ownapplication

package
v0.57.11 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 13, 2026 License: Apache-2.0, Apache-2.0 Imports: 11 Imported by: 0

Documentation

Overview

Package ownapplication defines Techstack-owned desired state consumed by the node's StackKits renderer. It grants no host, daemon or provider authority.

Index

Constants

View Source 
const APIVersion = "techstack.own-application/v1"
View Source 
const APIVersionV2 = "techstack.own-application/v2"
View Source 
const APIVersionV3 = "techstack.own-application/v3"
View Source 
const APIVersionV4 = "techstack.own-application/v4"

APIVersionV4 is one container StackKits rebuilt from an observed container it did not install ("Stack it"). It is the v2 single-container form plus the adoption source and the host ports the original published.

View Source 
const BundleVersion = "stackkit.own-application-bundle/v1"
View Source 
const ModuleRef = "stackkits-own-application-runtime"

Variables

View Source 
var AdoptedDataRoots = []string{"/srv/", "/opt/", "/data/", "/home/", "/mnt/", "/media/"}

AdoptedDataRoots are the host directories an adopted bind-mounted data source may live below. System paths, the Docker socket and / never are.

Functions

func AdoptableBindSource 

func AdoptableBindSource(source string) bool

AdoptableBindSource reports whether a host path is a clean path strictly below one of the admitted data roots.

func Decode 

func Decode(raw []byte, target any) error

func SecretSlotKey 

func SecretSlotKey(service, key string) string

SecretSlotKey is the flat input slot of one project secret. It keeps the private secrets file a flat object while the custody reference stays namespaced by the service that holds the variable.

func SplitImage 

func SplitImage(image string) (string, string, error)

func ValidName 

func ValidName(name string) bool

func ValidServiceName 

func ValidServiceName(name string) bool

ValidServiceName reports whether name is a Compose service identity this contract admits: a lowercase DNS label of at most 40 characters.

func ValidateRegistry 

func ValidateRegistry(registry string) error

ValidateRegistry is the single image-host admission rule. It performs no DNS lookup; transport additionally rejects non-public resolved addresses.

Types

type AdoptedFrom 

type AdoptedFrom struct {
	ContainerID string `json:"containerId"`
	// ImageDigest is the registry manifest digest the original ran.
	ImageDigest string `json:"imageDigest"`
	// Volumes names the data source copied into the named volume:
	// volume:<name> or bind:<absolute host path>. At most one.
	Volumes []string `json:"volumes,omitempty"`
	// OriginalConfigRef names the configuration the original came from, for
	// example compose:<project>/<service> or docker:<container name>.
	OriginalConfigRef string `json:"originalConfigRef"`
}

AdoptedFrom records the observed container an adopted application was rebuilt from. It is evidence of origin, never runtime authority.

type Application 

type Application struct {
	OutboundInternet *bool             `json:"outboundInternet,omitempty"`
	APIVersion       string            `json:"apiVersion"`
	Name             string            `json:"name"`
	Image            string            `json:"image,omitempty"`
	HTTPPort         int               `json:"httpPort,omitempty"`
	Hostname         string            `json:"hostname"`
	SignIn           *bool             `json:"signIn,omitempty"`
	Environment      map[string]string `json:"environment,omitempty"`
	SecretRefs       map[string]string `json:"secretRefs,omitempty"`
	Volume           *Volume           `json:"volume,omitempty"`
	Resources        Resources         `json:"resources,omitempty"`
	// Services declares the containers of a techstack.own-application/v3
	// project. The one-container forms keep their image and httpPort here.
	Services []Service `json:"services,omitempty"`
	// AdoptedFrom and PublishedPorts belong to techstack.own-application/v4
	// only: the observed source of an adopted container and the host ports it
	// published, kept so LAN host:port clients keep working.
	AdoptedFrom    *AdoptedFrom    `json:"adoptedFrom,omitempty"`
	PublishedPorts []PublishedPort `json:"publishedPorts,omitempty"`
}

Application is deliberately closed: users supply an image, never Compose, commands, capabilities, host mounts, devices or network configuration.

A techstack.own-application/v3 document declares a Compose project instead of a single container: it lists its services and carries no image or httpPort of its own.

func Parse 

func Parse(raw []byte) (Application, error)

func (Application) AdmitImageConfiguration 

func (a Application) AdmitImageConfiguration(raw []byte) error

AdmitImageConfiguration closes authority inherited from an image rather than the desired document. In particular Dockerfile routing labels must not create a second ingress path outside the reviewed router and Access Gate.

func (Application) ExpectedSecretRef 

func (a Application) ExpectedSecretRef(slot string) string

ExpectedSecretRef returns the custody reference a declared secret slot must carry. It returns the empty string for a slot the application does not declare, so a caller can refuse foreign custody.

func (Application) Firewalled 

func (a Application) Firewalled() bool

Firewalled reports whether the application runs on its managed host firewall bridge instead of an internal-only network: it has outbound Internet, published host ports, or both. Docker publishes no port of a container attached only to an internal network, so published ports without outbound use the same bridge with an ingress-only ruleset.

