mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-07 09:24:09 +00:00
feat(fleet): show itemized prune plans (#1734)
* feat(fleet): itemize prune review plans Build and display fingerprint-bound prune candidates for every reviewed fleet node. Preflight all node plans before mutation and preserve detailed removed, skipped, failed, and partial outcomes. Add safe resource metadata projection, managed ownership attribution, runtime contract validation, transport parity coverage, and operator docs. Closes #1724 * fix(security): harden stack path lookup Use a Map for Compose working-directory ownership resolution so untrusted path strings cannot become object property writes. * fix(fleet): harden prune execution safeguards
This commit is contained in:
Anso
@@ -19,6 +19,8 @@ const pruneManagedOnly = vi.fn();
|
||||
const pruneSystem = vi.fn();
|
||||
const estimateManagedReclaim = vi.fn();
|
||||
const estimateSystemReclaim = vi.fn();
|
||||
const buildPrunePlan = vi.fn();
|
||||
const executePrunePlan = vi.fn();
|
||||
const getContainersByStack = vi.fn();
|
||||
const stopContainer = vi.fn();
|
||||
const restartContainer = vi.fn();
|
||||
@@ -47,6 +49,8 @@ vi.mock('../services/DockerController', () => ({
|
||||
pruneSystem,
|
||||
estimateManagedReclaim,
|
||||
estimateSystemReclaim,
|
||||
buildPrunePlan,
|
||||
executePrunePlan,
|
||||
getContainersByStack,
|
||||
stopContainer,
|
||||
restartContainer,
|
||||
@@ -90,6 +94,11 @@ beforeEach(() => {
|
||||
pruneSystem.mockResolvedValue({ success: true, reclaimedBytes: 0 });
|
||||
estimateManagedReclaim.mockResolvedValue({ reclaimableBytes: 0 });
|
||||
estimateSystemReclaim.mockResolvedValue({ reclaimableBytes: 0 });
|
||||
buildPrunePlan.mockResolvedValue({
|
||||
nodeId: 1, scope: 'managed', targets: ['images'], items: [], reclaimableBytes: 0,
|
||||
fingerprint: 'empty-plan', createdAt: 1,
|
||||
});
|
||||
executePrunePlan.mockResolvedValue({ success: true, reclaimedBytes: 0, outcomes: [] });
|
||||
getContainersByStack.mockResolvedValue([{ Id: 'container-1' }]);
|
||||
stopContainer.mockResolvedValue(undefined);
|
||||
restartContainer.mockResolvedValue(undefined);
|
||||
@@ -1000,8 +1009,19 @@ describe('POST /api/fleet/labels/fleet-stop with dryRun: true', () => {
|
||||
});
|
||||
|
||||
describe('POST /api/fleet/labels/fleet-prune with dryRun: true', () => {
|
||||
it('routes to estimateManagedReclaim and marks each target dryRun: true', async () => {
|
||||
estimateManagedReclaim.mockResolvedValue({ reclaimableBytes: 2048 });
|
||||
it('returns one multi-target itemized plan without calling prune methods', async () => {
|
||||
buildPrunePlan.mockResolvedValue({
|
||||
nodeId: 1,
|
||||
scope: 'managed',
|
||||
targets: ['volumes', 'images'],
|
||||
items: [
|
||||
{ target: 'volumes', id: 'data', name: 'data', sizeBytes: 512, managed: true, reason: 'unused' },
|
||||
{ target: 'images', id: 'image', name: 'app:latest', sizeBytes: 1536, managed: true, reason: 'unused' },
|
||||
],
|
||||
reclaimableBytes: 2048,
|
||||
fingerprint: 'itemized-plan',
|
||||
createdAt: 1,
|
||||
});
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
@@ -1009,41 +1029,105 @@ describe('POST /api/fleet/labels/fleet-prune with dryRun: true', () => {
|
||||
expect(res.status).toBe(200);
|
||||
const node = res.body.results[0];
|
||||
expect(node.reachable).toBe(true);
|
||||
expect(node.fingerprint).toBe('itemized-plan');
|
||||
expect(node.items).toHaveLength(2);
|
||||
expect(node.targets).toHaveLength(2);
|
||||
for (const t of node.targets) {
|
||||
expect(t.success).toBe(true);
|
||||
expect(t.reclaimedBytes).toBe(2048);
|
||||
expect(t.dryRun).toBe(true);
|
||||
}
|
||||
expect(node.targets).toEqual([
|
||||
{ target: 'images', success: true, reclaimedBytes: 1536, dryRun: true },
|
||||
{ target: 'volumes', success: true, reclaimedBytes: 512, dryRun: true },
|
||||
]);
|
||||
expect(pruneManagedOnly).not.toHaveBeenCalled();
|
||||
expect(pruneSystem).not.toHaveBeenCalled();
|
||||
expect(estimateManagedReclaim).toHaveBeenCalledTimes(2);
|
||||
expect(buildPrunePlan).toHaveBeenCalledTimes(1);
|
||||
expect(invalidateNodeCaches).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('routes to estimateSystemReclaim when scope is "all"', async () => {
|
||||
estimateSystemReclaim.mockResolvedValue({ reclaimableBytes: 8192 });
|
||||
it('loads known stacks and builds attribution even when scope is "all"', async () => {
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images'], scope: 'all', dryRun: true });
|
||||
expect(res.status).toBe(200);
|
||||
expect(estimateManagedReclaim).not.toHaveBeenCalled();
|
||||
expect(estimateSystemReclaim).toHaveBeenCalled();
|
||||
expect(estimateSystemReclaim).not.toHaveBeenCalled();
|
||||
expect(buildPrunePlan).toHaveBeenCalledWith(['images'], 'all', ['alpha', 'beta'], expect.any(Number), expect.any(Function));
