jochen
12de28c81d
On 2026-10-09 the control node's route-proxy failed every lookup against 10.10.0.1 alone for twenty minutes while the machine's file listed both mesh resolvers; its copy lives under the runtime's root-only directory and no tool read it. docker_resolv_conf reads /etc/resolv.conf as the container sees it through the runtime's archive (docker cp, no exec), parses it, and says whether it lists the same resolvers as the machine.
125 lines
3.4 KiB
JSON
125 lines
3.4 KiB
JSON
{
|
|
"module": "docker",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"package-manager",
|
|
"service-manager",
|
|
"privileged"
|
|
],
|
|
"invokes": [
|
|
"seat:mesh-controller.images"
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "node-container-runtime",
|
|
"scope": "node"
|
|
}
|
|
],
|
|
"tools": [
|
|
"docker_list",
|
|
"docker_inspect",
|
|
"docker_resolv_conf",
|
|
"docker_logs",
|
|
"docker_secrets_in_logs",
|
|
"docker_secrets_in_events",
|
|
"docker_stats",
|
|
"docker_start",
|
|
"docker_stop",
|
|
"docker_restart",
|
|
"docker_top",
|
|
"docker_images",
|
|
"docker_prune",
|
|
"docker_prune_images",
|
|
"docker_disk_usage",
|
|
"docker_networks",
|
|
"docker_volumes",
|
|
"docker_events",
|
|
"docker_daemon_config",
|
|
"docker_unlabelled",
|
|
"docker_problems",
|
|
"docker_ports"
|
|
],
|
|
"replaces": {
|
|
"docker_resolv_conf": [
|
|
"docker exec cat /etc/resolv.conf"
|
|
]
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "package",
|
|
"type": "package",
|
|
"package": "docker"
|
|
},
|
|
{
|
|
"id": "buildx",
|
|
"type": "package",
|
|
"package": "docker-buildx"
|
|
},
|
|
{
|
|
"id": "socket",
|
|
"type": "service",
|
|
"unit": "docker.socket",
|
|
"state": "running",
|
|
"boot": "enabled"
|
|
},
|
|
{
|
|
"id": "daemon",
|
|
"type": "file",
|
|
"path": "/etc/docker/daemon.json",
|
|
"mode": "0644",
|
|
"into": "json",
|
|
"content": "{\"live-restore\": true, \"insecure-registries\": [\"${seat:mesh-artifact-store:reach}\"]}\n"
|
|
},
|
|
{
|
|
"id": "runtime",
|
|
"type": "service",
|
|
"unit": "docker.service",
|
|
"state": "running",
|
|
"boot": "enabled",
|
|
"reload-on": [
|
|
"daemon"
|
|
]
|
|
},
|
|
{
|
|
"id": "prune-service",
|
|
"type": "file",
|
|
"path": "/etc/systemd/system/docker-prune.service",
|
|
"mode": "0644",
|
|
"content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Prune dangling images and unused build cache (the mesh's docker module)\n# Never volumes, never a container, never an image a container uses: dangling\n# images and build cache nothing refers to, unused for a week. What a person\n# prunes beyond that is docker_prune's, by hand.\nAfter=docker.service\nConditionPathExists=/run/docker.sock\n\n[Service]\nType=oneshot\nNice=19\nIOSchedulingClass=idle\nExecStart=/usr/bin/docker image prune --force --filter until=168h\nExecStart=/usr/bin/docker builder prune --force --filter until=168h\n"
|
|
},
|
|
{
|
|
"id": "prune-timer",
|
|
"type": "file",
|
|
"path": "/etc/systemd/system/docker-prune.timer",
|
|
"mode": "0644",
|
|
"content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Weekly prune of dangling images and unused build cache (the mesh's docker module)\n\n[Timer]\nOnCalendar=weekly\nRandomizedDelaySec=1h\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n"
|
|
},
|
|
{
|
|
"id": "prune",
|
|
"type": "service",
|
|
"unit": "docker-prune.timer",
|
|
"state": "running",
|
|
"boot": "enabled",
|
|
"restart-on": [
|
|
"prune-service",
|
|
"prune-timer"
|
|
]
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/docker-tools",
|
|
"binary": "docker-tools",
|
|
"loads": [
|
|
"docker-tools"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|