docker

package
v0.39.9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package docker provides Docker operations for StackKits.

Index

Constants

This section is empty.

Variables

View Source 
var CanonicalComposeProjects = []string{
	"stackkit-basement-core",
	"stackkit-cloud-core",
	"stackkit-cloud-core-standalone",
}

CanonicalComposeProjects are the native core Compose project names created by Basement and Cloud Kit Apply. Whole-deployment remove always targets them.

Functions

func GetServiceStatus 

func GetServiceStatus(container *ContainerInfo) models.ServiceStatus

GetServiceStatus converts container info to service status

func StackKitsComposeProjectsToRemove 

func StackKitsComposeProjectsToRemove(discovered []string) []string

StackKitsComposeProjectsToRemove unions discovered compose projects that use the stackkit- prefix with the canonical core project names.

Types

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client handles Docker operations

func NewClient 

func NewClient(opts ...ClientOption) *Client

NewClient creates a new Docker client

func NewLocalClient 

func NewLocalClient(opts ...ClientOption) *Client

NewLocalClient creates a Docker CLI client that cannot follow process or option-provided remote daemon configuration. Every command binds the platform's canonical local socket/named pipe explicitly.

func (*Client) CanRunContainers 

func (c *Client) CanRunContainers(ctx context.Context) bool

CanRunContainers tests whether the Docker daemon can actually create containers. On some VPS (OpenVZ/LXC), Docker installs and the daemon starts, but the kernel blocks container creation (unshare/namespace errors).

func (*Client) ContainerIPAddress 

func (c *Client) ContainerIPAddress(ctx context.Context, nameOrID string) (string, error)

ContainerIPAddress returns the first Docker network IP assigned to a container. Host-network containers legitimately return an empty string.

func (*Client) Exec 

func (c *Client) Exec(ctx context.Context, container string, command []string) (string, error)

Exec runs a command in a container

func (*Client) ExecWithStdin 

func (c *Client) ExecWithStdin(ctx context.Context, container string, command []string, sensitiveInput []byte) (string, error)

ExecWithStdin runs a command in a container with docker exec's interactive stdin enabled. The input is treated as sensitive material: it is never copied into argv, inherited environment entries containing it are removed, and any command output echoing it is redacted before returning.

func (*Client) GetContainerHealth 

func (c *Client) GetContainerHealth(ctx context.Context, nameOrID string) (models.HealthStatus, error)

GetContainerHealth gets the health status of a container

func (*Client) GetContainersByLabel 

func (c *Client) GetContainersByLabel(ctx context.Context, label string) ([]ContainerInfo, error)

GetContainersByLabel returns all containers carrying an exact Docker label filter. Managed platform deployments use compose-project labels, while base StackKit services use the stackkit.layer filter above.

func (*Client) GetStackKitContainers 

func (c *Client) GetStackKitContainers(ctx context.Context) ([]ContainerInfo, error)

GetStackKitContainers returns containers managed by StackKit

func (*Client) InspectContainer 

func (c *Client) InspectContainer(ctx context.Context, nameOrID string) (*ContainerInfo, error)

InspectContainer inspects a container

func (*Client) InspectNetwork 

func (c *Client) InspectNetwork(ctx context.Context, name string) (*NetworkInfo, error)

InspectNetwork returns the typed isolation and peer projection for one Docker network.

func (*Client) IsInstalled 

func (c *Client) IsInstalled() bool

IsInstalled checks if Docker is installed

func (*Client) IsRunning 

func (c *Client) IsRunning(ctx context.Context) bool

IsRunning checks if Docker daemon is running

func (*Client) ListComposeProjects 

func (c *Client) ListComposeProjects(ctx context.Context) ([]string, error)

ListComposeProjects returns unique Compose project names from containers that carry com.docker.compose.project.

func (*Client) ListContainers 

func (c *Client) ListContainers(ctx context.Context, all bool) ([]ContainerInfo, error)

ListContainers lists all containers

func (*Client) ListNetworksByLabel 

func (c *Client) ListNetworksByLabel(ctx context.Context, label string) ([]string, error)

ListNetworksByLabel lists Docker networks matching a label filter.

func (*Client) ListVolumesByLabel 

func (c *Client) ListVolumesByLabel(ctx context.Context, label string) ([]string, error)

ListVolumesByLabel lists Docker volumes matching a label filter.

func (*Client) Logs 

func (c *Client) Logs(ctx context.Context, container string, tail int) (string, error)

Logs returns container logs

func (*Client) NetworkExists 

func (c *Client) NetworkExists(ctx context.Context, name string) bool

NetworkExists checks if a network exists

func (*Client) Prune 

func (c *Client) Prune(ctx context.Context) (int64, error)

Prune removes dangling images and build cache to reclaim disk space. Returns the number of bytes reclaimed.

