| 1 | + | package exec |
| 2 | + | |
| 3 | + | import ( |
| 4 | + | "context" |
| 5 | + | "fmt" |
| 6 | + | "io" |
| 7 | + | "strings" |
| 8 | + | |
| 9 | + | "github.com/docker/docker/api/types" |
| 10 | + | "github.com/docker/docker/api/types/container" |
| 11 | + | dockerclient "github.com/docker/docker/client" |
| 12 | + | "github.com/google/uuid" |
| 13 | + | "github.com/sirupsen/logrus" |
| 14 | + | "github.com/spf13/cobra" |
| 15 | + | |
| 16 | + | "github.com/iximiuz/cdebug/cmd" |
| 17 | + | ) |
| 18 | + | |
| 19 | + | // cdebug exec [--image busybox] <CONT> [CMD] |
| 20 | + | // cdebug exec [-it] --image nixery.dev/shell/ps <CONT> [CMD] |
| 21 | + | |
| 22 | + | // cdebug images |
| 23 | + | // - busybox |
| 24 | + | // - alpine |
| 25 | + | // - nixery:shell/ps |
| 26 | + | |
| 27 | + | const ( |
| 28 | + | defaultToolkitImage = "docker.io/library/busybox:latest" |
| 29 | + | ) |
| 30 | + | |
| 31 | + | type options struct { |
| 32 | + | target string |
| 33 | + | name string |
| 34 | + | image string |
| 35 | + | tty bool |
| 36 | + | stdin bool |
| 37 | + | cmd []string |
| 38 | + | } |
| 39 | + | |
| 40 | + | func NewCommand(cli cmd.CLI) *cobra.Command { |
| 41 | + | var opts options |
| 42 | + | |
| 43 | + | cmd := &cobra.Command{ |
| 44 | + | Use: "exec [OPTIONS] CONTAINER [COMMAND] [ARG...]", |
| 45 | + | Short: "Start a debugger shell in the target container", |
| 46 | + | Args: cobra.MinimumNArgs(1), |
| 47 | + | RunE: func(cmd *cobra.Command, args []string) error { |
| 48 | + | opts.target = args[0] |
| 49 | + | if len(args) > 1 { |
| 50 | + | opts.cmd = args[1:] |
| 51 | + | } |
| 52 | + | return runDebugger(context.Background(), cli, &opts) |
| 53 | + | }, |
| 54 | + | } |
| 55 | + | |
| 56 | + | flags := cmd.Flags() |
| 57 | + | flags.SetInterspersed(false) // Instead of relying on -- |
| 58 | + | |
| 59 | + | flags.StringVar( |
| 60 | + | &opts.name, |
| 61 | + | "name", |
| 62 | + | "", |
| 63 | + | "Assign a name to the debugger container", |
| 64 | + | ) |
| 65 | + | flags.StringVar( |
| 66 | + | &opts.image, |
| 67 | + | "image", |
| 68 | + | defaultToolkitImage, |
| 69 | + | "Debugging toolkit image (hint: use 'busybox' or 'nixery.dev/shell/tool1/tool2/etc...')", |
| 70 | + | ) |
| 71 | + | flags.BoolVarP( |
| 72 | + | &opts.stdin, |
| 73 | + | "interactive", |
| 74 | + | "i", |
| 75 | + | false, |
| 76 | + | "Keep the STDIN open (same as in `docker exec -i`)", |
| 77 | + | ) |
| 78 | + | flags.BoolVarP( |
| 79 | + | &opts.tty, |
| 80 | + | "tty", |
| 81 | + | "t", |
| 82 | + | false, |
| 83 | + | "Allocate a pseudo-TTY (same as in `docker exec -t`)", |
| 84 | + | ) |
| 85 | + | |
| 86 | + | return cmd |
| 87 | + | } |
| 88 | + | |
| 89 | + | const chrootProgramBusybox = ` |
| 90 | + | set -euxo pipefail |
| 91 | + | |
| 92 | + | rm -rf /proc/1/root/.cdebug |
| 93 | + | ln -s /proc/$$/root/bin/ /proc/1/root/.cdebug |
| 94 | + | export PATH=$PATH:/.cdebug |
| 95 | + | chroot /proc/1/root sh |
| 96 | + | ` |
| 97 | + | |
| 98 | + | func runDebugger(ctx context.Context, cli cmd.CLI, opts *options) error { |
