fix(compose): dependency closure for restricted plans, carry namespace modes - #118
Conversation
…e modes Round-2 adversarial findings on the native backend switch in dap: 1. A Plan restricted to a service subset (devcontainer runServices) started exactly the named services — docker compose up <names...> starts their transitive dependency closure. makeKeepSet and the engine's sidecar-image builds now expand the selection through the new compose.ServiceClosure (depends_on plus service:<x> namespace edges, the same edge set TopoSort orders by), so a dependency outside runServices is built and started again. 2. network_mode/pid/ipc were silently dropped: serviceToRunSpec always attached the project network and the runtime spec had no namespace fields, so `network_mode: none` — an explicit isolation request — received full project-network connectivity. RunSpec gains NetworkMode/PidMode/IpcMode (Docker HostConfig syntax), the docker backend maps them, service:<x> resolves to the dependency's started container ID, and a service with a network mode skips the project network per Docker's API constraints. TopoSort now also treats pid:/ipc: service references as ordering edges. Backends without namespace sharing are unaffected: Plan.Validate already refuses these projects via Capabilities.NamespaceSharing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 40 minutes Limit details: You’ve used the included review currently available. Your 67 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. You’re in a promotional period — use the checkbox below to run this review for free:
On-demand reviews are free for the next 29 days. After that, they cost $0.25 per reviewed file. How can I continue?Run this review now using the option above, or comment You can also wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
Comment |
1 participant
Follow-up to #115 — the two MEDIUM findings from round 2 of the adversarial review on crunchloop/dap#4828.
1. Restricted plans now start/build the dependency closure
docker compose up <names...>starts the named services and their transitive dependencies; a Plan restricted viaServices(devcontainerrunServices) started exactly the named set, so a dependency outside the list was neither built nor started. Newcompose.ServiceClosureexpands the selection through the same edge setTopoSortorders by (depends_on+service:<x>namespace references, now includingpid:/ipc:), and bothmakeKeepSetand the engine's sidecar-image builds use it.2.
network_mode/pid/ipccarried to the backendserviceToRunSpecalways attached the project network and the runtime-neutral spec had no namespace fields — sonetwork_mode: none(an explicit isolation request) silently received full project-network connectivity, andservice:<x>namespace joins were dropped. Now:RunSpecgainsNetworkMode/PidMode/IpcMode(Docker HostConfig syntax); the docker backend maps them ontoHostConfig.service:<x>resolves to the dependency's already-started container ID — ordering was already guaranteed because those references are TopoSort edges;pid:/ipc:service references now contribute edges too.docker composesemantics.Plan.Validatealready refuses such projects viaCapabilities.NamespaceSharing.Tests
ServiceClosurefollows namespace edges; engine sidecar builds cover dependencies of the selection.none/hostcarried and project network skipped;service:<x>resolves to the dependency's container ID; unaffected services keep the project network.go test .,./compose,./runtime/dockergreen.Will be consumed by crunchloop/dap#4828 as v0.4.2.
🤖 Generated with Claude Code