, used as a last resort when there is no user-defined network (the bridge has no embedded DNS, so only its IP is reachable).
type SelfNetwork ¶ added in v0.49.2
type SelfNetwork struct {
Name string
IP string // this container's IP on the network, empty if unset
}
SelfNetwork is one network the current container is attached to.
type VersionInfo ¶
VersionInfo holds the minimal version data we care about. The shape is kept stable across the CLI→SDK migration so callers don't churn.