| 99 | + | if err := cli.InputStream().CheckTty(opts.stdin, opts.tty); err != nil { |
| 100 | + | return err |
| 101 | + | } |
| 102 | + | |
| 103 | + | client, err := dockerclient.NewClientWithOpts( |
| 104 | + | dockerclient.FromEnv, |
| 105 | + | dockerclient.WithAPIVersionNegotiation(), |
| 106 | + | ) |
| 107 | + | if err != nil { |
| 108 | + | return fmt.Errorf("cannot initialize Docker client: %w", err) |
| 109 | + | } |
| 110 | + | |
| 111 | + | if err := pullImage(ctx, cli, client, opts.image); err != nil { |
| 112 | + | return err |
| 113 | + | } |
| 114 | + | |
| 115 | + | target := "container:" + opts.target |
| 116 | + | resp, err := client.ContainerCreate( |
| 117 | + | ctx, |
| 118 | + | &container.Config{ |
| 119 | + | Image: opts.image, |
| 120 | + | Cmd: []string{"sh", "-c", chrootProgramBusybox}, |
| 121 | + | // AttachStdin: true, |
| 122 | + | OpenStdin: opts.stdin, |
| 123 | + | Tty: opts.tty, |
| 124 | + | }, |
| 125 | + | &container.HostConfig{ |
| 126 | + | NetworkMode: container.NetworkMode(target), |
| 127 | + | PidMode: container.PidMode(target), |
| 128 | + | UTSMode: container.UTSMode(target), |
| 129 | + | // TODO: IpcMode: container.IpcMode("container:my-distroless"), |
| 130 | + | }, |
| 131 | + | nil, |
| 132 | + | nil, |
| 133 | + | debuggerName(opts.name), |
| 134 | + | ) |
| 135 | + | if err != nil { |
| 136 | + | return fmt.Errorf("cannot create debugger container: %w", err) |
| 137 | + | } |
| 138 | + | |
| 139 | + | if opts.stdin || opts.tty { |
| 140 | + | close, err := attachDebugger(ctx, cli, client, opts, resp.ID) |
| 141 | + | if err != nil { |
| 142 | + | return fmt.Errorf("cannot attach to debugger container: %w", err) |
| 143 | + | } |
| 144 | + | defer close() |
| 145 | + | } |
| 146 | + | |
| 147 | + | if err := client.ContainerStart(ctx, resp.ID, types.ContainerStartOptions{}); err != nil { |
| 148 | + | return fmt.Errorf("cannot start debugger container: %w", err) |
| 149 | + | } |
| 150 | + | |
| 151 | + | statusCh, errCh := client.ContainerWait(ctx, resp.ID, container.WaitConditionNotRunning) |
| 152 | + | select { |
| 153 | + | case err := <-errCh: |
| 154 | + | if err != nil { |
| 155 | + | return fmt.Errorf("waiting debugger container failed: %w", err) |
| 156 | + | } |
| 157 | + | case <-statusCh: |
| 158 | + | } |
| 159 | + | |
| 160 | + | return nil |
| 161 | + | } |
| 162 | + | |
| 163 | + | func pullImage( |
| 164 | + | ctx context.Context, |
| 165 | + | cli cmd.CLI, |
| 166 | + | client *dockerclient.Client, |
| 167 | + | image string, |
| 168 | + | ) error { |
| 169 | + | resp, err := client.ImagePull(ctx, image, types.ImagePullOptions{}) |
| 170 | + | if err != nil { |
| 171 | + | return fmt.Errorf("cannot pull debugger image %q: %w", image, err) |
| 172 | + | } |
| 173 | + | defer resp.Close() |
| 174 | + | |
| 175 | + | _, err = io.Copy(cli.OutputStream(), resp) |
| 176 | + | return err |
| 177 | + | } |
| 178 | + | |
| 179 | + | func attachDebugger( |
| 180 | + | ctx context.Context, |
| 181 | + | cli cmd.CLI, |
