248 lines
7.4 KiB
Go
248 lines
7.4 KiB
Go
package infra
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// DockerExecOpts configura la ejecucion de un comando dentro de un container Docker.
|
|
type DockerExecOpts struct {
|
|
ContainerID string // ID o nombre del container destino.
|
|
Cmd []string // argv. Cmd[0] = binario, debe estar en BinariesAllowed.
|
|
BinariesAllowed []string // Whitelist de binarios permitidos. EMPTY = rechaza todo.
|
|
User string // Usuario/grupo "UID:GID"; vacio = default del container.
|
|
WorkingDir string // Directorio de trabajo dentro del container.
|
|
Env []string // Variables de entorno en formato "KEY=VAL".
|
|
TimeoutSeconds int // Timeout de ejecucion; default 30 si es 0.
|
|
DockerHost string // Socket Docker; default "unix:///var/run/docker.sock".
|
|
}
|
|
|
|
// DockerExecResult contiene el resultado de ejecutar un comando en un container.
|
|
type DockerExecResult struct {
|
|
ExitCode int // Codigo de salida del proceso.
|
|
Stdout string // Salida estandar capturada.
|
|
Stderr string // Salida de error capturada.
|
|
Duration int64 // Duracion real de ejecucion en milisegundos.
|
|
}
|
|
|
|
// DockerContainerExec ejecuta un comando dentro de un container Docker via Engine API.
|
|
//
|
|
// Flujo: POST /containers/<id>/exec → POST /exec/<id>/start → demux stream → GET /exec/<id>/json.
|
|
// El comando se pasa como argv directo (sin shell). Aplica whitelist obligatoria de binarios.
|
|
// Timeout gestionado via context.WithTimeout.
|
|
func DockerContainerExec(opts DockerExecOpts) (DockerExecResult, error) {
|
|
// --- Validacion de seguridad (prioritaria, antes de contactar el engine) ---
|
|
if len(opts.Cmd) == 0 {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec: Cmd must not be empty")
|
|
}
|
|
if len(opts.BinariesAllowed) == 0 {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec: no binaries whitelisted: refusing")
|
|
}
|
|
bin := opts.Cmd[0]
|
|
inWhitelist := false
|
|
for _, b := range opts.BinariesAllowed {
|
|
if b == bin {
|
|
inWhitelist = true
|
|
break
|
|
}
|
|
}
|
|
if !inWhitelist {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec: binary %q not in whitelist %v", bin, opts.BinariesAllowed)
|
|
}
|
|
if opts.ContainerID == "" {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec: ContainerID must not be empty")
|
|
}
|
|
|
|
// --- Defaults ---
|
|
timeout := opts.TimeoutSeconds
|
|
if timeout <= 0 {
|
|
timeout = 30
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
|
|
defer cancel()
|
|
|
|
// Reuse dockerHTTPClient from docker_container_logs.go (same package).
|
|
client, baseURL, err := dockerHTTPClient(opts.DockerHost)
|
|
if err != nil {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec: building client: %w", err)
|
|
}
|
|
|
|
start := time.Now()
|
|
|
|
// --- Step 1: Create exec instance ---
|
|
execID, err := dockerExecCreate(ctx, client, baseURL, opts)
|
|
if err != nil {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec create: %w", err)
|
|
}
|
|
|
|
// --- Step 2: Start exec and capture stream ---
|
|
stdout, stderr, err := dockerExecStart(ctx, client, baseURL, execID)
|
|
if err != nil {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec start: %w", err)
|
|
}
|
|
|
|
// --- Step 3: Inspect to get exit code ---
|
|
exitCode, err := dockerExecInspect(ctx, client, baseURL, execID)
|
|
if err != nil {
|
|
return DockerExecResult{}, fmt.Errorf("docker exec inspect: %w", err)
|
|
}
|
|
|
|
duration := time.Since(start).Milliseconds()
|
|
|
|
return DockerExecResult{
|
|
ExitCode: exitCode,
|
|
Stdout: stdout,
|
|
Stderr: stderr,
|
|
Duration: duration,
|
|
}, nil
|
|
}
|
|
|
|
// dockerExecCreate llama POST /containers/<id>/exec y devuelve el ExecID.
