jschoubben
f5b03e1474
novox/hq 04-ISSUES/026. Four modules mounted fourteen host paths that no resource declared — the mail spool, the databases, the object store's data. Each would be created by the container runtime as root, with a mode nobody chose, so `owner` and `mode` went unapplied on exactly the directories that matter. The worse half: a directory the mesh declared and no longer wants is kept rather than removed when it holds anything the mesh did not put there. That rule is the answer to what happens to data when a module goes away, and it is written in terms of declared directories. An undeclared one is not covered. So the one rule guarding against data loss reached the configuration directories, which are cheap to lose, and missed the data directories, which are why the rule exists. The cause is worth naming. These manifests were written by reading the arrangement being replaced and carrying its compose files across — service, image, ports, volumes, environment. The container shape can express all of that, which is what made the transliteration feel like progress. A shape that can express a compose file gets filled in like one, and a volume line borrowed from compose declares no owner, no mode and no intent. Declared parent-first, because the host applies in the order written and does not sort. The check is mechanical now, because a person comparing volumes against directories by hand is the process that produced this. Still open, and bigger: whether these paths are where a module's data should live at all. They were inherited whole, and they decide what a person backs up.
116 lines
2.5 KiB
JSON
116 lines
2.5 KiB
JSON
{
|
|
"module": "minio",
|
|
"version": "1",
|
|
"provides": [
|
|
{
|
|
"name": "s3-bucket",
|
|
"scope": "mesh"
|
|
}
|
|
],
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"listens": [
|
|
{
|
|
"port": 9000,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "the S3 endpoint"
|
|
}
|
|
],
|
|
"serves": {
|
|
"s3-bucket": {
|
|
"port": 9000,
|
|
"scheme": "http",
|
|
"region": "us-east-1"
|
|
}
|
|
},
|
|
"receives": {
|
|
"s3-bucket": "/var/lib/minio/grants/mesh.json"
|
|
},
|
|
"grants": {
|
|
"s3-bucket": "/var/lib/minio/grants"
|
|
},
|
|
"own-secrets": {
|
|
"root": "/var/lib/minio/root.secret"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"path": "/var/lib/minio",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "directory",
|
|
"path": "/var/lib/minio/grants",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "root-env",
|
|
"type": "file",
|
|
"path": "/var/lib/minio/root.env",
|
|
"mode": "0600",
|
|
"content": "MINIO_ROOT_USER=meshroot\nMINIO_ROOT_PASSWORD=${secret:root}\n"
|
|
},
|
|
{
|
|
"id": "data",
|
|
"type": "directory",
|
|
"path": "/services/minio/data/data1-1",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "net",
|
|
"type": "network",
|
|
"name": "minio"
|
|
},
|
|
{
|
|
"id": "server",
|
|
"type": "container",
|
|
"name": "minio",
|
|
"image": "minio/minio@sha256:aefec8a86702aff0b0dcfdd9284bd7ab7c5631cbf9be63275799e6edcb30dfa2",
|
|
"network": "minio",
|
|
"args": [
|
|
"server",
|
|
"/data",
|
|
"--console-address",
|
|
":9001"
|
|
],
|
|
"env-file": [
|
|
"/var/lib/minio/root.env"
|
|
],
|
|
"ports": [
|
|
"9000:9000"
|
|
],
|
|
"volumes": [
|
|
"/services/minio/data/data1-1:/data"
|
|
],
|
|
"restart-on": [
|
|
"root-env"
|
|
]
|
|
},
|
|
{
|
|
"id": "provisioner",
|
|
"type": "container",
|
|
"name": "mesh-provision-objectstore",
|
|
"image": "mesh-provision-objectstore@sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"network": "minio",
|
|
"env": {
|
|
"GRANTS": "/var/lib/minio/grants",
|
|
"MESH_OBJECTSTORE_URL": "http://minio:9000",
|
|
"MESH_OBJECTSTORE_ROOT_USER": "meshroot",
|
|
"MESH_OBJECTSTORE_ROOT_PASSWORD_FILE": "/run/secrets/root"
|
|
},
|
|
"volumes": [
|
|
"/var/lib/minio/grants:/var/lib/minio/grants:ro",
|
|
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
|
],
|
|
"restart-on": [
|
|
"grants",
|
|
"root-env"
|
|
]
|
|
}
|
|
]
|
|
}
|