-
Notifications
You must be signed in to change notification settings - Fork 91
Expand file tree
/
Copy pathdocker_compose.rs
More file actions
411 lines (345 loc) · 12.6 KB
/
Copy pathdocker_compose.rs
File metadata and controls
411 lines (345 loc) · 12.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
// SPDX-FileCopyrightText: © 2024-2025 Phala Network <dstack@phala.network>
//
// SPDX-License-Identifier: Apache-2.0
use anyhow::{Context, Result};
use bollard::container::{ListContainersOptions, RemoveContainerOptions};
use bollard::Docker;
use fs_err as fs;
use serde::Deserialize;
use std::collections::HashMap;
use std::path::Path;
use yaml_rust2::{Yaml, YamlLoader};
/// Holds parsed information from a docker-compose file
#[derive(Debug)]
pub struct ComposeInfo {
pub project_name: String,
pub service_names: std::collections::HashSet<String>,
}
/// Parse a docker-compose file and extract project name and service names
pub fn parse_docker_compose_file(compose_file: impl AsRef<Path>) -> Result<ComposeInfo> {
let compose_content =
fs::read_to_string(compose_file.as_ref()).context("failed to read docker-compose file")?;
let yaml_docs = YamlLoader::load_from_str(&compose_content).context("failed to parse YAML")?;
let yaml_doc = yaml_docs.first().context("empty YAML document")?;
// Extract project name
let project_name = if let Some(name) = yaml_doc["name"].as_str() {
name.to_string()
} else {
get_project_name(compose_file.as_ref())?
};
// Extract service names
let services = match &yaml_doc["services"] {
Yaml::Hash(m) => m,
_ => anyhow::bail!("missing or invalid 'services' field"),
};
let service_names = services
.keys()
.filter_map(|k| k.as_str().map(|s| s.to_string()))
.collect();
Ok(ComposeInfo {
project_name,
service_names,
})
}
fn get_project_name(compose_file: impl AsRef<Path>) -> Result<String> {
let project_name = fs::canonicalize(compose_file)
.context("failed to canonicalize compose file")?
.parent()
.context("failed to get parent directory of compose file")?
.file_name()
.context("failed to get file name of compose file")?
.to_string_lossy()
.into_owned();
Ok(project_name)
}
/// Remove orphaned containers using Docker daemon API
pub async fn remove_orphans(compose_file: impl AsRef<Path>, dry_run: bool) -> Result<()> {
// Connect to Docker daemon
let docker =
Docker::connect_with_local_defaults().context("Failed to connect to Docker daemon")?;
// Parse compose file to extract project name and service names
let compose_info = parse_docker_compose_file(&compose_file)?;
let project_name = compose_info.project_name;
let service_names = compose_info.service_names;
// List all containers
let options = ListContainersOptions::<String> {
all: true,
..Default::default()
};
let containers = docker
.list_containers(Some(options))
.await
.context("Failed to list containers")?;
// Find and remove orphaned containers
for container in containers {
let Some(labels) = container.labels else {
continue;
};
// Check if container belongs to current project
let Some(container_project) = labels.get("com.docker.compose.project") else {
continue;
};
if container_project != &project_name {
continue;
}
// Check if service still exists in compose file
let Some(service_name) = labels.get("com.docker.compose.service") else {
continue;
};
if service_names.contains(service_name) {
continue;
}
// Service no longer exists in compose file, remove the container
let Some(container_id) = container.id else {
continue;
};
if dry_run {
println!("would remove orphaned container {service_name} {container_id}");
} else {
println!("removing orphaned container {service_name} {container_id}");
docker
.remove_container(
&container_id,
Some(RemoveContainerOptions {
v: true,
force: true,
..Default::default()
}),
)
.await
.with_context(|| format!("Failed to remove container {}", container_id))?;
}
}
Ok(())
}
/// Docker container config.v2.json structure
#[derive(Deserialize)]
struct ContainerConfig {
#[serde(rename = "Config")]
config: Option<ContainerConfigInner>,
}
#[derive(Deserialize)]
struct ContainerConfigInner {
#[serde(rename = "Labels")]
labels: Option<HashMap<String, String>>,
}
/// Remove orphaned containers without requiring Docker daemon (offline mode)
///
/// This function directly reads Docker's data directory to find and remove
/// orphaned containers. It should be run BEFORE dockerd starts to prevent
/// orphaned containers from starting.
