453 lines
15 KiB
Go
453 lines
15 KiB
Go
package updateagent
|
|
|
|
import (
|
|
"bufio"
|
|
"bytes"
|
|
"context"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"log/slog"
|
|
"net"
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/updateprotocol"
|
|
)
|
|
|
|
const defaultImageRepository = "git.j-mahler.de/admin/domain-control-webinterface-prod"
|
|
|
|
type DockerRunner struct {
|
|
docker *dockerClient
|
|
imageRepository string
|
|
targetLabel string
|
|
logger *slog.Logger
|
|
}
|
|
|
|
type updateError struct {
|
|
message string
|
|
err error
|
|
}
|
|
|
|
func (e *updateError) Error() string { return e.err.Error() }
|
|
func (e *updateError) Unwrap() error { return e.err }
|
|
func (e *updateError) PublicMessage() string { return e.message }
|
|
|
|
func NewDockerRunner(socket, imageRepository, targetLabel string, logger *slog.Logger) *DockerRunner {
|
|
if imageRepository == "" {
|
|
imageRepository = defaultImageRepository
|
|
}
|
|
return &DockerRunner{docker: newDockerClient(socket), imageRepository: imageRepository, targetLabel: targetLabel, logger: logger}
|
|
}
|
|
|
|
func (r *DockerRunner) Update(ctx context.Context, request updateprotocol.Request, progress func(phase, message string)) (resultErr error) {
|
|
if !updateprotocol.ValidVersion(request.Version) {
|
|
return errors.New("invalid target version")
|
|
}
|
|
if err := r.docker.negotiate(ctx); err != nil {
|
|
return &updateError{message: "Containerverwaltung ist nicht erreichbar; der Dienst läuft unverändert weiter", err: err}
|
|
}
|
|
progress(updateprotocol.PhasePulling, "Container-Image wird geladen")
|
|
if err := r.docker.pullImage(ctx, r.imageRepository, request.Version, request.RegistryUsername, request.RegistryToken); err != nil {
|
|
return &updateError{message: "Image konnte nicht geladen werden; der Dienst läuft unverändert weiter", err: err}
|
|
}
|
|
target, err := r.docker.findTarget(ctx, r.targetLabel)
|
|
if err != nil {
|
|
return &updateError{message: "Laufender Anwendungscontainer wurde nicht eindeutig gefunden", err: err}
|
|
}
|
|
inspected, err := r.docker.inspectContainer(ctx, target.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
originalName := strings.TrimPrefix(inspected.Name, "/")
|
|
if originalName == "" {
|
|
return errors.New("target container has no name")
|
|
}
|
|
backupName := originalName + "-rollback-" + fmt.Sprint(time.Now().UTC().Unix())
|
|
var oldStopped, oldRenamed bool
|
|
var newID string
|
|
defer func() {
|
|
if resultErr == nil || (!oldStopped && !oldRenamed && newID == "") {
|
|
return
|
|
}
|
|
rollbackCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
|
|
defer cancel()
|
|
if rollbackErr := r.rollback(rollbackCtx, target.ID, originalName, oldStopped, oldRenamed, newID); rollbackErr != nil {
|
|
r.logger.Error("software update rollback failed", "error", rollbackErr)
|
|
resultErr = &updateError{message: "Update und automatische Wiederherstellung sind fehlgeschlagen; Containerstatus am Host prüfen", err: fmt.Errorf("%w; rollback: %v", resultErr, rollbackErr)}
|
|
}
|
|
}()
|
|
|
|
progress(updateprotocol.PhaseRestarting, "Anwendung wird kontrolliert neu gestartet")
|
|
if err := r.docker.stopContainer(ctx, target.ID, 20); err != nil {
|
|
return err
|
|
}
|
|
oldStopped = true
|
|
if err := r.docker.renameContainer(ctx, target.ID, backupName); err != nil {
|
|
return err
|
|
}
|
|
oldRenamed = true
|
|
newID, err = r.docker.createReplacement(ctx, inspected, originalName, r.imageRepository+":"+request.Version)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := r.docker.startContainer(ctx, newID); err != nil {
|
|
return err
|
|
}
|
|
progress(updateprotocol.PhaseVerifying, "Neuer Container wird geprüft")
|
|
if err := r.docker.waitHealthy(ctx, newID, 100*time.Second); err != nil {
|
|
return err
|
|
}
|
|
if err := r.docker.removeContainer(ctx, target.ID, false); err != nil {
|
|
r.logger.Warn("old update rollback container could not be removed", "container", target.ID, "error", err)