|
||||
expect(pruneManagedOnly).not.toHaveBeenCalled();
|
||||
expect(pruneSystem).not.toHaveBeenCalled();
|
||||
expect(res.body.results[0].targets[0].reclaimedBytes).toBe(8192);
|
||||
});
|
||||
|
||||
it('still invokes pruneManagedOnly when dryRun is omitted', async () => {
|
||||
pruneManagedOnly.mockResolvedValue({ success: true, reclaimedBytes: 512 });
|
||||
it('requires reviewed roster and fingerprints when dryRun is omitted', async () => {
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images'], scope: 'managed' });
|
||||
expect(res.status).toBe(200);
|
||||
expect(pruneManagedOnly).toHaveBeenCalled();
|
||||
expect(res.status).toBe(400);
|
||||
expect(pruneManagedOnly).not.toHaveBeenCalled();
|
||||
expect(executePrunePlan).not.toHaveBeenCalled();
|
||||
expect(estimateManagedReclaim).not.toHaveBeenCalled();
|
||||
expect(res.body.results[0].targets[0].dryRun).toBeUndefined();
|
||||
});
|
||||
|
||||
it('invalidates local caches only after an item is removed', async () => {
|
||||
const local = db.getNodes().find((node) => node.type === 'local')!;
|
||||
buildPrunePlan.mockResolvedValue({
|
||||
nodeId: local.id,
|
||||
scope: 'managed',
|
||||
targets: ['images'],
|
||||
items: [{ target: 'images', id: 'image', name: 'app:latest', managed: true, reason: 'unused' }],
|
||||
reclaimableBytes: 0,
|
||||
fingerprint: 'reviewed-plan',
|
||||
createdAt: 1,
|
||||
});
|
||||
executePrunePlan.mockResolvedValue({
|
||||
success: true,
|
||||
reclaimedBytes: 0,
|
||||
outcomes: [{ target: 'images', id: 'image', status: 'removed' }],
|
||||
});
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'],
|
||||
scope: 'managed',
|
||||
dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }],
|
||||
plans: [{ nodeId: local.id, fingerprint: 'reviewed-plan' }],
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
expect(executePrunePlan).toHaveBeenCalledTimes(1);
|
||||
expect(invalidateNodeCaches).toHaveBeenCalledWith(local.id);
|
||||
});
|
||||
|
||||
it('does not invalidate local caches for empty, skipped, or failed outcomes', async () => {
|
||||
const local = db.getNodes().find((node) => node.type === 'local')!;
|
||||
const cases = [
|
||||
{ items: [], outcomes: [] },
|
||||
{
|
||||
items: [{ target: 'images', id: 'image', name: 'app:latest', managed: true, reason: 'unused', image: { references: ['app:latest'] } }],
|
||||
outcomes: [{ target: 'images', id: 'image', status: 'skipped', reason: 'became active' }],
|
||||
},
|
||||
{
|
||||
items: [{ target: 'images', id: 'image', name: 'app:latest', managed: true, reason: 'unused', image: { references: ['app:latest'] } }],
|
||||
outcomes: [{ target: 'images', id: 'image', status: 'failed', error: 'remove failed' }],
|
||||
},
|
||||
] as const;
|
||||
for (const [index, testCase] of cases.entries()) {
|
||||
const fingerprint = `reviewed-plan-${index}`;
|
||||
buildPrunePlan.mockResolvedValue({
|
||||
nodeId: local.id, scope: 'managed', targets: ['images'], items: [...testCase.items],
|
||||
reclaimableBytes: 0, fingerprint, createdAt: 1,
|
||||
});
|
||||
executePrunePlan.mockResolvedValue({ success: true, reclaimedBytes: 0, outcomes: [...testCase.outcomes] });
|
||||
invalidateNodeCaches.mockClear();
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }],
|
||||
plans: [{ nodeId: local.id, fingerprint }],
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
expect(invalidateNodeCaches).not.toHaveBeenCalled();
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -40,6 +40,8 @@ let proxyNodeId: number;
|
||||
let NodeRegistry: typeof import('../services/NodeRegistry').NodeRegistry;
|
||||
let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
|
||||
let LicenseService: typeof import('../services/LicenseService').LicenseService;
|
||||
let DockerController: typeof import('../services/DockerController').default;
|
||||
let FileSystemService: typeof import('../services/FileSystemService').FileSystemService;
|
||||
|
||||
beforeAll(async () => {
|
||||
tmpDir = await setupTestDb();
|
||||
@@ -47,6 +49,8 @@ beforeAll(async () => {
|
||||
({ NodeRegistry } = await import('../services/NodeRegistry'));
|
||||
({ DatabaseService } = await import('../services/DatabaseService'));
|
||||
({ LicenseService } = await import('../services/LicenseService'));
|
||||
({ default: DockerController } = await import('../services/DockerController'));
|
||||
({ FileSystemService } = await import('../services/FileSystemService'));
|
||||
|
||||
const db = DatabaseService.getInstance();
|
||||
pilotNodeId = db.addNode({
|
||||
@@ -259,7 +263,19 @@ describe('POST /api/fleet/labels/fleet-prune (pilot-agent dispatch)', () => {
|
||||
mockFetch((url, init) => {
|
||||
const headers = (init?.headers as Record<string, string>) ?? {};
|
||||
calls.push({ url, auth: headers.Authorization });
