The agent as a container image (M1.5)
- Dockerfile: built with uv into /opt/nisse (installed, not editable), run on python:3.12-slim with openssh-client as user nisse; stateless, with state in a /var/lib/nisse-dev volume, config mounted at /etc/nisse-dev/nisse-dev.yaml, secrets as environment variables, keys mounted read-only. 202 MB. Its `test` stage adds the tests and their tools over the installed package (UV_NO_SYNC, so `uv run` never swaps in the source tree); the default target is the agent. - scripts/e2e.sh --image REF runs the suite inside an image's test stage, on its own sshd. - CI builds both images on every PR (nothing pushed); release.yml pushes gitea.dongar.net/dongar/nisse-dev:<tag> and :latest on a v* tag, with the REGISTRY_TOKEN secret. - scripts/bringup.sh builds the code under test into an image and runs it in the systemd unit (root, $E2E mounted at its own path); `plan` prints what it would run; the build-VM set-aside reads the projects: config. Checked: the image refuses to start without a config, runs as uid 10001; one e2e test passed from the test stage (2m45s, $0). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE
This commit is contained in:
dongarandClaude Opus 5.5 committed
1 parent
2d6aa98f87
commit
0660fa3c51
7 files changed
+205
-26
No files matched your search
+57
-25
@@ -1,13 +1,19 @@
|
||||
#!/usr/bin/env bash
|
||||
# Bring-up runs of nisse-dev on this development VM (Development Plan M0.2).
|
||||
#
|
||||
# The agent runs as root, as it will on its own VM in production (D7): it may
|
||||
# install what it needs. It touches only test resources (the sandbox repo, the
|
||||
# test Matrix room, a budget-capped LiteLLM key), from the run's config. It
|
||||
# runs as a transient systemd unit, so it outlives the shell that started it.
|
||||
# The agent runs as its container image (M1.5), built from the code under
|
||||
# test, as a transient systemd unit, so it outlives the shell that started
|
||||
# it. It touches only test resources (an operator-made test repository, the
|
||||
# test Matrix room, a budget-capped LiteLLM key), from the run's config.
|
||||
#
|
||||
# scripts/bringup.sh start [REF] set the last run aside, export REF (default
|
||||
# HEAD) and start the agent
|
||||
# $E2E is mounted at the same path inside the container, so the config's
|
||||
# paths (state_db, keys) mean the same there; for that it runs as root here,
|
||||
# since the keys are root's. In production the image runs as its own user
|
||||
# with a state volume (Dockerfile).
|
||||
#
|
||||
# scripts/bringup.sh start [REF] set the last run aside, build REF (default
|
||||
# HEAD) into an image and start the agent
|
||||
# scripts/bringup.sh plan [REF] print what start would build and run
|
||||
# scripts/bringup.sh stop stop it cleanly (SIGTERM)
|
||||
# scripts/bringup.sh status the unit, and the agent's state
|
||||
# scripts/bringup.sh logs follow the agent's log
|
||||
@@ -16,7 +22,7 @@
|
||||
#
|
||||
# Layout, under $E2E (default /root/nisse-e2e):
|
||||
# nisse-dev.yaml, .env the run config and its secrets (made by hand once)
|
||||
# code/ the exported code under test, with its own .venv
|
||||
# code/ the exported code under test, built into the image
|
||||
# state.db the agent's state (its workspace is on the build VM)
|
||||
# ssh/ the agent's key for the build VM, and push keys
|
||||
# run-info, collected/ what was run, and the output of `collect`
|
||||
@@ -27,11 +33,28 @@ E2E=${NISSE_E2E:-/root/nisse-e2e}
|
||||
SRC=${NISSE_SRC:-/root/nisse} # repository to export code from
|
||||
CODE=$E2E/code
|
||||
UNIT=nisse-bringup
|
||||
UV=${UV:-$(command -v uv || echo /snap/bin/uv)}
