Documentation
¶
Overview ¶
Package dockerapi reads container state from a local Docker Engine.
This is the one place swinv talks to a daemon, and it is here because on Windows there is no alternative. Docker Desktop runs Linux containers inside a WSL2 virtual machine: their processes are not Windows processes, they have no entry in the Windows process table, and their listening sockets live in network namespaces inside that VM. No Windows API reaches them. What Windows *can* see is Docker's proxy holding the published port — which is exactly the "docker-ce owns port 3000" non-answer the Linux collector exists to avoid, and on Windows it cannot be followed any other way.
It remains true that swinv performs no network activity: this is a local named pipe (Windows) or Unix socket (Linux), kernel IPC with no address and no route. Nothing here reaches a registry or any other host.
Everything is best-effort. A machine with no Docker, a daemon that is not running, or a user outside the docker group produces no containers and no error — the inventory is not worth failing over a section that could not be collected, and the caller records a blind spot instead.
Index ¶
- type Client
- func (c *Client) Containers(ctx context.Context, all bool) ([]Container, error)
- func (c *Client) Endpoint() string
- func (c *Client) Inspect(ctx context.Context, id string) (Container, error)
- func (c *Client) ReadDir(ctx context.Context, id, dirPath string) (map[string][]byte, error)
- func (c *Client) ReadFile(ctx context.Context, id, filePath string) ([]byte, error)
- func (c *Client) Source(ctx context.Context, id string) *ContainerSource
- type Container
- type ContainerSource
- type PortMapping
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client talks to a local Docker Engine.
func (*Client) Containers ¶
Containers lists containers. all includes those that are not running.
A stopped container serves nothing, so it contributes no exposure. It is still software present on the machine, which is a different claim and the caller's to make.
func (*Client) Inspect ¶
Inspect fills in the details the list endpoint omits: the manifest digest, and what the container was told to run.
func (*Client) ReadDir ¶ added in v0.5.0
ReadDir returns the regular files directly inside a directory, keyed by name. Used for dpkg's per-package file lists, which is a directory of several hundred small files and one request rather than several hundred.
func (*Client) ReadFile ¶ added in v0.5.0
ReadFile returns one file from a container's filesystem.
This works whether or not the container is running, which is the reason it exists: /proc/<pid>/root needs a live process, and on Windows there is no /proc at all. It is the only way to see inside a stopped container, and the only way to see inside any container from Windows.
Symlinks are followed, because the interesting paths are often links -- /etc/os-release points at ../usr/lib/os-release on Debian, and a reader that stopped at the link would report a container with no operating system.
type Container ¶
type Container struct {
ID string
Name string
Image string
ImageID string
// Digest is the registry manifest digest where the daemon knows one. A
// locally built image that was never pushed has none.
Digest string
// State is the runtime's own word: "running", "exited", "created".
// A stopped container serves nothing, and its declared ports are a
// statement of intent rather than an observation.
State string
// Ports are the published mappings, straight from the daemon. This is the
// whole reason to ask: it says which host port reaches which container
// port, exactly, with no argv to parse and no address to guess.
Ports []PortMapping
// Entrypoint and Command are what the container was told to run, which is
// the only description of the workload available without entering it.
Entrypoint []string
Command []string
// Exposed are the ports the image declares with EXPOSE, whether or not
// anything is listening on them. For a stopped container this is the only
// network fact available, and it is a declaration rather than an
// observation -- which is why it is kept apart from Ports, and why a
// consumer must not read it as an open port.
Exposed []PortMapping
Labels map[string]string
}
Container is what the daemon says about one container.
type ContainerSource ¶ added in v0.5.0
type ContainerSource struct {
// contains filtered or unexported fields
}
ContainerSource reads a container's filesystem through the runtime.
It satisfies ctrpkg.Source without importing it, so the dependency runs one way: the package that knows about containers knows nothing about package databases.
func (*ContainerSource) IsSymlink ¶ added in v0.5.0
func (s *ContainerSource) IsSymlink(p string) bool
IsSymlink reports whether a top-level directory is a symlink.
Asked by requesting the path itself: the runtime returns the link rather than what it points at, so a symlink shows up as a member with a link target and a real directory does not.
Source Files