|
||||
return new Response(JSON.stringify({ success: true, reclaimedBytes: 999, dryRun: true }), {
|
||||
return new Response(JSON.stringify({
|
||||
nodeId: 1,
|
||||
scope: 'managed',
|
||||
targets: ['images'],
|
||||
items: [{
|
||||
target: 'images', id: 'sha256:pilot', name: 'pilot/app:latest', sizeBytes: 999,
|
||||
managed: true, reason: 'Image is not used by any container', stackName: 'app',
|
||||
image: { references: ['pilot/app:latest'] },
|
||||
}],
|
||||
reclaimableBytes: 999,
|
||||
fingerprint: 'pilot-plan',
|
||||
createdAt: 1,
|
||||
}), {
|
||||
status: 200, headers: { 'content-type': 'application/json' },
|
||||
});
|
||||
});
|
||||
@@ -272,11 +288,75 @@ describe('POST /api/fleet/labels/fleet-prune (pilot-agent dispatch)', () => {
|
||||
expect(res.status).toBe(200);
|
||||
const pilotCall = calls.find(c => c.url.startsWith(PILOT_LOOPBACK));
|
||||
expect(pilotCall).toBeDefined();
|
||||
expect(pilotCall?.url).toBe(`${PILOT_LOOPBACK}/api/system/prune/plan`);
|
||||
expect(pilotCall?.auth).toBeUndefined();
|
||||
const pilotResult = res.body.results.find((r: { nodeId: number }) => r.nodeId === pilotNodeId);
|
||||
expect(pilotResult.reachable).toBe(true);
|
||||
expect(pilotResult.targets[0].reclaimedBytes).toBe(999);
|
||||
});
|
||||
|
||||
it('uses one plan request and one fingerprint-bound execute request per remote', async () => {
|
||||
mockPaidTier();
|
||||
mockTargets();
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
const localPlan = {
|
||||
nodeId: local.id, scope: 'managed' as const, targets: ['images' as const], items: [],
|
||||
reclaimableBytes: 0, fingerprint: 'local-plan', createdAt: 1,
|
||||
};
|
||||
const executePrunePlan = vi.fn().mockResolvedValue({ success: true, reclaimedBytes: 0, outcomes: [] });
|
||||
vi.spyOn(DockerController, 'getInstance').mockReturnValue({
|
||||
buildPrunePlan: vi.fn().mockResolvedValue(localPlan),
|
||||
executePrunePlan,
|
||||
} as unknown as ReturnType<typeof DockerController.getInstance>);
|
||||
vi.spyOn(FileSystemService.prototype, 'getStacks').mockResolvedValue([]);
|
||||
|
||||
const calls: Array<{ url: string; auth: string | undefined; body: Record<string, unknown> }> = [];
|
||||
mockFetch((url, init) => {
|
||||
const headers = (init?.headers as Record<string, string>) ?? {};
|
||||
const body = JSON.parse(String(init?.body)) as Record<string, unknown>;
|
||||
calls.push({ url, auth: headers.Authorization, body });
|
||||
const pilot = url.startsWith(PILOT_LOOPBACK);
|
||||
if (url.endsWith('/api/system/prune/plan')) {
|
||||
return new Response(JSON.stringify({
|
||||
nodeId: 1, scope: 'managed', targets: ['images'], items: [], reclaimableBytes: 0,
|
||||
fingerprint: pilot ? 'pilot-plan' : 'proxy-plan', createdAt: 1,
|
||||
}), { status: 200, headers: { 'content-type': 'application/json' } });
|
||||
}
|
||||
return new Response(JSON.stringify({ success: true, reclaimedBytes: 0, outcomes: [] }), {
|
||||
status: 200, headers: { 'content-type': 'application/json' },
|
||||
});
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [
|
||||
{ nodeId: local.id, reachable: true },
|
||||
{ nodeId: pilotNodeId, reachable: true },
|
||||
{ nodeId: proxyNodeId, reachable: true },
|
||||
],
|
||||
plans: [
|
||||
{ nodeId: local.id, fingerprint: 'local-plan' },
|
||||
{ nodeId: pilotNodeId, fingerprint: 'pilot-plan' },
|
||||
{ nodeId: proxyNodeId, fingerprint: 'proxy-plan' },
|
||||
],
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(executePrunePlan).toHaveBeenCalledTimes(1);
|
||||
const pilotCalls = calls.filter((call) => call.url.startsWith(PILOT_LOOPBACK));
|
||||
expect(pilotCalls.map((call) => call.url)).toEqual([
|
||||
`${PILOT_LOOPBACK}/api/system/prune/plan`,
|
||||
`${PILOT_LOOPBACK}/api/system/prune/system`,
|
||||
]);
|
||||
expect(pilotCalls.every((call) => call.auth === undefined)).toBe(true);
|
||||
expect(pilotCalls[1].body).toMatchObject({ targets: ['images'], planFingerprint: 'pilot-plan' });
|
||||
const proxyCalls = calls.filter((call) => call.url.startsWith(PROXY_URL));
|
||||
expect(proxyCalls).toHaveLength(2);
|
||||
expect(proxyCalls.every((call) => call.auth === `Bearer ${PROXY_TOKEN}`)).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe('GET /api/image-updates/fleet (pilot inclusion)', () => {
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
/**
|
||||
* F-6 regression: fleet routes that call estimateSystemReclaim on local
|
||||
* nodes must also bound the slow `docker system df` call (8s) and surface
|
||||
* a recognizable timeout message to the operator, matching the
|
||||
* /api/system/prune/estimate behavior.
|
||||
* F-6 regression: Fleet itemized plan enumeration and byte estimation both
|
||||
* bound the slow `docker system df` call (8s) and surface a recognizable
|
||||
* timeout message to the operator.
