| 1 | #!/bin/bash |
| 2 | # Hosted Diffinery runners: starts the Docker daemon the first time anything needs |
| 3 | # it (a step running `docker`, job containers, services, Docker actions), then runs |
| 4 | # the real CLI. The daemon runs in its own session so step cleanup leaves it alone. |
| 5 | # |
| 6 | # The daemon reaches the Diffinery container registry through the runner's registry |
| 7 | # relay (agent.mjs --registry-relay), which splits image layers into chunks under |
| 8 | # Cloudflare's 100 MB request limit. BuildKit builders that `docker buildx create` |
| 9 | # starts (docker/setup-buildx-action) are set up here too, see below. |
| 10 | real=/usr/bin/docker |
| 11 | ready=/run/diffinery-dockerd.ready |
| 12 | state=/run/diffinery |
| 13 | relay_port=3129 |
| 14 | sys_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
| 15 | |
| 16 | # The Diffinery host this runner reports to, when it is reached over HTTPS. |
| 17 | registry_host() { |
| 18 | local url=${DIFFINERY_API_URL:-} |
| 19 | [[ "$url" == https://* ]] || return 1 |
| 20 | url=${url#https://} |
| 21 | echo "${url%%/*}" |
| 22 | } |
| 23 | |
| 24 | start_relay() { |
| 25 | local host=$1 |
| 26 | mkdir -p "$state" "/etc/docker/certs.d/$host" || return 1 |
| 27 | # A certificate for the Diffinery host that only this daemon (and its builders) trust. |
| 28 | openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes -days 30 -subj "/CN=$host" \ |
| 29 | -addext "subjectAltName=DNS:$host" -keyout "$state/relay.key" -out "$state/relay.crt" >/dev/null 2>&1 || return 1 |
| 30 | cp "$state/relay.crt" "/etc/docker/certs.d/$host/ca.crt" |
| 31 | printf '[registry."%s"]\n ca = ["%s"]\n' "$host" "$state/relay.crt" >"$state/buildkitd.toml" |
| 32 | # Under web-only egress the relay's own HTTPS needs the egress CA (src/egress.ts). |
| 33 | env -i PATH="$sys_path" ${NODE_EXTRA_CA_CERTS:+"NODE_EXTRA_CA_CERTS=$NODE_EXTRA_CA_CERTS"} DIFFINERY_RELAY_HOST="$host" DIFFINERY_RELAY_UPSTREAM="https://$host" DIFFINERY_RELAY_PORT="$relay_port" \ |
| 34 | DIFFINERY_RELAY_CERT="$state/relay.crt" DIFFINERY_RELAY_KEY="$state/relay.key" \ |
| 35 | setsid -f node /opt/diffinery/agent.mjs --registry-relay >/var/log/diffinery-relay.log 2>&1 </dev/null 9>&- |
| 36 | for _ in $(seq 1 80); do |
| 37 | if (exec 3<>"/dev/tcp/127.0.0.1/$relay_port") 2>/dev/null; then |
| 38 | echo "$host" >"$state/relay.host" |
| 39 | return 0 |
| 40 | fi |
| 41 | sleep 0.25 |
| 42 | done |
| 43 | return 1 |
| 44 | } |
| 45 | |
| 46 | if [ ! -e "$ready" ] && [ -z "${DOCKER_HOST:-}" ] && [ "$(id -u)" = 0 ]; then |
| 47 | exec 9>/run/diffinery-dockerd.lock |
| 48 | # Starting the daemon takes at most about a minute and a half (the relay, then dockerd), so a |
| 49 | # command that waits longer for another one to start it gives up rather than hang the step. |
| 50 | if ! flock -w 150 9 && [ ! -e "$ready" ]; then |
| 51 | echo "The Docker daemon did not start: another docker command has been starting it for over 2 minutes." >&2 |
| 52 | tail -n 20 /var/log/dockerd.log >&2 2>/dev/null |
| 53 | exit 1 |
| 54 | fi |
| 55 | if [ ! -e "$ready" ]; then |
| 56 | if ! "$real" version >/dev/null 2>&1; then |