|
|
}
|
|
oldStopped, oldRenamed, newID = false, false, ""
|
|
return nil
|
|
}
|
|
|
|
func (r *DockerRunner) rollback(ctx context.Context, oldID, originalName string, oldStopped, oldRenamed bool, newID string) error {
|
|
var failures []string
|
|
if newID != "" {
|
|
if err := r.docker.stopContainer(ctx, newID, 5); err != nil && !isDockerNotModified(err) {
|
|
failures = append(failures, "stop replacement: "+err.Error())
|
|
}
|
|
if err := r.docker.removeContainer(ctx, newID, true); err != nil {
|
|
failures = append(failures, "remove replacement: "+err.Error())
|
|
}
|
|
}
|
|
if oldRenamed {
|
|
if err := r.docker.renameContainer(ctx, oldID, originalName); err != nil {
|
|
failures = append(failures, "restore name: "+err.Error())
|
|
}
|
|
}
|
|
if oldStopped {
|
|
if err := r.docker.startContainer(ctx, oldID); err != nil && !isDockerNotModified(err) {
|
|
failures = append(failures, "restart previous container: "+err.Error())
|
|
}
|
|
}
|
|
if len(failures) > 0 {
|
|
return errors.New(strings.Join(failures, "; "))
|
|
}
|
|
return nil
|
|
}
|
|
|
|
type dockerClient struct {
|
|
socket string
|
|
client *http.Client
|
|
apiPrefix string
|
|
}
|
|
|
|
type containerSummary struct {
|
|
ID string `json:"Id"`
|
|
Names []string `json:"Names"`
|
|
State string `json:"State"`
|
|
}
|
|
|
|
type containerInspect struct {
|
|
ID string `json:"Id"`
|
|
Name string `json:"Name"`
|
|
Config json.RawMessage `json:"Config"`
|
|
HostConfig json.RawMessage `json:"HostConfig"`
|
|
NetworkSettings struct {
|
|
Networks map[string]endpointSettings `json:"Networks"`
|
|
} `json:"NetworkSettings"`
|
|
State containerState `json:"State"`
|
|
}
|
|
|
|
type endpointSettings struct {
|
|
IPAMConfig json.RawMessage `json:"IPAMConfig,omitempty"`
|
|
Links []string `json:"Links,omitempty"`
|
|
Aliases []string `json:"Aliases,omitempty"`
|
|
MacAddress string `json:"MacAddress,omitempty"`
|
|
DriverOpts map[string]string `json:"DriverOpts,omitempty"`
|
|
GwPriority int `json:"GwPriority,omitempty"`
|
|
}
|
|
|
|
type containerState struct {
|
|
Running bool `json:"Running"`
|
|
ExitCode int `json:"ExitCode"`
|
|
Health *struct {
|
|
Status string `json:"Status"`
|
|
} `json:"Health"`
|
|
}
|
|
|
|
func newDockerClient(socket string) *dockerClient {
|
|
transport := &http.Transport{
|
|
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
|
|
return (&net.Dialer{Timeout: 2 * time.Second}).DialContext(ctx, "unix", socket)
|
|
},
|
|
MaxIdleConns: 2,
|
|
MaxIdleConnsPerHost: 2,
|
|
IdleConnTimeout: 30 * time.Second,
|
|
}
|
|
return &dockerClient{socket: socket, client: &http.Client{Transport: transport}}
|
|
}
|
|
|
|
func (c *dockerClient) negotiate(ctx context.Context) error {
|
|
response, err := c.request(ctx, http.MethodGet, "/version", nil, nil, false)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode != http.StatusOK {
|
|
return dockerStatusError(response)
|
|
}
|
|
var version struct {
|
|
APIVersion string `json:"ApiVersion"`
|
|
}
|
|
if err := json.NewDecoder(io.LimitReader(response.Body, 64<<10)).Decode(&version); err != nil {
|
|
return fmt.Errorf("decode Docker API version: %w", err)
|
|
}
|
|
for _, character := range version.APIVersion {
|
|
if (character < '0' || character > '9') && character != '.' {
|
|
return errors.New("Docker returned an invalid API version")
|
|
}
|
|
}
|
|
if version.APIVersion == "" {
|
|
return errors.New("Docker returned an empty API version")
|
|
}
|
|
c.apiPrefix = "/v" + version.APIVersion
|
|
return nil
|
|
}
|
|
|
|
func (c *dockerClient) findTarget(ctx context.Context, label string) (containerSummary, error) {
|
|
filters, _ := json.Marshal(map[string][]string{"label": {label}})
|
|
query := url.Values{"all": {"1"}, "filters": {string(filters)}}
|
|
response, err := c.request(ctx, http.MethodGet, "/containers/json?"+query.Encode(), nil, nil, true)
|
|
if err != nil {
|
|
