Orchestrateur go pour lancer la démo et mettre en place plusieurs instances docker
This commit is contained in:
247
demo/orchestrator/docker.go
Normal file
247
demo/orchestrator/docker.go
Normal file
@@ -0,0 +1,247 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"github.com/docker/docker/api/types"
|
||||
"github.com/docker/docker/api/types/container"
|
||||
"github.com/docker/docker/api/types/filters"
|
||||
"github.com/docker/docker/api/types/network"
|
||||
"github.com/docker/docker/client"
|
||||
)
|
||||
|
||||
// DockerClient encapsule les operations Docker necessaires a la demo.
|
||||
type DockerClient struct {
|
||||
cli *client.Client
|
||||
}
|
||||
|
||||
func newDockerClient() (*DockerClient, error) {
|
||||
cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("docker client: %w", err)
|
||||
}
|
||||
return &DockerClient{cli: cli}, nil
|
||||
}
|
||||
|
||||
// SpawnTrio cree les 3 conteneurs d'une session (postgres, brain, core) et
|
||||
// les branche sur le reseau interne. Ils partagent un label "demo-session=<id>"
|
||||
// pour faciliter le nettoyage.
|
||||
func (d *DockerClient) SpawnTrio(ctx context.Context, sessionID string, cfg *Config) error {
|
||||
pgName := "demo-" + sessionID + "-postgres"
|
||||
brainName := "demo-" + sessionID + "-brain"
|
||||
coreName := "demo-" + sessionID + "-core"
|
||||
pgPassword := randomHex(16)
|
||||
brainSecret := randomHex(32)
|
||||
adminPassword := randomHex(16)
|
||||
|
||||
labels := map[string]string{
|
||||
"demo-session": sessionID,
|
||||
"demo-role": "", // rempli par conteneur
|
||||
}
|
||||
|
||||
// --- Postgres (tmpfs => ephemere) ---
|
||||
pgLabels := copyLabels(labels, "postgres")
|
||||
if err := d.runContainer(ctx, runSpec{
|
||||
Name: pgName,
|
||||
Image: "postgres:16-alpine",
|
||||
Env: []string{"POSTGRES_DB=loremind", "POSTGRES_USER=loremind", "POSTGRES_PASSWORD=" + pgPassword},
|
||||
Labels: pgLabels,
|
||||
Memory: cfg.PostgresMemoryBytes,
|
||||
Tmpfs: map[string]string{"/var/lib/postgresql/data": "rw,size=200m"},
|
||||
Net: cfg.SessionsNetwork,
|
||||
Alias: pgName,
|
||||
}); err != nil {
|
||||
return fmt.Errorf("spawn postgres: %w", err)
|
||||
}
|
||||
|
||||
// --- Brain ---
|
||||
brainLabels := copyLabels(labels, "brain")
|
||||
if err := d.runContainer(ctx, runSpec{
|
||||
Name: brainName,
|
||||
Image: cfg.Registry + "/ietm64/brain:" + cfg.Tag,
|
||||
Env: []string{
|
||||
"INTERNAL_SHARED_SECRET=" + brainSecret,
|
||||
// Pas de provider LLM configure en demo : les features IA repondront
|
||||
// en erreur, la demo sert principalement a explorer l'edition.
|
||||
"LLM_PROVIDER=ollama",
|
||||
"OLLAMA_BASE_URL=http://localhost:1", // endpoint mort volontairement
|
||||
},
|
||||
Labels: brainLabels,
|
||||
Memory: cfg.BrainMemoryBytes,
|
||||
Net: cfg.SessionsNetwork,
|
||||
Alias: brainName,
|
||||
}); err != nil {
|
||||
return fmt.Errorf("spawn brain: %w", err)
|
||||
}
|
||||
|
||||
// --- Core ---
|
||||
coreLabels := copyLabels(labels, "core")
|
||||
if err := d.runContainer(ctx, runSpec{
|
||||
Name: coreName,
|
||||
Image: cfg.Registry + "/ietm64/core:" + cfg.Tag,
|
||||
Env: []string{
|
||||
"SPRING_DATASOURCE_URL=jdbc:postgresql://" + pgName + ":5432/loremind",
|
||||
"SPRING_DATASOURCE_USERNAME=loremind",
|
||||
"SPRING_DATASOURCE_PASSWORD=" + pgPassword,
|
||||
"BRAIN_BASE_URL=http://" + brainName + ":8000",
|
||||
"BRAIN_INTERNAL_SECRET=" + brainSecret,
|
||||
"ADMIN_USERNAME=admin",
|
||||
"ADMIN_PASSWORD=" + adminPassword,
|
||||
"DEMO_MODE=true",
|
||||
"CORS_ALLOWED_ORIGINS=*",
|
||||
// MinIO volontairement non fourni : le client init en lazy, seul
|
||||
// l'upload d'images echouera (500). A masquer plus tard si besoin.
|
||||
},
|
||||
Labels: coreLabels,
|
||||
Memory: cfg.CoreMemoryBytes,
|
||||
Net: cfg.SessionsNetwork,
|
||||
Alias: coreName,
|
||||
}); err != nil {
|
||||
return fmt.Errorf("spawn core: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// runSpec regroupe les parametres d'un container pour runContainer.
|
||||
type runSpec struct {
|
||||
Name string
|
||||
Image string
|
||||
Env []string
|
||||
Labels map[string]string
|
||||
Memory int64
|
||||
Tmpfs map[string]string
|
||||
Net string
|
||||
Alias string
|
||||
}
|
||||
|
||||
// runContainer pull l'image si absente puis cree et demarre le conteneur.