| 57 | echo "Starting the Docker daemon" >&2 |
| 58 | proxy=() |
| 59 | if host=$(registry_host) && start_relay "$host"; then |
| 60 | proxy=(HTTPS_PROXY="http://127.0.0.1:$relay_port") |
| 61 | elif [ -n "${host:-}" ]; then |
| 62 | echo "The registry relay did not start, so image layers over 100 MB can't be pushed to $host:" >&2 |
| 63 | tail -n 5 /var/log/diffinery-relay.log >&2 2>/dev/null |
| 64 | fi |
| 65 | # The daemons must not inherit the lock (fd 9): they would hold it for good, and a second |
| 66 | # docker command that arrives while this one is still starting the daemon would wait forever. |
| 67 | env -i PATH="$sys_path" "${proxy[@]}" setsid -f dockerd >/var/log/dockerd.log 2>&1 </dev/null 9>&- |
| 68 | for _ in $(seq 1 240); do "$real" version >/dev/null 2>&1 && break; sleep 0.25; done |
| 69 | "$real" version >/dev/null 2>&1 || { echo "The Docker daemon did not start:" >&2; tail -n 20 /var/log/dockerd.log >&2; exit 1; } |
| 70 | fi |
| 71 | touch "$ready" |
| 72 | fi |
| 73 | exec 9>&- |
| 74 | fi |
| 75 | |
| 76 | # BuildKit builders. The docker-container driver talks to its BuildKit container through |
| 77 | # `docker exec`, which can't join that container's cgroup inside a Cloudflare Container. |
| 78 | # So `docker buildx create` (docker-container driver, as docker/setup-buildx-action runs it) |
| 79 | # starts the BuildKit container itself, on the host network with its socket on the host, |
| 80 | # and registers it as a remote builder. When the registry relay runs, BuildKit uses it as |
| 81 | # its HTTPS proxy and trusts it for the Diffinery host. `docker buildx rm` removes it. |
| 82 | buildkit_dir=/run/diffinery-buildkit |
| 83 | |
| 84 | buildx_create() { |
| 85 | local name="" driver=docker-container image=moby/buildkit:buildx-stable-1 cfg="" use=0 bootstrap=0 |
| 86 | local -a flags=() env=() keep=() |
| 87 | while [ $# -gt 0 ]; do |
| 88 | case "$1" in |
| 89 | --name) name=${2:-}; shift ;; |
| 90 | --name=*) name=${1#--name=} ;; |
| 91 | --driver) driver=${2:-}; shift ;; |
| 92 | --driver=*) driver=${1#--driver=} ;; |
| 93 | --driver-opt | --driver-opt=*) |
| 94 | local opt |
| 95 | if [ "$1" = --driver-opt ]; then opt=${2:-}; shift; else opt=${1#--driver-opt=}; fi |
| 96 | local o |
| 97 | IFS=, read -ra o <<<"$opt" |
| 98 | for o in "${o[@]}"; do |
| 99 | case "$o" in |
| 100 | image=*) image=${o#image=} ;; |
| 101 | env.*=*) o=${o#env.}; env+=(-e "$o") ;; |
| 102 | network=* | cgroup-parent=* | restart-policy=* | memory=* | memory-swap=* | cpu-*=* | default-load=* | provenance-add-gha=*) ;; |
| 103 | *) return 2 ;; |
| 104 | esac |
| 105 | done |
| 106 | ;; |
| 107 | --buildkitd-flags) read -ra flags <<<"${2:-}"; shift ;; |
| 108 | --buildkitd-flags=*) read -ra flags <<<"${1#--buildkitd-flags=}" ;; |
| 109 | --buildkitd-config | --config) cfg=${2:-}; shift ;; |
| 110 | --buildkitd-config=* | --config=*) cfg=${1#*=} ;; |
| 111 | --use) use=1 ;; |
| 112 | --bootstrap) bootstrap=1 ;; |
| 113 | --platform) keep+=("$1" "${2:-}"); shift ;; |
| 114 | --platform=*) keep+=("$1") ;; |
| 115 | --node | --node=*) [ "$1" = --node ] && shift ;; |
| 116 | # Appending nodes, endpoints and anything else: leave it to buildx. |