func (Application) HasVolume 

func (a Application) HasVolume() bool

HasVolume reports whether any declared container keeps a named volume.

func (Application) IsAdopted 

func (a Application) IsAdopted() bool

IsAdopted reports whether StackKits rebuilt the application from an observed container it did not install.

func (Application) IsProject 

func (a Application) IsProject() bool

IsProject reports whether the application declares a Compose project rather than a single container.

func (Application) Limits 

func (a Application) Limits() Resources

func (Application) OutboundEnabled 

func (a Application) OutboundEnabled() bool

func (Application) Protected 

func (a Application) Protected() bool

func (Application) RoutedService 

func (a Application) RoutedService() (Service, bool)

RoutedService returns the single project service that serves the routed host. A project always declares exactly one.

func (Application) SecretRefList 

func (a Application) SecretRefList() []string

SecretRefList returns every custody reference of the application in a stable order.

func (Application) SecretSlots 

func (a Application) SecretSlots() map[string]string

SecretSlots maps every declared secret to the flat input slot that carries its private material and to the custody reference that holds it.

func (Application) Service 

func (a Application) Service(name string) (Service, bool)

Service returns the declared project service with the given name.

func (*Application) UnmarshalJSON 

func (a *Application) UnmarshalJSON(raw []byte) error

UnmarshalJSON keeps the v1 wire shape closed even when a caller decodes a bundle directly rather than calling Parse. An explicit null is not a bool.

func (Application) Validate 

func (a Application) Validate() error

func (Application) WorkloadRef 

func (a Application) WorkloadRef() string

type Bundle 

type Bundle struct {
	APIVersion    string       `json:"apiVersion"`
	Application   Application  `json:"application"`
	Installation  Installation `json:"installation"`
	ResolvedImage string       `json:"resolvedImage,omitempty"`
	// ImageID is derived from the verified manifest/config by the node, never desired state.
	ImageID string `json:"imageID,omitempty"`
	// ResolvedImages and ImageIDs carry the image custody of every service of a
	// techstack.own-application/v3 project, keyed by service name. A project
	// never carries the single-container custody above.
	ResolvedImages map[string]string `json:"resolvedImages,omitempty"`
	ImageIDs       map[string]string `json:"imageIDs,omitempty"`
}

Bundle adapts desired state into the common application delivery graph. ResolvedImage is registry-observed before approval; execution uses that digest.

func (Bundle) ImagesResolved 

func (b Bundle) ImagesResolved() bool

ImagesResolved reports whether every declared container of the bundle carries its node-observed image custody.

func (Bundle) ProjectRelease 

func (b Bundle) ProjectRelease() string

ProjectRelease is the release identity of a project: the resolved image of every service in declared order. It names the whole project, not one container.

func (Bundle) Validate 

func (b Bundle) Validate() error

type Installation 

type Installation struct {
	Domain        string `json:"domain"`
	SiteRef       string `json:"siteRef"`
	NodeRef       string `json:"nodeRef"`
	CoreModuleRef string `json:"coreModuleRef"`
	TLSIssuerRef  string `json:"tlsIssuerRef"`
	TLSProfileRef string `json:"tlsProfileRef"`
	Exposure      string `json:"exposure"`
}

Installation is supplied by verified applied state, never by a live write's caller. Offline rendering accepts an explicit installation for inspection.

type PublishedPort 

type PublishedPort struct {
	HostIP        string `json:"hostIP,omitempty"`
	HostPort      int    `json:"hostPort"`
	ContainerPort int    `json:"containerPort"`
	Protocol      string `json:"protocol"`
}

PublishedPort is one host port the adopted container keeps publishing.

type Resources 

type Resources struct {
	MemoryMiB int     `json:"memoryMiB,omitempty"`
	CPUs      float64 `json:"cpus,omitempty"`
}

type Service 

type Service struct {
	Name        string            `json:"name"`
	Image       string            `json:"image"`
	HTTPPort    int               `json:"httpPort,omitempty"`
	Environment map[string]string `json:"environment,omitempty"`
	SecretRefs  map[string]string `json:"secretRefs,omitempty"`
	Volume      *Volume           `json:"volume,omitempty"`
	Resources   Resources         `json:"resources,omitempty"`
	DependsOn   []string          `json:"dependsOn,omitempty"`
}

Service is one container of an own Compose project. Exactly one service declares httpPort and is routed on the project hostname; every other service stays on the project's private network.

func (Service) AdmitImageConfiguration 

func (s Service) AdmitImageConfiguration(raw []byte) error

AdmitImageConfiguration closes the authority inherited from the image of one project service rather than from the user contract.

func (Service) Limits 

func (s Service) Limits() Resources

ServiceLimits returns the admitted limits of one project service.

type Volume 

type Volume struct {
	MountPath string `json:"mountPath"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.