return containerSummary{}, err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode != http.StatusOK {
|
|
return containerSummary{}, dockerStatusError(response)
|
|
}
|
|
var containers []containerSummary
|
|
if err := json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&containers); err != nil {
|
|
return containerSummary{}, err
|
|
}
|
|
var running []containerSummary
|
|
for _, container := range containers {
|
|
if container.State == "running" {
|
|
running = append(running, container)
|
|
}
|
|
}
|
|
if len(running) != 1 {
|
|
return containerSummary{}, fmt.Errorf("expected exactly one running target container, found %d", len(running))
|
|
}
|
|
return running[0], nil
|
|
}
|
|
|
|
func (c *dockerClient) pullImage(ctx context.Context, repository, tag, username, token string) error {
|
|
authJSON, _ := json.Marshal(map[string]string{"username": username, "password": token, "serveraddress": strings.Split(repository, "/")[0]})
|
|
headers := http.Header{"X-Registry-Auth": {base64.URLEncoding.EncodeToString(authJSON)}}
|
|
query := url.Values{"fromImage": {repository}, "tag": {tag}}
|
|
response, err := c.request(ctx, http.MethodPost, "/images/create?"+query.Encode(), nil, headers, true)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode != http.StatusOK {
|
|
return dockerStatusError(response)
|
|
}
|
|
scanner := bufio.NewScanner(response.Body)
|
|
scanner.Buffer(make([]byte, 64<<10), 1<<20)
|
|
for scanner.Scan() {
|
|
var event struct {
|
|
Error string `json:"error"`
|
|
}
|
|
if err := json.Unmarshal(scanner.Bytes(), &event); err == nil && event.Error != "" {
|
|
return errors.New(event.Error)
|
|
}
|
|
}
|
|
return scanner.Err()
|
|
}
|
|
|
|
func (c *dockerClient) inspectContainer(ctx context.Context, id string) (containerInspect, error) {
|
|
response, err := c.request(ctx, http.MethodGet, "/containers/"+url.PathEscape(id)+"/json", nil, nil, true)
|
|
if err != nil {
|
|
return containerInspect{}, err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode != http.StatusOK {
|
|
return containerInspect{}, dockerStatusError(response)
|
|
}
|
|
var inspected containerInspect
|
|
if err := json.NewDecoder(io.LimitReader(response.Body, 4<<20)).Decode(&inspected); err != nil {
|
|
return containerInspect{}, err
|
|
}
|
|
return inspected, nil
|
|
}
|
|
|
|
func (c *dockerClient) stopContainer(ctx context.Context, id string, seconds int) error {
|
|
query := url.Values{"t": {fmt.Sprint(seconds)}}
|
|
response, err := c.request(ctx, http.MethodPost, "/containers/"+url.PathEscape(id)+"/stop?"+query.Encode(), nil, nil, true)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode == http.StatusNoContent || response.StatusCode == http.StatusNotModified {
|
|
return nil
|
|
}
|
|
return dockerStatusError(response)
|
|
}
|
|
|
|
func (c *dockerClient) renameContainer(ctx context.Context, id, name string) error {
|
|
query := url.Values{"name": {name}}
|
|
response, err := c.request(ctx, http.MethodPost, "/containers/"+url.PathEscape(id)+"/rename?"+query.Encode(), nil, nil, true)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode == http.StatusNoContent {
|
|
return nil
|
|
}
|
|
return dockerStatusError(response)
|
|
}
|
|
|
|
func (c *dockerClient) createReplacement(ctx context.Context, inspected containerInspect, name, image string) (string, error) {
|
|
var body map[string]json.RawMessage
|
|
if err := json.Unmarshal(inspected.Config, &body); err != nil {
|
|
return "", fmt.Errorf("decode container config: %w", err)
|
|
}
|
|
imageJSON, _ := json.Marshal(image)
|
|
body["Image"] = imageJSON
|
|
body["HostConfig"] = inspected.HostConfig
|
|
endpoints := make(map[string]endpointSettings, len(inspected.NetworkSettings.Networks))
|
|
oldIDPrefix := inspected.ID
|
|
if len(oldIDPrefix) > 12 {
|
|
oldIDPrefix = oldIDPrefix[:12]
|
|
}
|
|
for network, endpoint := range inspected.NetworkSettings.Networks {
|
|
aliases := endpoint.Aliases[:0]
|
|
for _, alias := range endpoint.Aliases {
|
