docker

package
v0.0.0-...-147a9b8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: MIT Imports: 26 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrNotFound = errors.New("docker resource was not found")
	ErrConflict = errors.New("docker resource already exists")
)
View Source 
var ErrSkillCollectionDrift = fmt.Errorf("%w: ready Skill collection content differs", ErrConflict)
View Source 
var ErrSkillMountVerificationFailed = errors.New("prepared Skill mount verification failed")
View Source 
var ErrSkillVolumeMissing = errors.New("owned Skill volume is missing")

Functions

func IsUncertain 

func IsUncertain(err error) bool

func Uncertain 

func Uncertain(err error) error

Types

type Client 

type Client struct {
	// contains filtered or unexported fields
}

func NewHTTPClient 

func NewHTTPClient(httpClient *http.Client, baseURL string) (*Client, error)

func NewUnixClient 

func NewUnixClient(socketPath string) (*Client, error)

func (*Client) CreateContainer 

func (c *Client) CreateContainer(ctx context.Context, spec ContainerSpec) (string, error)

func (*Client) CreateVolume 

func (c *Client) CreateVolume(ctx context.Context, name string, labels map[string]string) error

func (*Client) GetArchive 

func (c *Client) GetArchive(ctx context.Context, identifier, source string) (io.ReadCloser, error)

GetArchive returns the raw tar stream from Docker. The caller must close it.

func (*Client) InspectContainer 

func (c *Client) InspectContainer(ctx context.Context, identifier string) (Container, error)

func (*Client) InspectImage 

func (c *Client) InspectImage(ctx context.Context, image string) (string, error)

func (*Client) InspectNetwork 

func (c *Client) InspectNetwork(ctx context.Context, name string) error

func (*Client) InspectVolume 

func (c *Client) InspectVolume(ctx context.Context, name string) (Volume, error)

func (*Client) ListManagedContainerIDs 

func (c *Client) ListManagedContainerIDs(ctx context.Context) ([]string, error)

func (*Client) ListManagedContainers 

func (c *Client) ListManagedContainers(ctx context.Context) ([]Container, error)

func (*Client) Ping 

func (c *Client) Ping(ctx context.Context) error

func (*Client) PutArchive 

func (c *Client) PutArchive(ctx context.Context, identifier, destination string, archive io.Reader) (resultErr error)

PutArchive writes a tar stream into a container's mounted volume. The caller owns validation of the tar members and must close its input.

func (*Client) RemoveContainer 

func (c *Client) RemoveContainer(ctx context.Context, identifier string) error

func (*Client) RemoveVolume 

func (c *Client) RemoveVolume(ctx context.Context, name string) error

func (*Client) StartContainer 

func (c *Client) StartContainer(ctx context.Context, identifier string) error

func (*Client) StopContainer 

func (c *Client) StopContainer(ctx context.Context, identifier string) error

func (*Client) WatchManagedEvents 

func (c *Client) WatchManagedEvents(
	ctx context.Context,
	since time.Time,
	ready func() error,
	emit func(ContainerEvent) error,
) (resultErr error)

type Config 

type Config struct {
	MCPMountGate          MCPMountGate
	AllowedImages         []string
	ControllerScope       string
	ManagementNetwork     string
	SystemSkillsVolume    string
	RuntimeOTEL           map[string]string
	SkillMountGate        SkillMountGate
	InstanceMountGate     InstanceMountGate
	RuntimeAuthentication map[string]string
}

type Container 

type Container struct {
	ID           string
	Name         string
	Running      bool
	Status       string
	ExitCode     int
	OOMKilled    bool
	Error        string
	Health       string
	RestartCount uint64
	Labels       map[string]string
	NetworkIPv4  map[string]string
	Mounts       []ObservedMount
}

type ContainerEvent 

type ContainerEvent struct {
	ID         string
	Action     string
	Attributes map[string]string
	ObservedAt time.Time
}

type ContainerSpec 

type ContainerSpec struct {
	Name           string
	Image          string
	User           string
	Environment    map[string]string
	Labels         map[string]string
	Mounts         map[string]Mount
	Capabilities   []string
	DNS            []string
	DNSOptions     []string
	Devices        []string
	ReadOnlyRootFS bool
	Tmpfs          map[string]string
	Networks       []string
	NetworkMode    string
	PidsLimit      int64
	MemoryBytes    int64
	RestartPolicy  string
	Healthcheck    Healthcheck
}

type Driver 

type Driver struct {
	// contains filtered or unexported fields
}

func NewDriver 

func NewDriver(engine Engine, config Config) (*Driver, error)