|
|
func dockerExecCreate(ctx context.Context, client *http.Client, baseURL string, opts DockerExecOpts) (string, error) {
|
|
type createBody struct {
|
|
AttachStdout bool `json:"AttachStdout"`
|
|
AttachStderr bool `json:"AttachStderr"`
|
|
Tty bool `json:"Tty"`
|
|
Cmd []string `json:"Cmd"`
|
|
User string `json:"User,omitempty"`
|
|
WorkingDir string `json:"WorkingDir,omitempty"`
|
|
Env []string `json:"Env,omitempty"`
|
|
}
|
|
|
|
body := createBody{
|
|
AttachStdout: true,
|
|
AttachStderr: true,
|
|
Tty: false,
|
|
Cmd: opts.Cmd,
|
|
User: opts.User,
|
|
WorkingDir: opts.WorkingDir,
|
|
Env: opts.Env,
|
|
}
|
|
|
|
bodyBytes, err := json.Marshal(body)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
url := fmt.Sprintf("%s/containers/%s/exec", baseURL, opts.ContainerID)
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(bodyBytes))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusCreated {
|
|
b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
|
|
return "", fmt.Errorf("engine returned %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
|
|
}
|
|
|
|
var result struct {
|
|
ID string `json:"Id"`
|
|
}
|
|
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
|
|
return "", err
|
|
}
|
|
if result.ID == "" {
|
|
return "", fmt.Errorf("engine returned empty exec ID")
|
|
}
|
|
|
|
return result.ID, nil
|
|
}
|
|
|
|
// dockerExecStart llama POST /exec/<id>/start y demux el stream multiplexado de Docker.
|
|
// Reusa dockerDemuxFrame de docker_container_logs.go (mismo paquete).
|
|
// Retorna (stdout, stderr, error).
|
|
func dockerExecStart(ctx context.Context, client *http.Client, baseURL, execID string) (string, string, error) {
|
|
type startBody struct {
|
|
Detach bool `json:"Detach"`
|
|
Tty bool `json:"Tty"`
|
|
}
|
|
bodyBytes, _ := json.Marshal(startBody{Detach: false, Tty: false})
|
|
|
|
url := fmt.Sprintf("%s/exec/%s/start", baseURL, execID)
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(bodyBytes))
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
if ctx.Err() != nil {
|
|
return "", "", fmt.Errorf("docker exec timed out")
|
|
}
|
|
return "", "", err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
|
|
return "", "", fmt.Errorf("engine returned %d on start: %s", resp.StatusCode, strings.TrimSpace(string(b)))
|
|
}
|
|
|
|
// Demux usando dockerDemuxFrame de docker_container_logs.go.
|
|
var stdoutBuf, stderrBuf strings.Builder
|
|
for {
|
|
streamType, payload, err := dockerDemuxFrame(resp.Body)
|
|
if err == io.EOF {
|
|
break
|
|
}
|
|
if err != nil {
|
|
if ctx.Err() != nil {
|
|
return "", "", fmt.Errorf("docker exec timed out")
|
|
}
|
|
return "", "", fmt.Errorf("reading exec stream: %w", err)
|
|
}
|
|
switch streamType {
|
|
case 1: // stdout
|
|
stdoutBuf.Write(payload)
|
|
case 2: // stderr
|
|
stderrBuf.Write(payload)
|
|
}
|
|
}
|
|
|
|
return stdoutBuf.String(), stderrBuf.String(), nil
|
|
}
|
|
|
|
// dockerExecInspect llama GET /exec/<id>/json y devuelve el ExitCode.
|
|
func dockerExecInspect(ctx context.Context, client *http.Client, baseURL, execID string) (int, error) {
|
|
url := fmt.Sprintf("%s/exec/%s/json", baseURL, execID)
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
|
if err != nil {
|
|
return -1, err
|
|
}
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return -1, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
|
|
return -1, fmt.Errorf("engine returned %d on inspect: %s", resp.StatusCode, strings.TrimSpace(string(b)))
|
|
}
|
|
|
|
var result struct {
|
|
ExitCode int `json:"ExitCode"`
|
|
}
|
|
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
|
|
return -1, err
|
|
}
|
|
|
|
return result.ExitCode, nil
|
|
}
|