alexei.dolgolyov
1c47030854
Restore a captured volume snapshot onto an image workload's live host-bind
data volumes, then redeploy — the most destructive workload action, built to
the adversarially-reviewed design (C1–C6) with all data-loss guards.
- Engine.Restore (engine-owned): all-or-nothing pre-flight re-resolution from
the workload's CURRENT config (never the tamperable manifest), per-filesystem
disk pre-check, per-workload lock, container quiesce, extract-to-tmp, durable
pre-restore snapshot, write-ahead journal, atomic rename swap, redeploy, and
crash-recovery sweep (RecoverInterruptedRestores) wired before serving.
- internal/keyedmutex: shared per-key lock; deployer now serializes every
deploy entrypoint per workload via DispatchPlugin (+ LockWorkload/RedeployLocked
for the restore re-dispatch, no deadlock).
- Untrusted-archive extractor: zip-slip containment, type allow-list (reg/dir
only), decompression-bomb cap, manifest-index bounds.
- POST /api/workloads/{id}/snapshots/{sid}/restore: admin, X-Confirm-Restore
header (CSRF), per-workload single-flight (409).
- WebUI: Restore button + danger ConfirmDialog + busy state + i18n (en/ru).
Scope: image-source only; scopes absolute/stage/project (driven off the same
supportedScopes constant capture uses).
Plan-reviewed before coding; per-phase go/security/ts reviews; final review
READY TO MERGE. Security review caught + fixed a CRITICAL manifest-Source path
traversal (re-derive target from current config + base containment).
Plan: plans/volume-snapshot-restore/
54 lines
2.0 KiB
Modula-2
54 lines
2.0 KiB
Modula-2
module github.com/alexei/tinyforge
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/coreos/go-oidc/v3 v3.11.0
|
|
github.com/go-chi/chi/v5 v5.2.1
|
|
github.com/golang-jwt/jwt/v5 v5.2.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/moby/moby/api v1.54.0
|
|
github.com/moby/moby/client v0.3.0
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/yuin/goldmark v1.8.2
|
|
golang.org/x/crypto v0.28.0
|
|
golang.org/x/oauth2 v0.25.0
|
|
golang.org/x/sync v0.20.0
|
|
golang.org/x/sys v0.33.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
modernc.org/sqlite v1.34.5
|
|
)
|
|
|
|
require (
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/containerd/errdefs v1.0.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/go-connections v0.6.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.0.2 // indirect
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/ncruces/go-strftime v0.1.9 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
|
|
go.opentelemetry.io/otel v1.35.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.35.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.35.0 // indirect
|
|
golang.org/x/mod v0.18.0 // indirect
|
|
golang.org/x/tools v0.22.0 // indirect
|
|
modernc.org/libc v1.55.3 // indirect
|
|
modernc.org/mathutil v1.6.0 // indirect
|
|
modernc.org/memory v1.8.0 // indirect
|
|
)
|
|
|
|
// Prevent the +incompatible monorepo from being pulled (conflicts with moby/moby/client submodule).
|
|
replace github.com/moby/moby => github.com/moby/moby/client v0.3.0
|