Documentation
¶
Overview ¶
Package mountplan turns a profile's local sources into the mount plan the launcher applies on the host: one line per directory to bind read-only into the console, with the globs the console may open under it. The launcher (scripts/locklog) checks every line again on the host (allowed roots, real paths, groups); this side only derives them.
Line format, one per line, fields separated by one space:
file <dir> <glob> a file source: bind <dir>, open only <glob> in it
journald the journal directories (/var/log/journal, /run/log/journal)
docker <glob> an approved container name glob of a docker source: the
launcher binds the containers root and maps the
containers whose name matches
remote the profile reads a remote source (Loki,
Elasticsearch, OpenSearch): nothing to bind, but the
console needs the network LOCKLOG_NETWORK names
(`locklog mounts` prints it last; Lines does not
return it)
No field holds a space, a comma, ';', ':', '=', a quote or a control character: the config refuses such globs, and Lines refuses them again.
Index ¶
Constants ¶
const ConsoleHome = "/home/locklog"
ConsoleHome is the console's home volume in its image: only the console mounts it (agents never do).
const RemoteLine = "remote"
RemoteLine is the plan's line of a profile with a remote source.
Variables ¶
This section is empty.
Functions ¶
func Dir ¶
Dir returns the directory to bind for an absolute file glob: the leading components before the first one holding a glob character, the file name itself excluded.
func TLSFiles ¶
TLSFiles checks that the console can read the tls_ca, tls_cert and tls_key files of p's remote sources without any mount of their own, and that no agent can read a client key: the launcher binds only the project's .locklog/ (read-only, also readable by agents) and the console's home volume, and the console confines its reads to them and the image's /etc/ssl. A CA certificate (public) may be in project/.locklog/, the home volume or /etc/ssl; a client certificate and its key only in the home volume, never under the project (a project inside the home volume is refused). project is the project root on the host, where .locklog/ is bound at the same path. Paths are compared cleaned; those under the project with their links resolved.
Types ¶
type Line ¶
type Line struct {
Kind string // "file", "journald" or "docker"
Dir string // file: the directory to bind
Glob string // file: the absolute glob opened under Dir; docker: the container name glob
}
Line is one entry of the plan.
Source Files