|
||||
*
|
||||
* Covers:
|
||||
* - POST /api/fleet/labels/fleet-prune with dryRun: true
|
||||
@@ -42,17 +41,27 @@ afterEach(() => {
|
||||
activeBulkActions.clear();
|
||||
});
|
||||
|
||||
function stubLocalEstimate(impl: () => Promise<{ reclaimableBytes: number }>) {
|
||||
function stubLocalEstimate(
|
||||
estimateImpl: () => Promise<{ reclaimableBytes: number }>,
|
||||
planImpl: () => Promise<unknown> = async () => ({
|
||||
nodeId: 1, scope: 'all', targets: ['volumes'], items: [], reclaimableBytes: 0,
|
||||
fingerprint: 'empty', createdAt: 1,
|
||||
}),
|
||||
) {
|
||||
vi.spyOn(DockerController, 'getInstance').mockReturnValue({
|
||||
estimateSystemReclaim: vi.fn().mockImplementation(impl),
|
||||
estimateSystemReclaim: vi.fn().mockImplementation(estimateImpl),
|
||||
estimateManagedReclaim: vi.fn().mockResolvedValue({ reclaimableBytes: 0 }),
|
||||
buildPrunePlan: vi.fn().mockImplementation(planImpl),
|
||||
} as unknown as ReturnType<typeof DockerController.getInstance>);
|
||||
vi.spyOn(FileSystemService.prototype, 'getStacks').mockResolvedValue([]);
|
||||
}
|
||||
|
||||
describe('Fleet prune routes bound docker df at 8s on local nodes (F-6)', () => {
|
||||
it('POST /api/fleet/labels/fleet-prune dry-run surfaces a busy-daemon error on local timeout', async () => {
|
||||
stubLocalEstimate(() => new Promise(() => { /* never resolves */ }));
|
||||
stubLocalEstimate(
|
||||
() => Promise.resolve({ reclaimableBytes: 0 }),
|
||||
() => new Promise(() => { /* never resolves */ }),
|
||||
);
|
||||
|
||||
const t0 = Date.now();
|
||||
const res = await request(app)
|
||||
@@ -86,7 +95,21 @@ describe('Fleet prune routes bound docker df at 8s on local nodes (F-6)', () =>
|
||||
}, 20_000);
|
||||
|
||||
it('fleet-prune dry-run succeeds normally when estimateSystemReclaim resolves quickly', async () => {
|
||||
stubLocalEstimate(() => Promise.resolve({ reclaimableBytes: 256 }));
|
||||
stubLocalEstimate(
|
||||
() => Promise.resolve({ reclaimableBytes: 256 }),
|
||||
async () => ({
|
||||
nodeId: 1,
|
||||
scope: 'all',
|
||||
targets: ['volumes'],
|
||||
items: [{
|
||||
target: 'volumes', id: 'volume-a', name: 'volume-a', sizeBytes: 256,
|
||||
managed: false, reason: 'Volume is not referenced by any container',
|
||||
}],
|
||||
reclaimableBytes: 256,
|
||||
fingerprint: 'volume-plan',
|
||||
createdAt: 1,
|
||||
}),
|
||||
);
|
||||
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
|
||||
@@ -1,17 +1,12 @@
|
||||
/**
|
||||
* Tests for the fleet-wide Docker prune endpoint. Covers auth, tier gating,
|
||||
* input validation, local node orchestration with mocked DockerController,
|
||||
* remote-node fan-out with mocked fetch, lock contention, and partial failures.
|
||||
*/
|
||||
import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from 'vitest';
|
||||
import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
|
||||
import request from 'supertest';
|
||||
import jwt from 'jsonwebtoken';
|
||||
import { setupTestDb, cleanupTestDb, TEST_USERNAME, TEST_JWT_SECRET } from './helpers/setupTestDb';
|
||||
import { cleanupTestDb, setupTestDb, TEST_JWT_SECRET, TEST_USERNAME } from './helpers/setupTestDb';
|
||||
import type { PruneItemOutcome, PrunePlan, PrunePlanItem } from '../services/prunePlan';
|
||||
|
||||
let tmpDir: string;
|
||||
let app: import('express').Express;
|
||||
let authHeader: string;
|
||||
let LicenseService: typeof import('../services/LicenseService').LicenseService;
|
||||
let DockerController: typeof import('../services/DockerController').default;
|
||||
let FileSystemService: typeof import('../services/FileSystemService').FileSystemService;
|
||||
let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
|
||||
@@ -20,13 +15,11 @@ let activeBulkActions: typeof import('../routes/labels').activeBulkActions;
|
||||
beforeAll(async () => {
|
||||
tmpDir = await setupTestDb();
|
||||
({ app } = await import('../index'));
|
||||
({ LicenseService } = await import('../services/LicenseService'));
|
||||
({ default: DockerController } = await import('../services/DockerController'));
|
||||
({ FileSystemService } = await import('../services/FileSystemService'));
|
||||
({ DatabaseService } = await import('../services/DatabaseService'));
|
||||
({ activeBulkActions } = await import('../routes/labels'));
|
||||
const token = jwt.sign({ username: TEST_USERNAME }, TEST_JWT_SECRET, { expiresIn: '1m' });
|
||||
authHeader = `Bearer ${token}`;
|
||||
authHeader = `Bearer ${jwt.sign({ username: TEST_USERNAME }, TEST_JWT_SECRET, { expiresIn: '10m' })}`;
|
||||
});
|
||||
|
||||
afterAll(() => cleanupTestDb(tmpDir));
|
||||
@@ -36,198 +29,448 @@ afterEach(() => {
|
||||
activeBulkActions.clear();
|
||||
});
|
||||
|
||||
function mockTier(tier: 'paid' | 'community') {
|
||||
vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue(tier);
|
||||
function item(overrides: Partial<PrunePlanItem> = {}): PrunePlanItem {
|
||||
return {
|
||||
target: 'images',
|
||||
id: 'sha256:image',
|
||||
name: 'example/app:latest',
|
||||
sizeBytes: 256,
|
||||
managed: true,
|
||||
reason: 'Image is not used by any container',
|
||||
stackName: 'app',
|
||||
image: { references: ['example/app:latest'] },
|
||||
...overrides,
|
||||
} as PrunePlanItem;
|
||||
}
|
||||
|
||||