|
if alias != inspected.ID && alias != oldIDPrefix {
|
|
aliases = append(aliases, alias)
|
|
}
|
|
}
|
|
endpoint.Aliases = aliases
|
|
endpoints[network] = endpoint
|
|
}
|
|
networkingJSON, _ := json.Marshal(map[string]any{"EndpointsConfig": endpoints})
|
|
body["NetworkingConfig"] = networkingJSON
|
|
encoded, err := json.Marshal(body)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
query := url.Values{"name": {name}}
|
|
response, err := c.request(ctx, http.MethodPost, "/containers/create?"+query.Encode(), bytes.NewReader(encoded), http.Header{"Content-Type": {"application/json"}}, true)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode != http.StatusCreated {
|
|
return "", dockerStatusError(response)
|
|
}
|
|
var created struct {
|
|
ID string `json:"Id"`
|
|
}
|
|
if err := json.NewDecoder(io.LimitReader(response.Body, 64<<10)).Decode(&created); err != nil {
|
|
return "", err
|
|
}
|
|
if created.ID == "" {
|
|
return "", errors.New("Docker created a replacement without an ID")
|
|
}
|
|
return created.ID, nil
|
|
}
|
|
|
|
func (c *dockerClient) startContainer(ctx context.Context, id string) error {
|
|
response, err := c.request(ctx, http.MethodPost, "/containers/"+url.PathEscape(id)+"/start", nil, nil, true)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode == http.StatusNoContent || response.StatusCode == http.StatusNotModified {
|
|
return nil
|
|
}
|
|
return dockerStatusError(response)
|
|
}
|
|
|
|
func (c *dockerClient) removeContainer(ctx context.Context, id string, force bool) error {
|
|
query := url.Values{"force": {fmt.Sprint(force)}, "v": {"0"}}
|
|
response, err := c.request(ctx, http.MethodDelete, "/containers/"+url.PathEscape(id)+"?"+query.Encode(), nil, nil, true)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode == http.StatusNoContent || response.StatusCode == http.StatusNotFound {
|
|
return nil
|
|
}
|
|
return dockerStatusError(response)
|
|
}
|
|
|
|
func (c *dockerClient) waitHealthy(ctx context.Context, id string, timeout time.Duration) error {
|
|
deadline := time.NewTimer(timeout)
|
|
ticker := time.NewTicker(time.Second)
|
|
defer deadline.Stop()
|
|
defer ticker.Stop()
|
|
consecutiveHealthy := 0
|
|
startedAt := time.Now()
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
case <-deadline.C:
|
|
return errors.New("replacement container did not become healthy in time")
|
|
case <-ticker.C:
|
|
inspected, err := c.inspectContainer(ctx, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !inspected.State.Running {
|
|
return fmt.Errorf("replacement container stopped with exit code %d", inspected.State.ExitCode)
|
|
}
|
|
if inspected.State.Health == nil {
|
|
if time.Since(startedAt) >= 8*time.Second {
|
|
return nil
|
|
}
|
|
continue
|
|
}
|
|
if inspected.State.Health.Status == "healthy" {
|
|
consecutiveHealthy++
|
|
if consecutiveHealthy >= 3 {
|
|
return nil
|
|
}
|
|
} else {
|
|
consecutiveHealthy = 0
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func (c *dockerClient) request(ctx context.Context, method, path string, body io.Reader, headers http.Header, versioned bool) (*http.Response, error) {
|
|
if versioned {
|
|
path = c.apiPrefix + path
|
|
}
|
|
request, err := http.NewRequestWithContext(ctx, method, "http://docker"+path, body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
for name, values := range headers {
|
|
for _, value := range values {
|
|
request.Header.Add(name, value)
|
|
}
|
|
}
|
|
return c.client.Do(request)
|
|
}
|
|
|
|
func dockerStatusError(response *http.Response) error {
|
|
message, _ := io.ReadAll(io.LimitReader(response.Body, 8<<10))
|
|
trimmed := strings.TrimSpace(string(message))
|
|
if trimmed == "" {
|
|
trimmed = http.StatusText(response.StatusCode)
|
|
}
|
|
return fmt.Errorf("Docker API HTTP %d: %s", response.StatusCode, trimmed)
|
|
}
|
|
|
|
func isDockerNotModified(err error) bool {
|
|
return err != nil && strings.Contains(err.Error(), "HTTP 304")
|
|
}
|