|
| 1 | +// Command openbloxd brokers the Docker API so callers never need socket access. |
| 2 | +// |
| 3 | +// It owns the Docker connection and exposes only openblox's own surface, under |
| 4 | +// a policy read from its config file. A caller that is compromised can create |
| 5 | +// sandboxes, which it can do by design; it cannot mount the host filesystem or |
| 6 | +// start a privileged container. |
| 7 | +package main |
| 8 | + |
| 9 | +import ( |
| 10 | + "context" |
| 11 | + "errors" |
| 12 | + "flag" |
| 13 | + "fmt" |
| 14 | + "log/slog" |
| 15 | + "net" |
| 16 | + "net/http" |
| 17 | + "os" |
| 18 | + "os/signal" |
| 19 | + "syscall" |
| 20 | + "time" |
| 21 | + |
| 22 | + "github.com/blox-eng/openblox/internal/daemon" |
| 23 | + "github.com/blox-eng/openblox/pkg/docker" |
| 24 | +) |
| 25 | + |
| 26 | +func main() { |
| 27 | + configPath := flag.String("config", "/etc/openbloxd/config.yaml", "path to the config file") |
| 28 | + flag.Parse() |
| 29 | + |
| 30 | + if err := run(*configPath); err != nil { |
| 31 | + slog.Error("openbloxd: exiting", slog.Any("error", err)) |
| 32 | + os.Exit(1) |
| 33 | + } |
| 34 | +} |
| 35 | + |
| 36 | +func run(configPath string) error { |
| 37 | + cfg, err := daemon.Load(configPath) |
| 38 | + if err != nil { |
| 39 | + return err |
| 40 | + } |
| 41 | + |
| 42 | + var opts []docker.Option |
| 43 | + // One Docker connection carries one credential, and Config.validate has |
| 44 | + // already refused profiles whose registry_auth differs — so every non-nil |
| 45 | + // value here is the same one, and applying it once says that plainly. |
| 46 | + var auth *daemon.RegistryAuth |
| 47 | + for name, p := range cfg.Profiles { |
| 48 | + if !p.DigestPinned() { |
| 49 | + slog.Warn("profile image is not pinned to a digest; whoever controls the registry can repoint the tag", |
| 50 | + slog.String("profile", name), slog.String("image", p.Image)) |
| 51 | + } |
| 52 | + if p.RegistryAuth != nil && auth == nil { |
| 53 | + auth = p.RegistryAuth |
| 54 | + } |
| 55 | + } |
| 56 | + if auth != nil { |
| 57 | + opts = append(opts, docker.WithRegistryAuth(auth.Username, auth.Password)) |
| 58 | + } |
| 59 | + |
| 60 | + backend, err := docker.New(opts...) |
| 61 | + if err != nil { |
| 62 | + return err |
| 63 | + } |
| 64 | + defer func() { _ = backend.Close() }() |
| 65 | + |
| 66 | + ln, err := daemon.Listen(cfg.Socket, cfg.SocketGroup) |
| 67 | + if err != nil { |
| 68 | + return err |
| 69 | + } |
| 70 | + |
| 71 | + srv := daemon.New(backend, cfg) |
| 72 | + ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM) |
| 73 | + defer stop() |
| 74 | + go srv.RunReaper(ctx) |
| 75 | + |
| 76 | + // No read or write timeout: exec can legitimately run for minutes and a |
| 77 | + // dialled preview stream is open for as long as the page is. The library's |
| 78 | + // own command timeouts are the bound that applies here. |
| 79 | + // |
| 80 | + // ReadHeaderTimeout is different: it only bounds the time to read the |
| 81 | + // request line and headers, which completes before Hijack (dial.go) or |
| 82 | + // the handler body (exec.go) ever runs — so it can't truncate a long exec |
| 83 | + // or a long-lived dialled stream. It closes a real Slowloris hole (a peer |
| 84 | + // that trickles headers forever) on the socket that holds the Docker |
| 85 | + // connection, even though that peer is local. |
| 86 | + httpSrv := &http.Server{Handler: srv.Handler(), ReadHeaderTimeout: 10 * time.Second} |
| 87 | + |
| 88 | + slog.Info("openbloxd listening", slog.String("socket", cfg.Socket), slog.Int("profiles", len(cfg.Profiles))) |
| 89 | + return serve(ctx, httpSrv, ln) |
| 90 | +} |
| 91 | + |
| 92 | +// serve runs httpSrv on ln until ctx is cancelled or Serve fails on its own. |
| 93 | +// |
| 94 | +// A Serve failure with no signal must return promptly rather than wait on |
| 95 | +// ctx.Done(), which may never fire: Restart=on-failure in the unit only |
| 96 | +// triggers if the process actually exits, and a process that hangs after |
| 97 | +// Serve dies looks "active (running)" to systemd while accepting nothing. |
| 98 | +func serve(ctx context.Context, httpSrv *http.Server, ln net.Listener) error { |
| 99 | + serveErr := make(chan error, 1) |
| 100 | + go func() { serveErr <- httpSrv.Serve(ln) }() |
| 101 | + |
| 102 | + select { |
| 103 | + case err := <-serveErr: |
| 104 | + if err != nil && !errors.Is(err, http.ErrServerClosed) { |
| 105 | + return fmt.Errorf("serve: %w", err) |
| 106 | + } |
| 107 | + return nil |
| 108 | + case <-ctx.Done(): |
| 109 | + } |
| 110 | + |
| 111 | + // Shutdown closes the listener the instant it's called, before it starts |
| 112 | + // waiting on in-flight connections — so it must run synchronously here and |
| 113 | + // block until it (or its 10s budget) is done. Do this on a goroutine |
| 114 | + // instead and the caller returns the moment Serve unblocks, killing that |
| 115 | + // goroutine mid-wait and turning the grace period into dead code. |
| 116 | + // |
| 117 | + // This still can't wait out a hijacked preview stream: once a connection is |
| 118 | + // hijacked it's invisible to Shutdown's in-flight accounting, so the 10s |
| 119 | + // budget — not a graceful drain — is what bounds it. |
| 120 | + shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second) |
| 121 | + defer cancel() |
| 122 | + if err := httpSrv.Shutdown(shutdownCtx); err != nil { |
| 123 | + slog.Warn("openbloxd: graceful shutdown did not complete in time", slog.Any("error", err)) |
| 124 | + } |
| 125 | + |
| 126 | + if err := <-serveErr; err != nil && !errors.Is(err, http.ErrServerClosed) { |
| 127 | + return fmt.Errorf("serve: %w", err) |
| 128 | + } |
| 129 | + return nil |
| 130 | +} |
0 commit comments