func (*Client) Pull 

func (c *Client) Pull(ctx context.Context, image string) error

Pull pulls a Docker image with a 10-minute timeout.

func (*Client) RemoveComposeProject 

func (c *Client) RemoveComposeProject(ctx context.Context, project string, deleteVolumes bool) error

RemoveComposeProject deletes containers, networks, and volumes owned by one Compose project. Missing resources are success. Empty lists never invoke rm.

func (*Client) RemoveContainer 

func (c *Client) RemoveContainer(ctx context.Context, nameOrID string) error

RemoveContainer force-removes a container (stopped or running).

func (*Client) RemoveImage 

func (c *Client) RemoveImage(ctx context.Context, image string) error

RemoveImage removes a Docker image by name/tag.

func (*Client) RemoveNetwork 

func (c *Client) RemoveNetwork(ctx context.Context, name string) error

RemoveNetwork removes a Docker network by name.

func (*Client) RemoveVolume 

func (c *Client) RemoveVolume(ctx context.Context, name string) error

RemoveVolume removes a Docker volume by name.

func (*Client) ResolveComposeServiceContainer 

func (c *Client) ResolveComposeServiceContainer(ctx context.Context, project, service string) (*ContainerInfo, error)

ResolveComposeServiceContainer resolves one running, healthy container by the two exact labels Compose owns. Native-v2 lifecycle code uses this instead of assuming that a service name is also the runtime container name.

func (*Client) StartContainer 

func (c *Client) StartContainer(ctx context.Context, nameOrID string) error

StartContainer starts one exact container identity. Callers that need idempotent restoration inspect first and only invoke this method while the container is stopped and was recorded as running before quiescence.

func (*Client) StopContainer 

func (c *Client) StopContainer(ctx context.Context, nameOrID string) error

StopContainer stops one exact container identity. Callers that need idempotent quiescence inspect first and only invoke this method while the container is still running.

func (*Client) StopContainerWithTimeout 

func (c *Client) StopContainerWithTimeout(ctx context.Context, nameOrID string, grace time.Duration) error

StopContainerWithTimeout stops one exact container identity with an explicit Docker grace period. StopContainer intentionally retains its historical daemon-default behavior for consumers that do not own a cold snapshot boundary.

func (*Client) Version 

func (c *Client) Version(ctx context.Context) (string, error)

Version returns the Docker version

func (*Client) VolumeExists 

func (c *Client) VolumeExists(ctx context.Context, name string) bool

VolumeExists checks if a volume exists

type ClientOption 

type ClientOption func(*Client)

ClientOption configures the Docker client

func WithBinary 

func WithBinary(binary string) ClientOption

WithBinary sets the Docker binary path

func WithEnv 

func WithEnv(values ...string) ClientOption

WithEnv adds Docker transport environment entries (for example DOCKER_HOST and DOCKER_SSH_COMMAND) without mutating the process environment. This is used by managed-runtime verification to inspect the same remote host that a rollout targeted.

func WithTimeout 

func WithTimeout(timeout time.Duration) ClientOption

WithTimeout sets the operation timeout

type ContainerConfig 

type ContainerConfig struct {
	Hostname     string                `json:"Hostname"`
	Image        string                `json:"Image"`
	StopSignal   string                `json:"StopSignal"`
	User         string                `json:"User"`
	WorkingDir   string                `json:"WorkingDir"`
	Env          []string              `json:"Env"`
	ExposedPorts map[string]any        `json:"ExposedPorts"`
	Entrypoint   []string              `json:"Entrypoint"`
	Cmd          []string              `json:"Cmd"`
	Labels       map[string]string     `json:"Labels"`
	Healthcheck  *ContainerHealthcheck `json:"Healthcheck"`
}

ContainerConfig is the security-relevant runtime projection returned by docker inspect. Environment values are retained so the native-v2 adapter can require the exact credential-free environment inherited from its pinned image.

type ContainerDeviceMapping 

type ContainerDeviceMapping struct {
	PathOnHost        string `json:"PathOnHost"`
	PathInContainer   string `json:"PathInContainer"`
	CgroupPermissions string `json:"CgroupPermissions"`
}

type ContainerDeviceRequest 

type ContainerDeviceRequest struct {
	Driver       string            `json:"Driver"`
	Count        int               `json:"Count"`
	DeviceIDs    []string          `json:"DeviceIDs"`
	Capabilities [][]string        `json:"Capabilities"`
	Options      map[string]string `json:"Options"`
}

type ContainerHealthcheck 

type ContainerHealthcheck struct {
	Test        []string `json:"Test"`
	Interval    int64    `json:"Interval"`
	Timeout     int64    `json:"Timeout"`
	Retries     int      `json:"Retries"`
	StartPeriod int64    `json:"StartPeriod"`
}