|
||||
IMAGE=nisse-dev:bringup
|
||||
|
||||
die() { echo "bringup: $*" >&2; exit 1; }
|
||||
running() { systemctl is-active --quiet "$UNIT"; }
|
||||
|
||||
# The container the unit runs: host networking (Matrix, Gitea, LiteLLM as
|
||||
# here), $E2E at its own path, the config and secrets from it.
|
||||
docker_run() {
|
||||
echo docker run --rm --name "$UNIT" --network host --user 0 \
|
||||
-v "$E2E:$E2E" \
|
||||
-e NISSE_CONFIG="$E2E/nisse-dev.yaml" -e NISSE_ENV="$E2E/.env" \
|
||||
"$IMAGE"
|
||||
}
|
||||
|
||||
cmd_plan() {
|
||||
local ref=${1:-HEAD} sha
|
||||
sha=$(git -C "$SRC" rev-parse --verify "$ref^{commit}") || die "unknown ref $ref"
|
||||
echo "git -C $SRC archive $sha | tar -x -C $CODE"
|
||||
echo "docker build -t $IMAGE $CODE"
|
||||
echo "systemd-run --unit=$UNIT ... $(docker_run)"
|
||||
}
|
||||
|
||||
cmd_start() {
|
||||
local ref=${1:-HEAD} sha
|
||||
[ -f "$E2E/nisse-dev.yaml" ] && [ -f "$E2E/.env" ] || die "no config in $E2E"
|
||||
@@ -58,16 +81,16 @@ cmd_start() {
|
||||
rm -rf "$CODE"
|
||||
mkdir -p "$CODE"
|
||||
git -C "$SRC" archive "$sha" | tar -x -C "$CODE"
|
||||
(cd "$CODE" && "$UV" sync --quiet --all-packages)
|
||||
docker build --quiet -t "$IMAGE" "$CODE" > /dev/null
|
||||
printf 'ref: %s\ncommit: %s\nstarted: %s\n' "$ref" "$sha" "$(date -Is)" > "$E2E/run-info"
|
||||
|
||||
systemctl reset-failed "$UNIT" 2>/dev/null || true
|
||||
# SIGTERM reaches the agent through docker run's signal proxy; it shuts
|
||||
# down cleanly (main.py).
|
||||
# shellcheck disable=SC2046
|
||||
systemd-run --quiet --unit="$UNIT" --collect \
|
||||
--property=WorkingDirectory="$CODE" \
|
||||
--property=KillSignal=SIGTERM --property=TimeoutStopSec=120 \
|
||||
--setenv=NISSE_CONFIG="$E2E/nisse-dev.yaml" \
|
||||
--setenv=NISSE_ENV="$E2E/.env" \
|
||||
"$CODE/.venv/bin/nisse-dev"
|
||||
$(docker_run)
|
||||
echo "started $UNIT at ${sha:0:8} ($ref)"
|
||||
}
|
||||
|
||||
@@ -78,15 +101,17 @@ remote_aside() {
|
||||
where=$(python3 - "$E2E/nisse-dev.yaml" <<'PY'
|
||||
import sys, yaml
|
||||
c = yaml.safe_load(open(sys.argv[1]))
|
||||
b = c["build_host"]
|
||||
print(b.get("user", "root"), b["address"], b.get("port", 22), b["key"], c["workspace"])
|
||||
for p in c["projects"].values(): # each project's workspace, on its build VM (D8)
|
||||
b = p["build_host"]
|
||||
print(b.get("user", "root"), b["address"], b.get("port", 22), b["key"], p["workspace"])
|
||||
PY
|
||||
) || die "cannot read build_host and workspace from the config"
|
||||
read -r user address port key workspace <<< "$where"
|
||||
ssh -i "$key" -p "$port" -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
|
||||
-o UserKnownHostsFile="$E2E/ssh/known_hosts" "$user@$address" \
|
||||
"if [ -e '$workspace' ]; then mv '$workspace' '$workspace.$stamp' && echo 'build VM: set aside $workspace.$stamp'; fi" \
|
||||
|| die "cannot reach the build VM $address"
|
||||
) || die "cannot read the projects' build VMs and workspaces from the config"
|
||||
while read -r user address port key workspace; do
|
||||
ssh -n -i "$key" -p "$port" -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
|
||||
-o UserKnownHostsFile="$E2E/ssh/known_hosts" "$user@$address" \
|
||||
"if [ -e '$workspace' ]; then mv '$workspace' '$workspace.$stamp' && echo 'build VM: set aside $workspace.$stamp'; fi" \
|
||||
|| die "cannot reach the build VM $address"
|
||||
done <<< "$where"
|
||||
}
|
||||
|
||||
cmd_stop() {
|
||||
@@ -98,28 +123,35 @@ cmd_stop() {
|
||||
cmd_status() {
|
||||
if running; then echo "unit: running"; else echo "unit: not running"; fi
|
||||
[ -f "$E2E/run-info" ] && sed 's/^/ /' "$E2E/run-info"