| 117 | *) return 2 ;; |
| 118 | esac |
| 119 | shift |
| 120 | done |
| 121 | [ "$driver" = docker-container ] || return 2 |
| 122 | [ -n "$name" ] || name="builder-$(cat /proc/sys/kernel/random/uuid)" |
| 123 | local dir="$buildkit_dir/$name" box="buildx_buildkit_${name}0" |
| 124 | mkdir -p "$dir" "$state" |
| 125 | local -a args=(--config /etc/buildkit/buildkitd.toml) |
| 126 | : >"$dir/buildkitd.toml" |
| 127 | [ -n "$cfg" ] && cat "$cfg" >>"$dir/buildkitd.toml" |
| 128 | if [ -s "$state/relay.host" ]; then |
| 129 | local host |
| 130 | host=$(cat "$state/relay.host") |
| 131 | if ! grep -qF "registry.\"$host\"" "$dir/buildkitd.toml"; then |
| 132 | { echo; cat "$state/buildkitd.toml"; } >>"$dir/buildkitd.toml" |
| 133 | fi |
| 134 | env+=(-e "HTTPS_PROXY=http://127.0.0.1:$relay_port" -e "https_proxy=http://127.0.0.1:$relay_port") |
| 135 | fi |
| 136 | "$real" rm -f "$box" >/dev/null 2>&1 |
| 137 | "$real" run -d --name "$box" --label "diffinery.buildkit=$name" --privileged --network host \ |
| 138 | -v "$dir:/run/buildkit" -v "$dir/buildkitd.toml:/etc/buildkit/buildkitd.toml:ro" -v "$state:$state:ro" \ |
| 139 | -v "${box}_state:/var/lib/buildkit" "${env[@]}" "$image" "${args[@]}" "${flags[@]}" >/dev/null || return 1 |
| 140 | for _ in $(seq 1 120); do |
| 141 | [ -S "$dir/buildkitd.sock" ] && break |
| 142 | if [ "$("$real" inspect -f '{{.State.Running}}' "$box" 2>/dev/null)" != true ]; then |
| 143 | echo "BuildKit did not start:" >&2 |
| 144 | "$real" logs "$box" 2>&1 | tail -n 20 >&2 |
| 145 | return 1 |
| 146 | fi |
| 147 | sleep 0.25 |
| 148 | done |
| 149 | local -a create=(buildx create --name "$name" --driver remote "${keep[@]}") |
| 150 | [ "$use" = 1 ] && create+=(--use) |
| 151 | [ "$bootstrap" = 1 ] && create+=(--bootstrap) |
| 152 | exec "$real" "${create[@]}" "unix://$dir/buildkitd.sock" |
| 153 | } |
| 154 | |
| 155 | if [ "${1:-}" = buildx ] && [ "${2:-}" = create ] && [ -z "${DOCKER_HOST:-}" ] && [ "$(id -u)" = 0 ]; then |
| 156 | buildx_create "${@:3}" |
| 157 | [ $? = 2 ] || exit 1 |
| 158 | fi |
| 159 | |
| 160 | # docker buildx rm: also remove the BuildKit containers buildx_create started. |
| 161 | if [ "${1:-}" = buildx ] && [ "${2:-}" = rm ] && [ -d "$buildkit_dir" ]; then |
| 162 | "$real" "$@" |
| 163 | status=$? |
| 164 | for arg in "${@:3}"; do |
| 165 | case "$arg" in -*) continue ;; esac |
| 166 | if [ -d "$buildkit_dir/$arg" ]; then |
| 167 | "$real" rm -f -v "buildx_buildkit_${arg}0" >/dev/null 2>&1 |
| 168 | "$real" volume rm "buildx_buildkit_${arg}0_state" >/dev/null 2>&1 |
| 169 | rm -rf "${buildkit_dir:?}/$arg" |
| 170 | fi |
| 171 | done |
| 172 | exit "$status" |
| 173 | fi |
| 174 | |
| 175 | # docker push: when it fails, show what the registry relay saw (its error alone doesn't say). |
| 176 | if { [ "${1:-}" = push ] || { [ "${1:-}" = image ] && [ "${2:-}" = push ]; }; } && [ -s "$state/relay.host" ]; then |
| 177 | "$real" "$@" |
| 178 | status=$? |
| 179 | if [ "$status" != 0 ]; then |
| 180 | echo "The registry relay's last lines:" >&2 |
| 181 | tail -n 20 /var/log/diffinery-relay.log >&2 2>/dev/null |
| 182 | fi |
| 183 | exit "$status" |
| 184 | fi |
| 185 | |
| 186 | exec "$real" "$@" |