function mockLocalPrune(opts: { managedBytes?: Partial<Record<string, number>>; allBytes?: Partial<Record<string, number>>; throwOn?: string } = {}) {
|
||||
function plan(nodeId: number, fingerprint = `fingerprint-${nodeId}`, items: PrunePlanItem[] = [item()]): PrunePlan {
|
||||
return {
|
||||
nodeId,
|
||||
scope: 'managed',
|
||||
targets: ['images'],
|
||||
items,
|
||||
reclaimableBytes: items.reduce((sum, entry) => sum + (entry.sizeBytes ?? 0), 0),
|
||||
fingerprint,
|
||||
createdAt: 1,
|
||||
};
|
||||
}
|
||||
|
||||
function mockLocal(planFactory: (nodeId: number) => PrunePlan = (nodeId) => plan(nodeId)) {
|
||||
const fake = {
|
||||
pruneManagedOnly: vi.fn(async (target: string) => {
|
||||
if (opts.throwOn === target) throw new Error(`mock pruneManagedOnly threw for ${target}`);
|
||||
return { success: true, reclaimedBytes: opts.managedBytes?.[target] ?? 0 };
|
||||
}),
|
||||
pruneSystem: vi.fn(async (target: string) => {
|
||||
if (opts.throwOn === target) throw new Error(`mock pruneSystem threw for ${target}`);
|
||||
return { success: true, reclaimedBytes: opts.allBytes?.[target] ?? 0 };
|
||||
}),
|
||||
buildPrunePlan: vi.fn(async (_targets, _scope, _stacks, nodeId: number) => planFactory(nodeId)),
|
||||
executePrunePlan: vi.fn(async (reviewedPlan: PrunePlan): Promise<{
|
||||
success: boolean;
|
||||
reclaimedBytes: number;
|
||||
outcomes: PruneItemOutcome[];
|
||||
}> => ({
|
||||
success: true,
|
||||
reclaimedBytes: reviewedPlan.reclaimableBytes,
|
||||
outcomes: reviewedPlan.items.map((entry) => ({
|
||||
id: entry.id,
|
||||
target: entry.target,
|
||||
status: 'removed' as const,
|
||||
sizeBytes: entry.sizeBytes,
|
||||
})),
|
||||
})),
|
||||
};
|
||||
vi.spyOn(DockerController, 'getInstance').mockReturnValue(fake as unknown as ReturnType<typeof DockerController.getInstance>);
|
||||
// Spy on the prototype so the mock applies to whichever FileSystemService
|
||||
// instance the route creates for the local node id, not a throwaway one.
|
||||
vi.spyOn(FileSystemService.prototype, 'getStacks').mockResolvedValue(['stack-a', 'stack-b']);
|
||||
vi.spyOn(FileSystemService.prototype, 'getStacks').mockResolvedValue(['app']);
|
||||
return fake;
|
||||
}
|
||||
|
||||
function localReview(fingerprint: string) {
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
return {
|
||||
local,
|
||||
body: {
|
||||
targets: ['images'],
|
||||
scope: 'managed',
|
||||
dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }],
|
||||
plans: [{ nodeId: local.id, fingerprint }],
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function addRemote(name: string): number {
|
||||
return DatabaseService.getInstance().addNode({
|
||||
name,
|
||||
type: 'remote',
|
||||
api_url: `http://${name}.example:1852`,
|
||||
api_token: 'token',
|
||||
compose_dir: '/app/compose',
|
||||
is_default: false,
|
||||
});
|
||||
}
|
||||
|
||||
describe('POST /api/fleet/labels/fleet-prune', () => {
|
||||
it('returns 401 without auth', async () => {
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.send({ targets: ['images'], scope: 'managed' });
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('is reachable on community tier for admins (no PAID_REQUIRED)', async () => {
|
||||
mockTier('community');
|
||||
mockLocalPrune({ managedBytes: { images: 128 } });
|
||||
const res = await request(app)
|
||||
it('requires authentication and validates the request', async () => {
|
||||
expect((await request(app).post('/api/fleet/labels/fleet-prune').send({})).status).toBe(401);
|
||||
const invalid = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images'], scope: 'managed' });
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.code).not.toBe('PAID_REQUIRED');
|
||||
expect(Array.isArray(res.body.results)).toBe(true);
|
||||
});
|
||||
|
||||
it('returns 400 when body is missing', async () => {
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send();
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('returns 400 when targets is empty', async () => {
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: [], scope: 'managed' });
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/non-empty/);
|
||||
});
|
||||
|
||||
it('returns 400 when a target is unrecognized', async () => {
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images', 'containers'], scope: 'managed' });
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/Invalid target/);
|
||||
});
|
||||
|
||||
it('runs pruneManagedOnly per target on the local node and returns aggregated bytes', async () => {
|
||||
const fake = mockLocalPrune({ managedBytes: { images: 1500, volumes: 320 } });
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images', 'volumes'], scope: 'managed' });
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.results).toHaveLength(1);
|
||||
const node = res.body.results[0];
|
||||
expect(node.reachable).toBe(true);
|
||||
expect(node.targets).toEqual([
|
||||
{ target: 'images', success: true, reclaimedBytes: 1500 },
|
||||
{ target: 'volumes', success: true, reclaimedBytes: 320 },
|
||||
]);
|
||||
expect(fake.pruneManagedOnly).toHaveBeenCalledTimes(2);
|
||||
expect(fake.pruneSystem).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('runs pruneSystem when scope is "all" and dedupes targets', async () => {
|
||||
const fake = mockLocalPrune({ allBytes: { networks: 0, images: 2048 } });
