Documentation
¶
Overview ¶
Package socketproxy lets Mooring MANAGE its own read-only docker-socket-proxy (plan §3) so the operator never runs a docker command — they only ever write mooring.yaml. The proxy compose is EMBEDDED in the binary (never operator input); at boot Mooring writes it under the data dir and brings it up idempotently.
The proxy is the READ-plane security boundary: the raw docker socket is mounted ONLY into the proxy (read-only), and Mooring polls container state through it on loopback. Write-plane actions never use it — they shell out to `docker compose`.
Index ¶
Constants ¶
const Project = "mooring-socket-proxy"
Project is the fixed compose project name for the managed proxy.
Variables ¶
This section is empty.
Functions ¶
func Compose ¶
func Compose() []byte
Compose returns the embedded, Mooring-owned proxy compose bytes.
func EnsureRunning ¶
func EnsureRunning(ctx context.Context, runner *dockerexec.Runner, dataDir string, onLine func(string)) error
EnsureRunning materializes the embedded proxy compose and brings it up idempotently (`docker compose up -d`). It is UNGATED (the read plane must work on a small box) and best-effort: a docker error is returned for the caller to log, never treated as fatal — the read plane simply reports "unavailable" until the proxy is up. The compose is embedded, so nothing operator-controlled ever reaches the docker argv.
func Materialize ¶
Materialize writes the embedded proxy compose under dataDir/socket-proxy (dir 0700, file 0600) and returns its path. It is pure I/O (no docker), so it is unit-testable.
Types ¶
This section is empty.
Source Files