type ContainerHostConfig 

type ContainerHostConfig struct {
	Binds                   []string                          `json:"Binds"`
	Mounts                  []ContainerHostMount              `json:"Mounts"`
	ContainerIDFile         string                            `json:"ContainerIDFile"`
	LogConfig               ContainerLogConfig                `json:"LogConfig"`
	NetworkMode             string                            `json:"NetworkMode"`
	PortBindings            map[string][]ContainerPortBinding `json:"PortBindings"`
	RestartPolicy           ContainerRestartPolicy            `json:"RestartPolicy"`
	AutoRemove              bool                              `json:"AutoRemove"`
	VolumeDriver            string                            `json:"VolumeDriver"`
	VolumesFrom             []string                          `json:"VolumesFrom"`
	ConsoleSize             [2]uint                           `json:"ConsoleSize"`
	CapAdd                  []string                          `json:"CapAdd"`
	CapDrop                 []string                          `json:"CapDrop"`
	CgroupnsMode            string                            `json:"CgroupnsMode"`
	DNS                     []string                          `json:"Dns"`
	DNSOptions              []string                          `json:"DnsOptions"`
	DNSSearch               []string                          `json:"DnsSearch"`
	ExtraHosts              []string                          `json:"ExtraHosts"`
	GroupAdd                []string                          `json:"GroupAdd"`
	IpcMode                 string                            `json:"IpcMode"`
	Cgroup                  string                            `json:"Cgroup"`
	Links                   []string                          `json:"Links"`
	OomScoreAdj             int                               `json:"OomScoreAdj"`
	PidMode                 string                            `json:"PidMode"`
	Privileged              bool                              `json:"Privileged"`
	PublishAllPorts         bool                              `json:"PublishAllPorts"`
	ReadonlyRootfs          bool                              `json:"ReadonlyRootfs"`
	SecurityOpt             []string                          `json:"SecurityOpt"`
	UTSMode                 string                            `json:"UTSMode"`
	UsernsMode              string                            `json:"UsernsMode"`
	ShmSize                 int64                             `json:"ShmSize"`
	Runtime                 string                            `json:"Runtime"`
	Isolation               string                            `json:"Isolation"`
	CPUShares               int64                             `json:"CpuShares"`
	Memory                  int64                             `json:"Memory"`
	NanoCPUs                int64                             `json:"NanoCpus"`
	CgroupParent            string                            `json:"CgroupParent"`
	BlkioWeight             uint16                            `json:"BlkioWeight"`
	BlkioWeightDevice       []ContainerWeightDevice           `json:"BlkioWeightDevice"`
	BlkioDeviceReadBps      []ContainerThrottleDevice         `json:"BlkioDeviceReadBps"`
	BlkioDeviceWriteBps     []ContainerThrottleDevice         `json:"BlkioDeviceWriteBps"`
	BlkioDeviceReadIOps     []ContainerThrottleDevice         `json:"BlkioDeviceReadIOps"`
	BlkioDeviceWriteIOps    []ContainerThrottleDevice         `json:"BlkioDeviceWriteIOps"`
	CPUPeriod               int64                             `json:"CpuPeriod"`
	CPUQuota                int64                             `json:"CpuQuota"`
	CPURealtimePeriod       int64                             `json:"CpuRealtimePeriod"`
	CPURealtimeRuntime      int64                             `json:"CpuRealtimeRuntime"`
	CpusetCPUs              string                            `json:"CpusetCpus"`
	CpusetMems              string                            `json:"CpusetMems"`
	Devices                 []ContainerDeviceMapping          `json:"Devices"`
	DeviceCgroupRules       []string                          `json:"DeviceCgroupRules"`
	DeviceRequests          []ContainerDeviceRequest          `json:"DeviceRequests"`
	MemoryReservation       int64                             `json:"MemoryReservation"`
	MemorySwap              int64                             `json:"MemorySwap"`
	MemorySwappiness        *int64                            `json:"MemorySwappiness"`
	OomKillDisable          *bool                             `json:"OomKillDisable"`
	PidsLimit               *int64                            `json:"PidsLimit"`
	Ulimits                 []ContainerUlimit                 `json:"Ulimits"`
	CPUCount                int64                             `json:"CpuCount"`
	CPUPercent              int64                             `json:"CpuPercent"`
	IOMaximumIOps           uint64                            `json:"IOMaximumIOps"`
	IOMaximumBandwidth      uint64                            `json:"IOMaximumBandwidth"`
	MaskedPaths             []string                          `json:"MaskedPaths"`
	ReadonlyPaths           []string                          `json:"ReadonlyPaths"`
	Sysctls                 map[string]string                 `json:"Sysctls"`
	Init                    *bool                             `json:"Init"`
	UnknownInspectionFields []string                          `json:"-"`
}

func (*ContainerHostConfig) UnmarshalJSON 

func (config *ContainerHostConfig) UnmarshalJSON(data []byte) error

UnmarshalJSON retains fields unknown to this typed projection. Native lifecycle validators can then reject a daemon inspection surface they do not understand instead of silently ignoring a future privilege control.