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images', 'networks', 'images'], scope: 'all' });
|
||||
expect(res.status).toBe(200);
|
||||
expect(fake.pruneManagedOnly).not.toHaveBeenCalled();
|
||||
expect(fake.pruneSystem).toHaveBeenCalledTimes(2);
|
||||
const node = res.body.results[0];
|
||||
expect(node.targets.map((t: { target: string }) => t.target).sort()).toEqual(['images', 'networks']);
|
||||
});
|
||||
|
||||
it('records per-target failure when DockerController throws but continues remaining targets', async () => {
|
||||
mockLocalPrune({ managedBytes: { images: 100 }, throwOn: 'volumes' });
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images', 'volumes'], scope: 'managed' });
|
||||
expect(res.status).toBe(200);
|
||||
const node = res.body.results[0];
|
||||
expect(node.targets.find((t: { target: string }) => t.target === 'images').success).toBe(true);
|
||||
const volumes = node.targets.find((t: { target: string }) => t.target === 'volumes');
|
||||
expect(volumes.success).toBe(false);
|
||||
expect(volumes.reclaimedBytes).toBe(0);
|
||||
expect(volumes.error).toMatch(/pruneManagedOnly threw/);
|
||||
});
|
||||
|
||||
it('reports lock contention when bulk-prune lock is already held', async () => {
|
||||
mockLocalPrune();
|
||||
const db = DatabaseService.getInstance();
|
||||
const localId = db.getNodes().find(n => n.type === 'local')!.id;
|
||||
activeBulkActions.add(`bulk-prune:${localId}`);
|
||||
const res = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images'], scope: 'managed' });
|
||||
expect(res.status).toBe(200);
|
||||
const node = res.body.results.find((n: { nodeId: number }) => n.nodeId === localId);
|
||||
expect(node.targets[0].success).toBe(false);
|
||||
expect(node.targets[0].error).toMatch(/already running/);
|
||||
});
|
||||
|
||||
it('marks a remote node unreachable when fetch throws and short-circuits later targets', async () => {
|
||||
mockLocalPrune();
|
||||
const db = DatabaseService.getInstance();
|
||||
const remoteId = db.addNode({
|
||||
name: 'remote-test',
|
||||
type: 'remote',
|
||||
api_url: 'http://remote.example:1852',
|
||||
api_token: 'tok',
|
||||
compose_dir: '/app/compose',
|
||||
is_default: false,
|
||||
});
|
||||
try {
|
||||
const fetchSpy = vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('connect ECONNREFUSED'));
|
||||
const res = await request(app)
|
||||
.send({ targets: ['containers'], dryRun: true });
|
||||
expect(invalid.status).toBe(400);
|
||||
for (const scope of [undefined, 'everything', 1]) {
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images', 'volumes', 'networks'], scope: 'managed' });
|
||||
expect(res.status).toBe(200);
|
||||
const remote = res.body.results.find((n: { nodeId: number }) => n.nodeId === remoteId);
|
||||
expect(remote.reachable).toBe(false);
|
||||
expect(remote.error).toMatch(/ECONNREFUSED/);
|
||||
expect(remote.targets).toHaveLength(3);
|
||||
for (const t of remote.targets) expect(t.success).toBe(false);
|
||||
// Only the first target attempts the fetch; the rest short-circuit.
|
||||
expect(fetchSpy).toHaveBeenCalledTimes(1);
|
||||
} finally {
|
||||
db.deleteNode(remoteId);
|
||||
.send({ targets: ['images'], scope, dryRun: true });
|
||||
expect(response.status).toBe(400);
|
||||
}
|
||||
});
|
||||
|
||||
it('parses remote node responses into per-target reclaimed bytes', async () => {
|
||||
mockLocalPrune();
|
||||
const db = DatabaseService.getInstance();
|
||||
const remoteId = db.addNode({
|
||||
name: 'remote-ok',
|
||||
type: 'remote',
|
||||
api_url: 'http://remote-ok.example:1852/',
|
||||
api_token: 'tok',
|
||||
compose_dir: '/app/compose',
|
||||
is_default: false,
|
||||
});
|
||||
it('rejects malformed remote plan contracts', async () => {
|
||||
mockLocal();
|
||||
const remoteId = addRemote('remote-malformed-plan');
|
||||
const base = plan(remoteId);
|
||||
const malformedPlans = [
|
||||
{ ...base, targets: ['images', 'images'] },
|
||||
{ ...base, items: [item(), item()], reclaimableBytes: 512 },
|
||||
{ ...base, reclaimableBytes: -1 },
|
||||
{ ...base, nodeId: 'remote' },
|
||||
{ ...base, createdAt: Number.NaN },
|
||||
];
|
||||
try {
|
||||
const responses = new Map<string, number>([['images', 4096], ['volumes', 512]]);
|
||||
vi.spyOn(globalThis, 'fetch').mockImplementation(async (_url, init) => {
|
||||
const body = JSON.parse((init?.body as string) ?? '{}') as { target: string };
|
||||
const reclaimedBytes = responses.get(body.target) ?? 0;
|
||||
return new Response(JSON.stringify({ message: 'ok', success: true, reclaimedBytes }), {
|
||||
status: 200, headers: { 'content-type': 'application/json' },
|
||||
});
|
||||
});
|
||||
const res = await request(app)
|
||||
for (const malformed of malformedPlans) {
|
||||
vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(new Response(JSON.stringify(malformed), { status: 200 }));
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images', 'volumes'], scope: 'managed', dryRun: true });
|
||||
const remote = response.body.results.find((result: { nodeId: number }) => result.nodeId === remoteId);
|
||||
expect(remote).toMatchObject({ reachable: true, code: 'REMOTE_PLAN_INVALID' });
|
||||
expect(remote.fingerprint).toBeUndefined();
|
||||
vi.restoreAllMocks();
|
||||
mockLocal();
|
||||
}