| 182 | + | client *dockerclient.Client, |
| 183 | + | opts *options, |
| 184 | + | contID string, |
| 185 | + | ) (func(), error) { |
| 186 | + | resp, err := client.ContainerAttach(ctx, contID, types.ContainerAttachOptions{ |
| 187 | + | Stream: true, |
| 188 | + | Stdin: opts.stdin, |
| 189 | + | Stdout: true, |
| 190 | + | Stderr: true, |
| 191 | + | }) |
| 192 | + | if err != nil { |
| 193 | + | return nil, fmt.Errorf("cannot attach to debugger container: %w", err) |
| 194 | + | } |
| 195 | + | |
| 196 | + | var cin io.ReadCloser |
| 197 | + | if opts.stdin { |
| 198 | + | cin = cli.InputStream() |
| 199 | + | } |
| 200 | + | |
| 201 | + | var cout io.Writer = cli.OutputStream() |
| 202 | + | var cerr io.Writer = cli.ErrorStream() |
| 203 | + | if opts.tty { |
| 204 | + | cerr = cli.OutputStream() |
| 205 | + | } |
| 206 | + | |
| 207 | + | go func() { |
| 208 | + | s := ioStreamer{ |
| 209 | + | streams: cli, |
| 210 | + | inputStream: cin, |
| 211 | + | outputStream: cout, |
| 212 | + | errorStream: cerr, |
| 213 | + | resp: resp, |
| 214 | + | tty: opts.tty, |
| 215 | + | stdin: opts.stdin, |
| 216 | + | } |
| 217 | + | |
| 218 | + | if err := s.stream(ctx); err != nil { |
| 219 | + | logrus.WithError(err).Warn("ioStreamer.stream() failed") |
| 220 | + | } |
| 221 | + | }() |
| 222 | + | |
| 223 | + | return resp.Close, nil |
| 224 | + | } |
| 225 | + | |
| 226 | + | type ioStreamer struct { |
| 227 | + | streams cmd.Streams |
| 228 | + | |
| 229 | + | inputStream io.ReadCloser |
| 230 | + | outputStream io.Writer |
| 231 | + | errorStream io.Writer |
| 232 | + | |
| 233 | + | resp types.HijackedResponse |
| 234 | + | |
| 235 | + | stdin bool |
| 236 | + | tty bool |
| 237 | + | } |
| 238 | + | |
| 239 | + | func (s *ioStreamer) stream(ctx context.Context) error { |
| 240 | + | // TODO: check stdin && tty flags |
| 241 | + | s.streams.InputStream().SetRawTerminal() |
| 242 | + | s.streams.OutputStream().SetRawTerminal() |
| 243 | + | defer func() { |
| 244 | + | s.streams.InputStream().RestoreTerminal() |
| 245 | + | s.streams.OutputStream().RestoreTerminal() |
| 246 | + | }() |
| 247 | + | |
| 248 | + | inDone := make(chan error) |
| 249 | + | go func() { |
| 250 | + | io.Copy(s.resp.Conn, s.inputStream) |
| 251 | + | close(inDone) |
| 252 | + | }() |
| 253 | + | |
| 254 | + | outDone := make(chan error) |
| 255 | + | go func() { |
| 256 | + | io.Copy(s.outputStream, s.resp.Reader) |
| 257 | + | close(outDone) |
| 258 | + | }() |
| 259 | + | |
| 260 | + | select { |
| 261 | + | case <-ctx.Done(): |
| 262 | + | return ctx.Err() |
| 263 | + | case <-inDone: |
| 264 | + | <-outDone |
| 265 | + | return nil |
| 266 | + | case <-outDone: |
| 267 | + | return nil |
| 268 | + | } |
| 269 | + | |
| 270 | + | return nil |
| 271 | + | } |
| 272 | + | |
| 273 | + | func debuggerName(name string) string { |
| 274 | + | if len(name) > 0 { |
| 275 | + | return name |
| 276 | + | } |
| 277 | + | |
| 278 | + | return "cdebug-" + strings.Split(uuid.NewString(), "-")[0] |
| 279 | + | } |
| 280 | + | |