claude code agent
7eaff4dab0
F1: ContainerImageStatus now reads the 24h statusCache (keyed by imageID) before the remote registry digest lookup, so the cache is effective on the input side for all callers instead of being write-only. This avoids the rate-limited registry HEAD on repeat loads. F2: add nodeName to the imageStatus query key so cached results cannot be reused across nodes. F3: correct the swagger annotations to reflect that engine-level issues degrade to a 200 skipped/error status rather than 400/404. F4: return a generic error message to the client instead of the raw registry/engine error; the raw error is still logged server-side. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
83 lines
3.9 KiB
Go
83 lines
3.9 KiB
Go
package containers
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/portainer/portainer/api/docker/images"
|
|
"github.com/portainer/portainer/api/http/middlewares"
|
|
httperror "github.com/portainer/portainer/pkg/libhttp/error"
|
|
"github.com/portainer/portainer/pkg/libhttp/request"
|
|
"github.com/portainer/portainer/pkg/libhttp/response"
|
|
|
|
"github.com/rs/zerolog/log"
|
|
)
|
|
|
|
// imageStatusResponse is the body returned by the image status endpoint.
|
|
type imageStatusResponse struct {
|
|
// Status of the running container image. One of:
|
|
// "outdated", "updated", "skipped", "processing", "preparing", "error".
|
|
Status string `json:"Status"`
|
|
// Message holds an optional human-readable detail, typically the detection error.
|
|
Message string `json:"Message,omitempty"`
|
|
}
|
|
|
|
// @id ContainerImageStatus
|
|
// @summary Fetch the image status of a container
|
|
// @description Detect whether a newer image is available for the running container by
|
|
// @description comparing the local image digest against the remote registry digest.
|
|
// @description This is a read-only operation: it never pulls or recreates anything.
|
|
// @description **Access policy**: authenticated
|
|
// @tags docker
|
|
// @security ApiKeyAuth
|
|
// @security jwt
|
|
// @produce json
|
|
// @param id path int true "Environment identifier"
|
|
// @param containerId path string true "Container identifier"
|
|
// @param nodeName query string false "Node name for a Swarm/agent endpoint"
|
|
// @description Engine-level issues (container not found, registry unreachable, auth
|
|
// @description failure, ...) are not treated as API errors: they degrade gracefully to a
|
|
// @description 200 response carrying a "skipped" or "error" status. HTTP errors are only
|
|
// @description returned for request/authorization problems.
|
|
// @success 200 {object} imageStatusResponse "Image status (also returned with a skipped/error status for engine-level issues)"
|
|
// @failure 400 "Invalid request: missing container identifier"
|
|
// @failure 403 "Permission denied to access the environment"
|
|
// @failure 404 "Environment not found"
|
|
// @router /docker/{id}/containers/{containerId}/image_status [get]
|
|
func (handler *Handler) imageStatus(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
|
|
containerID, err := request.RetrieveRouteVariableValue(r, "containerId")
|
|
if err != nil {
|
|
return httperror.BadRequest("Invalid containerId", err)
|
|
}
|
|
|
|
// nodeName is optional and only relevant for Swarm/agent endpoints.
|
|
nodeName, _ := request.RetrieveQueryParameter(r, "nodeName", true)
|
|
|
|
endpoint, err := middlewares.FetchEndpoint(r)
|
|
if err != nil {
|
|
return httperror.NotFound("Unable to find an environment on request context", err)
|
|
}
|
|
|
|
if err := handler.bouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
|
|
return httperror.Forbidden("Permission denied to access environment", err)
|
|
}
|
|
|
|
// The detection engine (zlib/CE) routes outbound registry calls through the
|
|
// RegistryClient, which honors the encrypted credential store and the outbound
|
|
// SSRF/AllowList. It caches results for 24h and skips digest-pinned/local-only images.
|
|
digestClient := images.NewClientWithRegistry(images.NewRegistryClient(handler.dataStore), handler.dockerClientFactory)
|
|
|
|
status, err := digestClient.ContainerImageStatus(r.Context(), containerID, endpoint, nodeName)
|
|
if err != nil {
|
|
// A detection failure (registry unreachable, auth failure, ...) is not an API
|
|
// failure: degrade gracefully with a 200 + "error" status so the UI can render a
|
|
// neutral badge instead of surfacing a hard error. The raw error is logged
|
|
// server-side only; the response carries a generic message to avoid leaking
|
|
// registry URLs or credential details to the client.
|
|
log.Warn().Err(err).Str("containerId", containerID).Msg("unable to determine container image status")
|
|
|
|
return response.JSON(w, &imageStatusResponse{Status: string(images.Error), Message: "unable to determine image status"})
|
|
}
|
|
|
|
return response.JSON(w, &imageStatusResponse{Status: string(status)})
|
|
}
|