69 lines
2.0 KiB
Bash
Executable File
69 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
if [[ $# -ne 3 ]]; then
|
|
echo "usage: $0 SOURCE_GIT_DIR NEW_WORK_DIR NODE_IMAGE_AT_SHA256" >&2
|
|
exit 2
|
|
fi
|
|
|
|
source_git=$(cd "$1" && pwd)
|
|
work_parent=$(cd "$(dirname "$2")" && pwd)
|
|
work_dir="$work_parent/$(basename "$2")"
|
|
node_image=$3
|
|
|
|
[[ "$node_image" == *@sha256:* ]] || {
|
|
echo "NODE_IMAGE_AT_SHA256 must be an immutable digest reference" >&2
|
|
exit 2
|
|
}
|
|
[[ ! -e "$work_dir" ]] || {
|
|
echo "refusing to overwrite existing work directory: $work_dir" >&2
|
|
exit 2
|
|
}
|
|
command -v podman >/dev/null || {
|
|
echo "podman is required" >&2
|
|
exit 127
|
|
}
|
|
|
|
mkdir -p "$work_dir"
|
|
"$SCRIPT_DIR/prepare-source.sh" "$source_git" "$work_dir/source"
|
|
|
|
common=(
|
|
--rm
|
|
--pull=never
|
|
--cpus=2
|
|
--memory=2g
|
|
--memory-swap=2g
|
|
--pids-limit=512
|
|
--cap-drop=all
|
|
--security-opt=no-new-privileges
|
|
--read-only
|
|
--tmpfs=/tmp:rw,nosuid,nodev,size=256m
|
|
--tmpfs=/run:rw,nosuid,nodev,size=16m
|
|
--env=HOME=/tmp/npm-home
|
|
--env=npm_config_cache=/tmp/npm-cache
|
|
--env=npm_config_audit=false
|
|
--env=npm_config_fund=false
|
|
--volume="$work_dir/source:/src:rw,Z"
|
|
--workdir=/src/server
|
|
)
|
|
|
|
# Dependency installation may execute package lifecycle scripts, so it occurs
|
|
# only inside this disposable, secret-free container. No home, credentials,
|
|
# engine socket, service bus, wallet, app data, or host network is mounted.
|
|
timeout --signal=TERM --kill-after=15s 10m \
|
|
podman run "${common[@]}" \
|
|
--network=slirp4netns:allow_host_loopback=false \
|
|
"$node_image" npm ci
|
|
|
|
# The source gate itself has no network. The work directory is intentionally
|
|
# retained so the parent can preserve exact logs and inspect package-lock state.
|
|
timeout --signal=TERM --kill-after=15s 10m \
|
|
podman run "${common[@]}" \
|
|
--network=none \
|
|
"$node_image" sh -c 'npm run build && npm test'
|
|
|
|
printf 'Podsteadr source gate passed for tree %s with image %s\n' \
|
|
"$(sed -n '1p' "$work_dir/source/.archipelago-patched-tree")" "$node_image"
|