56 lines
3.4 KiB
Plaintext
56 lines
3.4 KiB
Plaintext
%% werkdock, planned with Werkbaum (https://werkbaum.javagil.de): what exists, what comes next.
|
|
%% Status: [^] deployed on mih09 and in use, [x] merged, not yet deployed, [~] in work, [ ] planned, [?] idea, [-] dropped.
|
|
%% The block behind --- explains the nodes with an id.
|
|
%% View: https://werkbaum.javagil.de/?sourceUrl=https://git.javagil.de/mi/werkdock/raw/branch/main/docs/werkdock.werkbaum
|
|
|
|
[~] #werkdock: werkdock https://git.javagil.de/mi/werkdock
|
|
" A docker-like sandbox CLI over bwrap, filesystem isolation only, without root on a Hostsharing Managed Webspace.
|
|
- [^] #foundation: Go, one static binary, the standard library only (RFC 0001)
|
|
" Grew in Werkator's werkdock/ directory; moved here in Werkator's plan step 21.
|
|
- [^] #surface: Docker-shaped CLI (RFC 0002 level 1)
|
|
- [^] run, image names, the image store in docker's shape (S)
|
|
" 0.2.0, PR#1.
|
|
- [^] pull from a registry through crane (S)
|
|
" 0.3.0, PR#2; RFC 0002 level 2, RFC 0004.
|
|
- [^] Exit codes 126 and 127 for a command that cannot start (XS)
|
|
" 0.11.0, PR#13.
|
|
- [x] #images: Image creation (RFC 0004)
|
|
- [^] import with ENTRYPOINT and CMD, load of docker save and OCI layouts (M)
|
|
- [^] One import per image at a time, across processes (XS)
|
|
" 0.11.0, PR#13.
|
|
- [x] #images.dockerfile: A Dockerfile builds on the target (L)
|
|
" werkdock PR#14, 0.13.0.
|
|
- [^] #services: Services and Testcontainers (RFC 0005)
|
|
- [^] Service images as non-root, VOLUMEs as anonymous volumes (M)
|
|
" 0.4.0, PR#3; milestone 1.
|
|
- [^] Instance lifecycle: run -d, ps, logs, stop, rm, exec (M)
|
|
" 0.5.0, PR#4; milestone 2.
|
|
- [^] Docker Engine API on a unix socket; Testcontainers starts PostgreSQL (L)
|
|
" 0.6.0, PR#5; milestones 3 and 4.
|
|
- [^] A file into a container, PUT /containers/{id}/archive (S)
|
|
" 0.7.0, PR#7; a copy into a directory the image fills since 0.8.1, PR#10.
|
|
- [^] #quirks: Ports by the image's own variable, measured per image (M)
|
|
" 0.8.0 to 0.10.0, PR#8, PR#11, PR#12: PostgreSQL, MySQL, MariaDB, Redis, NATS, RabbitMQ, Mosquitto.
|
|
- [?] #mounts: Composable toolchain mounts (RFC 0003, candidate)
|
|
" Comes due when more than one toolchain combination is needed.
|
|
- [?] #prune: rmi of orphans and a prune verb for the image store
|
|
- [~] #workflow: Shared agentic workflow, reviews by werkrevisor
|
|
- [^] #workflow.equipment: AGENTS.md, PR documents, plan, review rules, risk analysis (S)
|
|
" werkdock PR#15.
|
|
- [^] #workflow.checks: Licenses in each build, vulnerabilities per branch and of main each night (S)
|
|
" werkdock PR#15: go-licenses and govulncheck.
|
|
- [x] #workflow.toolchain: Build with a Go toolchain without known vulnerabilities, and roll it out to mih09 (S) :#workflow.checks
|
|
" werkdock PR#16: go1.26.10, version 0.13.1.
|
|
- [x] #secrets: The sandbox's environment off bwrap's command line and readable by the owner only (S)
|
|
" werkdock PR#17, version 0.13.2; werkator PR#166 keeps it off werkdock's; PR#18, 0.13.3: bwrap's own environment empty.
|
|
---
|
|
|
|
#prune
|
|
The store keeps an unpacked tree per image; a consumer that keys images by the archive path leaves the old tree behind.
|
|
See "Disk Footprint" in the README.
|
|
|
|
#workflow.toolchain
|
|
govulncheck reports 7 called vulnerabilities of the standard library of go1.26.8, fixed in go1.26.9;
|
|
older Go has more: the CI builds with go1.24.4, the binary on mih09 came from go1.22.2.
|
|
A toolchain line in go.mod makes every build use a fixed Go.
|