func (*Driver) Create 

func (d *Driver) Create(
	ctx context.Context, value deployment.Deployment, digest string,
) deployment.EffectOutcome

func (*Driver) Delete 

func (d *Driver) Delete(
	ctx context.Context, key deployment.Key, digest string,
) deployment.EffectOutcome

func (*Driver) DeleteStorage 

func (d *Driver) DeleteStorage(ctx context.Context, agentID string) deployment.EffectOutcome

func (*Driver) DeploymentDigest 

func (d *Driver) DeploymentDigest(value deployment.Deployment) (string, error)

func (*Driver) EnsureStorage 

func (d *Driver) EnsureStorage(ctx context.Context, agentID string) deployment.EffectOutcome

func (*Driver) Inspect 

func (d *Driver) Inspect(
	ctx context.Context, key deployment.Key,
) (deployment.Inspection, error)

func (*Driver) List 

func (d *Driver) List(ctx context.Context) ([]deployment.Inspection, error)

func (*Driver) Ready 

func (d *Driver) Ready(ctx context.Context) error

func (*Driver) ResolveImage 

func (d *Driver) ResolveImage(ctx context.Context, value string) (platform.ImageResolution, error)

func (*Driver) VerifyStorage 

func (d *Driver) VerifyStorage(ctx context.Context, agentID string) deployment.EffectOutcome

func (*Driver) Watch 

func (d *Driver) Watch(
	ctx context.Context,
	since time.Time,
	ready func(context.Context) error,
	emit func(context.Context, deployment.Observation) error,
) error

type Engine 

type Engine interface {
	Ping(context.Context) error
	InspectImage(context.Context, string) (string, error)
	InspectContainer(context.Context, string) (Container, error)
	ListManagedContainerIDs(context.Context) ([]string, error)
	ListManagedContainers(context.Context) ([]Container, error)
	WatchManagedEvents(context.Context, time.Time, func() error, func(ContainerEvent) error) error
	InspectVolume(context.Context, string) (Volume, error)
	CreateVolume(context.Context, string, map[string]string) error
	InspectNetwork(context.Context, string) error
	CreateContainer(context.Context, ContainerSpec) (string, error)
	StartContainer(context.Context, string) error
	StopContainer(context.Context, string) error
	RemoveContainer(context.Context, string) error
	RemoveVolume(context.Context, string) error
}

type Healthcheck 

type Healthcheck struct {
	Test          []string
	Interval      time.Duration
	Timeout       time.Duration
	StartPeriod   time.Duration
	StartInterval time.Duration
	Retries       int
}

type ImagePolicy 

type ImagePolicy struct {
	// contains filtered or unexported fields
}

ImagePolicy is configured by the operator, never by lifecycle request bodies. Repositories permit their tags/digests; repository@sha256 pins one manifest.

func ParseImagePolicy 

func ParseImagePolicy(entries []string) (*ImagePolicy, error)

func (*ImagePolicy) Allows 

func (p *ImagePolicy) Allows(raw string) bool

type InstanceMountGate 

type InstanceMountGate interface {
	Prepare(context.Context, deployment.Key, *instanceauth.Record) error
	VerifyRuntimeMount(context.Context, deployment.Key, *deployment.RuntimeAuthentication, string) error
	Remove(context.Context, deployment.Key) error
}

type InstanceVolumeWriter 

type InstanceVolumeWriter struct {
	// contains filtered or unexported fields
}

func NewInstanceVolumeWriter 

func NewInstanceVolumeWriter(engine SkillVolumeEngine, image string, issuer *instanceauth.Manager, scope string) (*InstanceVolumeWriter, error)

func (*InstanceVolumeWriter) Prepare 

func (w *InstanceVolumeWriter) Prepare(ctx context.Context, key deployment.Key, record *instanceauth.Record) (resultErr error)

func (*InstanceVolumeWriter) Remove 

func (w *InstanceVolumeWriter) Remove(ctx context.Context, key deployment.Key) error

func (*InstanceVolumeWriter) VerifyRuntimeMount 

func (w *InstanceVolumeWriter) VerifyRuntimeMount(ctx context.Context, key deployment.Key, descriptor *deployment.RuntimeAuthentication, containerID string) error

type MCPMountGate 

type MCPMountGate interface {
	Prepare(context.Context, deployment.Key, *deployment.MCPTemplateSource, []deployment.MCPServer) error
	VerifyRuntimeMount(context.Context, deployment.Key, *deployment.MCPTemplateSource, []deployment.MCPServer, string) error
	Remove(context.Context, deployment.Key) error
}