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('returns itemized dry-run plans without taking the destructive lock', async () => {
|
||||
const fake = mockLocal();
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images'], scope: 'managed', dryRun: true });
|
||||
|
||||
expect(response.status).toBe(200);
|
||||
expect(response.body.results[0]).toMatchObject({
|
||||
reachable: true,
|
||||
fingerprint: expect.stringMatching(/^fingerprint-/),
|
||||
reclaimableBytes: 256,
|
||||
items: [expect.objectContaining({ name: 'example/app:latest', managed: true, stackName: 'app' })],
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 256, dryRun: true }],
|
||||
});
|
||||
expect(fake.executePrunePlan).not.toHaveBeenCalled();
|
||||
expect(activeBulkActions.size).toBe(0);
|
||||
});
|
||||
|
||||
it('loads known stacks for All unused attribution', async () => {
|
||||
mockLocal();
|
||||
const stackSpy = vi.spyOn(FileSystemService.prototype, 'getStacks');
|
||||
await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images'], scope: 'all', dryRun: true });
|
||||
expect(stackSpy).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('rejects missing, duplicate, and malformed reviewed entries', async () => {
|
||||
mockLocal();
|
||||
const { local } = localReview(`fingerprint-${DatabaseService.getInstance().getNodes()[0].id}`);
|
||||
const cases = [
|
||||
{ reviewedNodes: [{ nodeId: local.id, reachable: true }], plans: [] },
|
||||
{ reviewedNodes: [{ nodeId: local.id, reachable: true }, { nodeId: local.id, reachable: true }], plans: [] },
|
||||
{ reviewedNodes: [{ nodeId: local.id, reachable: true }], plans: [{ nodeId: local.id, fingerprint: '' }] },
|
||||
];
|
||||
for (const testCase of cases) {
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ targets: ['images', 'volumes'], scope: 'all' });
|
||||
expect(res.status).toBe(200);
|
||||
const remote = res.body.results.find((n: { nodeId: number }) => n.nodeId === remoteId);
|
||||
expect(remote.reachable).toBe(true);
|
||||
expect(remote.targets).toEqual([
|
||||
{ target: 'images', success: true, reclaimedBytes: 4096 },
|
||||
{ target: 'volumes', success: true, reclaimedBytes: 512 },
|
||||
]);
|
||||
.send({ targets: ['images'], scope: 'managed', dryRun: false, ...testCase });
|
||||
expect([400, 409]).toContain(response.status);
|
||||
}
|
||||
});
|
||||
|
||||
it('executes a valid empty plan and releases the lock', async () => {
|
||||
const fake = mockLocal((nodeId) => plan(nodeId, `empty-${nodeId}`, []));
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }],
|
||||
plans: [{ nodeId: local.id, fingerprint: `empty-${local.id}` }],
|
||||
});
|
||||
expect(response.status).toBe(200);
|
||||
expect(fake.executePrunePlan).toHaveBeenCalledTimes(1);
|
||||
expect(response.body.results[0].outcomes).toEqual([]);
|
||||
expect(activeBulkActions.size).toBe(0);
|
||||
});
|
||||
|
||||
it('fails closed when a local prune lock is active', async () => {
|
||||
const fake = mockLocal();
|
||||
const { local, body } = localReview(`fingerprint-${DatabaseService.getInstance().getNodes()[0].id}`);
|
||||
const remoteId = addRemote('remote-lock-check');
|
||||
const fetchSpy = vi.spyOn(globalThis, 'fetch');
|
||||
const lockKey = `bulk-prune:${local.id}`;
|
||||
activeBulkActions.add(lockKey);
|
||||
try {
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
...body,
|
||||
reviewedNodes: [...body.reviewedNodes, { nodeId: remoteId, reachable: true }],
|
||||
plans: [...body.plans, { nodeId: remoteId, fingerprint: 'remote-plan' }],
|
||||
});
|
||||
expect(response.status).toBe(409);
|
||||
expect(response.body.code).toBe('PRUNE_ALREADY_RUNNING');
|
||||
expect(fake.buildPrunePlan).not.toHaveBeenCalled();
|
||||
expect(fake.executePrunePlan).not.toHaveBeenCalled();
|
||||
expect(fetchSpy).not.toHaveBeenCalled();
|
||||
expect(activeBulkActions.has(lockKey)).toBe(true);
|
||||
} finally {
|
||||
db.deleteNode(remoteId);
|
||||
activeBulkActions.delete(lockKey);
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('returns a node failure when local execution setup fails after preflight', async () => {
|
||||
const fake = mockLocal();
|
||||
vi.spyOn(FileSystemService.prototype, 'getStacks')
|
||||
.mockResolvedValueOnce(['app'])
|
||||
.mockRejectedValueOnce(new Error('stack inventory unavailable'));
|
||||
const { body } = localReview(`fingerprint-${DatabaseService.getInstance().getNodes()[0].id}`);
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send(body);
|
||||
|
||||
expect(response.status).toBe(200);
|
||||
expect(response.body.results[0]).toMatchObject({
|
||||
code: 'PRUNE_EXECUTE_FAILED',
|
||||
error: 'stack inventory unavailable',
|
||||
targets: [{ success: false }],
|
||||
});
|
||||
expect(fake.executePrunePlan).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('prevents every destructive call when one node plan is stale', async () => {
|
||||
const fake = mockLocal();
|
||||
const remoteId = addRemote('remote-stale');
|
||||
try {
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(
|
||||
JSON.stringify(plan(99, 'remote-new')),
|
||||
{ status: 200, headers: { 'content-type': 'application/json' } },
|
||||
));
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }, { nodeId: remoteId, reachable: true }],
|
||||
plans: [
|
||||
{ nodeId: local.id, fingerprint: `fingerprint-${local.id}` },