|
||||
if [ -f "$E2E/state.db" ] && [ -x "$CODE/.venv/bin/python" ]; then
|
||||
"$CODE/.venv/bin/python" -m nisse_dev.dump "$E2E/state.db" | head -n 3
|
||||
if [ -f "$E2E/state.db" ]; then
|
||||
dump "$E2E/state.db" | head -n 3
|
||||
fi
|
||||
}
|
||||
|
||||
cmd_logs() { journalctl -u "$UNIT" -f -o cat; }
|
||||
|
||||
# The state store, read with the image's own code.
|
||||
dump() {
|
||||
docker run --rm --user 0 -v "$E2E:$E2E" --entrypoint python "$IMAGE" \
|
||||
-m nisse_dev.dump "$@"
|
||||
}
|
||||
|
||||
cmd_collect() {
|
||||
[ -f "$E2E/run-info" ] || die "no run to collect"
|
||||
local out=$E2E/collected since
|
||||
since=$(sed -n 's/^started: //p' "$E2E/run-info")
|
||||
mkdir -p "$out"
|
||||
journalctl -u "$UNIT" --since "$since" -o cat > "$out/agent.log"
|
||||
"$CODE/.venv/bin/python" -m nisse_dev.dump --full "$E2E/state.db" > "$out/transcript.txt"
|
||||
dump --full "$E2E/state.db" > "$out/transcript.txt"
|
||||
echo "collected into $out"
|
||||
}
|
||||
|
||||
case "${1:-}" in
|
||||
start) shift; cmd_start "$@" ;;
|
||||
plan) shift; cmd_plan "$@" ;;
|
||||
stop) cmd_stop ;;
|
||||
status) cmd_status ;;
|
||||
logs) cmd_logs ;;
|
||||
collect) cmd_collect ;;
|
||||
*) sed -n '2,25p' "$0" | sed 's/^# \{0,1\}//'; exit 2 ;;
|
||||
*) sed -n '2,30p' "$0" | sed 's/^# \{0,1\}//'; exit 2 ;;
|
||||
esac
|
||||
@@ -6,6 +6,8 @@
|
||||
#
|
||||
# scripts/e2e.sh on the bring-up build VM (configured below)
|
||||
# scripts/e2e.sh --local on a throwaway local sshd instead
|
||||
# scripts/e2e.sh --image REF inside an image's `test` stage (Dockerfile),
|
||||
# on its own sshd: checks a release as built
|
||||
#
|
||||
# Uses tests/integration/nisse-test.yaml and its secrets (.env at the repo
|
||||
# root), like the integration tests. Every role runs on a local model
|
||||
@@ -14,6 +16,18 @@
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
if [ "${1:-}" = "--image" ]; then
|
||||
image=${2:?--image needs an image reference}
|
||||
shift 2
|
||||
runs=${NISSE_E2E_RUNS:-/root/nisse-e2e/test-runs}
|
||||
mkdir -p "$runs"
|
||||
secrets=()
|
||||
[ -f .env ] && secrets=(--env-file .env)
|
||||
# Host networking: the suite reaches Matrix, Gitea and LiteLLM as here.
|
||||
exec docker run --rm --network host "${secrets[@]}" \
|
||||
-e NISSE_E2E_RUNS=/runs -v "$runs:/runs" \
|
||||
"$image" scripts/e2e.sh --local "$@"
|
||||
fi
|
||||
if [ "${1:-}" = "--local" ]; then
|
||||
shift
|
||||
else
|
||||
|
||||
Reference in new issue
Block a user