|
||||
func (d *DockerClient) runContainer(ctx context.Context, s runSpec) error {
|
||||
// Pull silencieux si image absente localement. Ignore les erreurs (l'image
|
||||
// peut exister localement sans etre atteignable au registre, ex: builds dev).
|
||||
if reader, err := d.cli.ImagePull(ctx, s.Image, types.ImagePullOptions{}); err == nil {
|
||||
// Drain le body, sinon le pull n'est pas termine quand on continue.
|
||||
_, _ = io.Copy(io.Discard, reader)
|
||||
reader.Close()
|
||||
}
|
||||
|
||||
pidsLimit := int64(200)
|
||||
hostCfg := &container.HostConfig{
|
||||
RestartPolicy: container.RestartPolicy{Name: "no"},
|
||||
Resources: container.Resources{
|
||||
Memory: s.Memory,
|
||||
NanoCPUs: 1_000_000_000, // 1 vCPU par conteneur
|
||||
PidsLimit: &pidsLimit, // Anti fork-bomb : max 200 threads/processus.
|
||||
},
|
||||
Tmpfs: s.Tmpfs,
|
||||
// no-new-privileges : interdit a un processus du conteneur de gagner
|
||||
// plus de privileges que son parent (bloque les exploits setuid courants).
|
||||
SecurityOpt: []string{"no-new-privileges:true"},
|
||||
// CapDrop/CapAdd volontairement non configures : les images core (JVM
|
||||
// Spring Boot) et brain (Python) n'ont pas ete auditees pour un
|
||||
// fonctionnement avec capabilities restreintes ; un drop trop agressif
|
||||
// peut casser le demarrage de maniere non triviale. A revoir si besoin.
|
||||
}
|
||||
|
||||
netCfg := &network.NetworkingConfig{
|
||||
EndpointsConfig: map[string]*network.EndpointSettings{
|
||||
s.Net: {Aliases: []string{s.Alias}},
|
||||
},
|
||||
}
|
||||
|
||||
resp, err := d.cli.ContainerCreate(ctx, &container.Config{
|
||||
Image: s.Image,
|
||||
Env: s.Env,
|
||||
Labels: s.Labels,
|
||||
}, hostCfg, netCfg, nil, s.Name)
|
||||
if err != nil {
|
||||
return fmt.Errorf("create %s: %w", s.Name, err)
|
||||
}
|
||||
if err := d.cli.ContainerStart(ctx, resp.ID, container.StartOptions{}); err != nil {
|
||||
return fmt.Errorf("start %s: %w", s.Name, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// WaitReady poll l'endpoint /api/config du core pendant timeout, retourne true
|
||||
// des qu'il repond 200. Utilise par le manager pour passer en Status=ready.
|
||||
func (d *DockerClient) WaitReady(ctx context.Context, sessionID string, timeout time.Duration) bool {
|
||||
deadline := time.Now().Add(timeout)
|
||||
url := "http://demo-" + sessionID + "-core:8080/api/config"
|
||||
httpClient := &http.Client{Timeout: 2 * time.Second}
|
||||
for time.Now().Before(deadline) {
|
||||
resp, err := httpClient.Get(url)
|
||||
if err == nil {
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode == 200 {
|
||||
return true
|
||||
}
|
||||
}
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return false
|
||||
case <-time.After(2 * time.Second):
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// KillTrio arrete et supprime tous les conteneurs avec le label demo-session=<id>.
|
||||
func (d *DockerClient) KillTrio(ctx context.Context, sessionID string) error {
|
||||
f := filters.NewArgs()
|
||||
f.Add("label", "demo-session="+sessionID)
|
||||
list, err := d.cli.ContainerList(ctx, container.ListOptions{All: true, Filters: f})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, c := range list {
|
||||
_ = d.cli.ContainerRemove(ctx, c.ID, container.RemoveOptions{Force: true})
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ListSessionIDs retourne les IDs de session detectes dans les labels Docker.
|
||||
// Utile au demarrage pour nettoyer les orphelins (conteneurs d'une vie
|
||||
// anterieure de l'orchestrateur).
|
||||
func (d *DockerClient) ListSessionIDs(ctx context.Context) ([]string, error) {
|
||||
f := filters.NewArgs()
|
||||
f.Add("label", "demo-session")
|
||||
list, err := d.cli.ContainerList(ctx, container.ListOptions{All: true, Filters: f})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
seen := make(map[string]bool)
|
||||
for _, c := range list {
|
||||
if v, ok := c.Labels["demo-session"]; ok && v != "" {
|
||||
seen[v] = true
|
||||
}
|
||||
}
|
||||
out := make([]string, 0, len(seen))
|
||||
for id := range seen {
|
||||
out = append(out, id)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// --- helpers ---
|
||||
|
||||
func copyLabels(base map[string]string, role string) map[string]string {
|
||||
out := make(map[string]string, len(base))
|
||||
for k, v := range base {
|
||||
out[k] = v
|
||||
}
|
||||
out["demo-role"] = role
|
||||
return out
|
||||
}
|
||||
|
||||
func randomHex(n int) string {
|
||||
b := make([]byte, n)
|
||||
_, _ = rand.Read(b)
|
||||
return hex.EncodeToString(b)
|
||||
}
|
||||
Reference in New Issue
Block a user