pub fn remove_orphans_direct(
compose_file: impl AsRef<Path>,
docker_root: impl AsRef<Path>,
dry_run: bool,
) -> Result<()> {
// Parse compose file to extract project name and service names
let compose_info = parse_docker_compose_file(&compose_file)?;
let project_name = &compose_info.project_name;
let service_names = &compose_info.service_names;
let containers_dir = docker_root.as_ref().join("containers");
if !containers_dir.exists() {
return Ok(());
}
// Iterate through all container directories
let entries = fs::read_dir(&containers_dir).with_context(|| {
format!(
"Failed to read containers directory: {}",
containers_dir.display()
)
})?;
for entry in entries {
let entry = entry.context("Failed to read directory entry")?;
let container_dir = entry.path();
if !container_dir.is_dir() {
continue;
}
let container_id = container_dir
.file_name()
.and_then(|n| n.to_str())
.unwrap_or("")
.to_string();
// Read config.v2.json
let config_path = container_dir.join("config.v2.json");
if !config_path.exists() {
continue;
}
let config_content = match fs::read_to_string(&config_path) {
Ok(content) => content,
Err(e) => {
eprintln!("Warning: Failed to read {}: {}", config_path.display(), e);
continue;
}
};
let config: ContainerConfig = match serde_json::from_str(&config_content) {
Ok(config) => config,
Err(e) => {
eprintln!("Warning: Failed to parse {}: {}", config_path.display(), e);
continue;
}
};
let Some(inner_config) = config.config else {
continue;
};
let Some(labels) = inner_config.labels else {
continue;
};
// Check if container belongs to current project
let Some(container_project) = labels.get("com.docker.compose.project") else {
continue;
};
if container_project != project_name {
continue;
}
// Check if service still exists in compose file
let Some(service_name) = labels.get("com.docker.compose.service") else {
continue;
};
if service_names.contains(service_name) {
continue;
}
// Service no longer exists in compose file, remove the container directory
let short_id = &container_id[..12.min(container_id.len())];
if dry_run {
println!("would remove orphaned container {service_name} {short_id}");
} else {
println!("removing orphaned container {service_name} {short_id}");
fs::remove_dir_all(&container_dir).with_context(|| {
format!(
"Failed to remove container directory: {}",
container_dir.display()
)
})?;
}
}
Ok(())
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_yaml_anchor_parsing() {
// Test that yaml-rust2 can parse YAML anchors and aliases
let yaml_with_anchors = r#"
name: test-project
services:
common: &common-config
image: ubuntu:latest
restart: unless-stopped
service1:
<<: *common-config
container_name: service1
service2:
<<: *common-config
container_name: service2
service3:
image: nginx:latest
"#;
let yaml_docs = YamlLoader::load_from_str(yaml_with_anchors).unwrap();
let yaml_doc = yaml_docs.first().unwrap();
// Extract project name
let project_name = yaml_doc["name"].as_str().unwrap();
assert_eq!(project_name, "test-project");
// Extract service names
let services = match &yaml_doc["services"] {
Yaml::Hash(m) => m,
_ => panic!("services should be a hash"),
};
let service_names: std::collections::HashSet<String> = services
.keys()
.filter_map(|k| k.as_str().map(|s| s.to_string()))
.collect();
// Verify all services are parsed including the anchor definition
assert_eq!(service_names.len(), 4);
assert!(service_names.contains("common"));
assert!(service_names.contains("service1"));
assert!(service_names.contains("service2"));
assert!(service_names.contains("service3"));
// Verify that anchors are resolved
// Note: yaml-rust2 parses anchors but doesn't auto-expand merge keys
// The merge key "<<" will contain the referenced hash
let service1 = &yaml_doc["services"]["service1"];
assert_eq!(service1["container_name"].as_str().unwrap(), "service1");
// Verify the merge key contains the anchor content
if let Yaml::Hash(merge_content) = &service1["<<"] {
assert_eq!(
merge_content[&Yaml::String("image".to_string())]
.as_str()
.unwrap(),
"ubuntu:latest"
);
assert_eq!(
merge_content[&Yaml::String("restart".to_string())]
.as_str()
.unwrap(),
"unless-stopped"
);
} else {
panic!("merge key should contain hash");
}
}
#[test]
fn test_yaml_simple_anchor_alias() {
// Test simple anchor and alias without merge keys
let yaml_simple_anchor = r#"
defaults: &defaults
timeout: 30
retries: 3
service1:
name: web
config: *defaults
service2:
name: api
config: *defaults
"#;
let yaml_docs = YamlLoader::load_from_str(yaml_simple_anchor).unwrap();
let yaml_doc = yaml_docs.first().unwrap();
// Verify alias points to the same content
let service1_config = &yaml_doc["service1"]["config"];
let service2_config = &yaml_doc["service2"]["config"];
assert_eq!(service1_config["timeout"].as_i64().unwrap(), 30);
assert_eq!(service1_config["retries"].as_i64().unwrap(), 3);
assert_eq!(service2_config["timeout"].as_i64().unwrap(), 30);
assert_eq!(service2_config["retries"].as_i64().unwrap(), 3);
}
#[test]
fn test_yaml_without_anchors() {
let yaml_simple = r#"
services:
web:
image: nginx:latest
db:
image: postgres:14
"#;
let yaml_docs = YamlLoader::load_from_str(yaml_simple).unwrap();
let yaml_doc = yaml_docs.first().unwrap();
let services = match &yaml_doc["services"] {
Yaml::Hash(m) => m,
_ => panic!("services should be a hash"),
};
let service_names: std::collections::HashSet<String> = services
.keys()
.filter_map(|k| k.as_str().map(|s| s.to_string()))
.collect();
assert_eq!(service_names.len(), 2);
assert!(service_names.contains("web"));
assert!(service_names.contains("db"));
}
#[test]
fn test_parse_real_compose_file() {
// Test with the real local-key-provider/build/docker-compose.yaml
let compose_path = concat!(
env!("CARGO_MANIFEST_DIR"),
"/../local-key-provider/build/docker-compose.yaml"
);
let compose_info = parse_docker_compose_file(compose_path).unwrap();
// Verify service names are correctly extracted
assert_eq!(compose_info.service_names.len(), 2);
assert!(compose_info.service_names.contains("aesmd"));
assert!(compose_info.service_names.contains("local-key-provider"));
// Note: x-common is an anchor definition, not a service, so it should not be in service_names
assert!(!compose_info.service_names.contains("x-common"));
// Project name defaults to the Compose file's parent directory.
assert_eq!(compose_info.project_name, "build");
}
}