type ContainerHostMount 

type ContainerHostMount struct {
	Type                    string          `json:"Type"`
	Source                  string          `json:"Source"`
	Target                  string          `json:"Target"`
	ReadOnly                bool            `json:"ReadOnly"`
	Consistency             string          `json:"Consistency"`
	BindOptions             json.RawMessage `json:"BindOptions"`
	VolumeOptions           json.RawMessage `json:"VolumeOptions"`
	ImageOptions            json.RawMessage `json:"ImageOptions"`
	TmpfsOptions            json.RawMessage `json:"TmpfsOptions"`
	ClusterOptions          json.RawMessage `json:"ClusterOptions"`
	UnknownInspectionFields []string        `json:"-"`
}

ContainerHostMount is one HostConfig.Mounts request. Some Compose releases (for example 2.26 on Debian 13) request named volumes through the mount API instead of Binds; the option objects stay raw so validators can require them to be empty.

func (*ContainerHostMount) UnmarshalJSON 

func (mount *ContainerHostMount) UnmarshalJSON(data []byte) error

type ContainerInfo 

type ContainerInfo struct {
	ID              string                   `json:"Id"`
	Name            string                   `json:"Name"`
	Image           string                   `json:"Image"`
	State           ContainerState           `json:"State"`
	Ports           []ContainerPort          `json:"Ports"`
	Labels          map[string]string        `json:"Labels"`
	Created         string                   `json:"Created"`
	Config          ContainerConfig          `json:"Config"`
	HostConfig      ContainerHostConfig      `json:"HostConfig"`
	Mounts          []ContainerMount         `json:"Mounts"`
	NetworkSettings ContainerNetworkSettings `json:"NetworkSettings"`
}

ContainerInfo represents container information

type ContainerLogConfig 

type ContainerLogConfig struct {
	Type   string            `json:"Type"`
	Config map[string]string `json:"Config"`
}

type ContainerMount 

type ContainerMount struct {
	Type        string `json:"Type"`
	Name        string `json:"Name"`
	Source      string `json:"Source"`
	Destination string `json:"Destination"`
	RW          bool   `json:"RW"`
	Propagation string `json:"Propagation"`
}

type ContainerNetwork 

type ContainerNetwork struct {
	NetworkID string `json:"NetworkID"`
}

type ContainerNetworkSettings 

type ContainerNetworkSettings struct {
	Networks map[string]ContainerNetwork `json:"Networks"`
}

type ContainerPort 

type ContainerPort struct {
	PrivatePort int    `json:"PrivatePort"`
	PublicPort  int    `json:"PublicPort"`
	Type        string `json:"Type"`
}

ContainerPort represents a container port

type ContainerPortBinding 

type ContainerPortBinding struct {
	HostIP   string `json:"HostIp"`
	HostPort string `json:"HostPort"`
}

type ContainerRestartPolicy 

type ContainerRestartPolicy struct {
	Name              string `json:"Name"`
	MaximumRetryCount int    `json:"MaximumRetryCount"`
}

type ContainerState 

type ContainerState struct {
	Status     string       `json:"Status"`
	Running    bool         `json:"Running"`
	Paused     bool         `json:"Paused"`
	Restarting bool         `json:"Restarting"`
	ExitCode   int          `json:"ExitCode"`
	OOMKilled  bool         `json:"OOMKilled"`
	Error      string       `json:"Error"`
	Health     *HealthState `json:"Health,omitempty"`
}

ContainerState represents container state

type ContainerThrottleDevice 

type ContainerThrottleDevice struct {
	Path string `json:"Path"`
	Rate uint64 `json:"Rate"`
}

type ContainerUlimit 

type ContainerUlimit struct {
	Name string `json:"Name"`
	Hard int64  `json:"Hard"`
	Soft int64  `json:"Soft"`
}

type ContainerWeightDevice 

type ContainerWeightDevice struct {
	Path   string `json:"Path"`
	Weight uint16 `json:"Weight"`
}

type HealthState 

type HealthState struct {
	Status string `json:"Status"`
}

HealthState represents container health

type NetworkContainer 

type NetworkContainer struct {
	Name string `json:"Name"`
}

type NetworkInfo 

type NetworkInfo struct {
	ID         string                      `json:"Id"`
	Name       string                      `json:"Name"`
	Internal   bool                        `json:"Internal"`
	Containers map[string]NetworkContainer `json:"Containers"`
}

NetworkInfo is the exact isolation projection returned by docker network inspect for a rendered local-only network.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.