type MCPSecretResolver 

type MCPSecretResolver interface {
	Resolve(context.Context, *deployment.MCPTemplateSource, []deployment.MCPServer) (map[string]map[string]string, error)
}

type MCPVolumeWriter 

type MCPVolumeWriter struct {
	// contains filtered or unexported fields
}

func NewMCPVolumeWriter 

func NewMCPVolumeWriter(engine SkillVolumeEngine, image, scope string, resolver MCPSecretResolver) (*MCPVolumeWriter, error)

func (*MCPVolumeWriter) Prepare 

func (writer *MCPVolumeWriter) Prepare(ctx context.Context, key deployment.Key, source *deployment.MCPTemplateSource, servers []deployment.MCPServer) (resultErr error)

func (*MCPVolumeWriter) Remove 

func (writer *MCPVolumeWriter) Remove(ctx context.Context, key deployment.Key) error

func (*MCPVolumeWriter) VerifyRuntimeMount 

func (writer *MCPVolumeWriter) VerifyRuntimeMount(ctx context.Context, key deployment.Key, source *deployment.MCPTemplateSource, servers []deployment.MCPServer, id string) error

type Mount 

type Mount struct {
	Source   string
	ReadOnly bool
	NoCopy   bool
}

type ObservedMount 

type ObservedMount struct {
	Type        string
	Name        string
	Destination string
	ReadWrite   bool
	NoCopy      bool
}

type SkillMountGate 

type SkillMountGate interface {
	VerifyRuntimeMount(context.Context, skillset.SetKey, string, string) error
}

type SkillVolumeEngine 

type SkillVolumeEngine interface {
	InspectVolume(context.Context, string) (Volume, error)
	CreateVolume(context.Context, string, map[string]string) error
	RemoveVolume(context.Context, string) error
	InspectContainer(context.Context, string) (Container, error)
	CreateContainer(context.Context, ContainerSpec) (string, error)
	RemoveContainer(context.Context, string) error
	PutArchive(context.Context, string, string, io.Reader) error
	GetArchive(context.Context, string, string) (io.ReadCloser, error)
}

type SkillVolumeWriter 

type SkillVolumeWriter struct {
	// contains filtered or unexported fields
}

func NewSkillVolumeWriter 

func NewSkillVolumeWriter(engine SkillVolumeEngine, image string) (*SkillVolumeWriter, error)

func (*SkillVolumeWriter) InspectPreparedVolume 

func (w *SkillVolumeWriter) InspectPreparedVolume(ctx context.Context, prepared skillset.PreparedMaterialization) error

func (*SkillVolumeWriter) MaterializePackage 

func (w *SkillVolumeWriter) MaterializePackage(ctx context.Context, key skillset.SetKey, artifact []byte, pkg skillset.Package) error

func (*SkillVolumeWriter) RemovePreparedVolume 

func (w *SkillVolumeWriter) RemovePreparedVolume(ctx context.Context, key skillset.SetKey) error

RemovePreparedVolume removes only an RC-owned materialization. Docker refuses a volume still mounted by a container, which is an additional protection if the database and physical state temporarily disagree.

func (*SkillVolumeWriter) VerifyPackage 

func (w *SkillVolumeWriter) VerifyPackage(ctx context.Context, key skillset.SetKey, pkg skillset.Package) error

func (*SkillVolumeWriter) VerifyPreparedCollection 

func (w *SkillVolumeWriter) VerifyPreparedCollection(ctx context.Context, prepared skillset.PreparedMaterialization) error

VerifyPreparedCollection performs the bounded full readback only at the independent Prepare boundary, never inside a lifecycle mutation deadline.

func (*SkillVolumeWriter) VerifyRuntimeMount 

func (w *SkillVolumeWriter) VerifyRuntimeMount(ctx context.Context, key skillset.SetKey, containerID, manifestDigest string) (resultErr error)

VerifyRuntimeMount checks the actual mount after Docker creates a candidate Runtime and before it is allowed to start, and rechecks an adopted running Runtime before reporting recovery success. Docker may auto-create a missing named volume between a preflight check and container creation; this gate rejects that unlabeled empty replacement without treating its name as proof.

func (*SkillVolumeWriter) WriteManifest 

func (w *SkillVolumeWriter) WriteManifest(ctx context.Context, key skillset.SetKey, manifest []byte) error

WriteManifest makes the set ready for consumption only after the exact collection identity has been written and read back from the owned volume.

type Volume 

type Volume struct {
	Name   string
	Labels map[string]string
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.