|
||||
{ nodeId: remoteId, fingerprint: 'remote-old' },
|
||||
],
|
||||
});
|
||||
expect(response.status).toBe(409);
|
||||
expect(response.body.code).toBe('PRUNE_PLAN_STALE');
|
||||
expect(fake.executePrunePlan).not.toHaveBeenCalled();
|
||||
expect(fetchSpy).toHaveBeenCalledTimes(1);
|
||||
expect(String(fetchSpy.mock.calls[0][0])).toContain('/api/system/prune/plan');
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects a reviewed-unreachable node that becomes reachable', async () => {
|
||||
const fake = mockLocal();
|
||||
const remoteId = addRemote('remote-newly-reachable');
|
||||
try {
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(JSON.stringify(plan(99)), { status: 200 }));
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }, { nodeId: remoteId, reachable: false }],
|
||||
plans: [{ nodeId: local.id, fingerprint: `fingerprint-${local.id}` }],
|
||||
});
|
||||
expect(response.status).toBe(409);
|
||||
expect(response.body.code).toBe('PRUNE_NODE_REACHABILITY_CHANGED');
|
||||
expect(fake.executePrunePlan).not.toHaveBeenCalled();
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects a reviewed-reachable node that becomes unreachable', async () => {
|
||||
const fake = mockLocal();
|
||||
const remoteId = addRemote('remote-now-offline');
|
||||
try {
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('connect ECONNREFUSED'));
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }, { nodeId: remoteId, reachable: true }],
|
||||
plans: [
|
||||
{ nodeId: local.id, fingerprint: `fingerprint-${local.id}` },
|
||||
{ nodeId: remoteId, fingerprint: 'remote-plan' },
|
||||
],
|
||||
});
|
||||
expect(response.status).toBe(409);
|
||||
expect(response.body.code).toBe('PRUNE_NODE_REACHABILITY_CHANGED');
|
||||
expect(fake.executePrunePlan).not.toHaveBeenCalled();
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects a changed configured-node roster before preflight', async () => {
|
||||
const fake = mockLocal();
|
||||
const remoteId = addRemote('remote-added-after-review');
|
||||
try {
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }],
|
||||
plans: [{ nodeId: local.id, fingerprint: `fingerprint-${local.id}` }],
|
||||
});
|
||||
expect(response.status).toBe(409);
|
||||
expect(response.body.code).toBe('PRUNE_NODE_ROSTER_CHANGED');
|
||||
expect(fake.buildPrunePlan).not.toHaveBeenCalled();
|
||||
expect(fake.executePrunePlan).not.toHaveBeenCalled();
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects a present but incomplete remote outcome list', async () => {
|
||||
const fake = mockLocal();
|
||||
const remoteId = addRemote('remote-bad-outcomes');
|
||||
try {
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
vi.spyOn(globalThis, 'fetch')
|
||||
.mockResolvedValueOnce(new Response(JSON.stringify(plan(remoteId, 'remote-reviewed')), { status: 200 }))
|
||||
.mockResolvedValueOnce(new Response(JSON.stringify({
|
||||
success: true,
|
||||
reclaimedBytes: 256,
|
||||
outcomes: [],
|
||||
}), { status: 200 }));
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }, { nodeId: remoteId, reachable: true }],
|
||||
plans: [
|
||||
{ nodeId: local.id, fingerprint: `fingerprint-${local.id}` },
|
||||
{ nodeId: remoteId, fingerprint: 'remote-reviewed' },
|
||||
],
|
||||
});
|
||||
|
||||
expect(response.status).toBe(200);
|
||||
expect(fake.executePrunePlan).toHaveBeenCalledTimes(1);
|
||||
expect(response.body.results.find((result: { nodeId: number }) => result.nodeId === remoteId)).toMatchObject({
|
||||
code: 'REMOTE_PRUNE_INVALID',
|
||||
error: 'Remote returned malformed or incomplete prune outcomes',
|
||||
});
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects malformed numeric and success fields in remote execute results', async () => {
|
||||
mockLocal();
|
||||
const remoteId = addRemote('remote-bad-result-fields');
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
const remotePlan = plan(remoteId, 'remote-fields');
|
||||
const malformedResults = [
|
||||
{ success: 'yes', reclaimedBytes: 256 },
|
||||
{ success: true, reclaimedBytes: -1 },
|
||||
{
|
||||
success: true, reclaimedBytes: 0,
|
||||
outcomes: [{ target: 'images', id: 'sha256:image', status: 'removed', sizeBytes: -1 }],
|
||||
},
|
||||
];
|
||||
try {
|
||||
const fetchSpy = vi.spyOn(globalThis, 'fetch');
|
||||
for (const malformed of malformedResults) {
|
||||
fetchSpy
|
||||
.mockResolvedValueOnce(new Response(JSON.stringify(remotePlan), { status: 200 }))
|
||||
.mockResolvedValueOnce(new Response(JSON.stringify(malformed), { status: 200 }));
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }, { nodeId: remoteId, reachable: true }],
|
||||
plans: [{ nodeId: local.id, fingerprint: `fingerprint-${local.id}` }, { nodeId: remoteId, fingerprint: 'remote-fields' }],
|
||||
});
|
||||
expect(response.body.results.find((result: { nodeId: number }) => result.nodeId === remoteId)).toMatchObject({
|
||||
code: 'REMOTE_PRUNE_INVALID',
|
||||
});
|
||||
}
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
|
||||
it('projects mixed local outcomes and accepts a legacy remote total', async () => {
|
||||
const items = [
|
||||
item({ id: 'removed', sizeBytes: 100 }),
|
||||
item({ id: 'skipped', sizeBytes: 200 }),
|
||||
item({ id: 'failed', sizeBytes: 300 }),
|
||||
];
|
||||
const fake = mockLocal((nodeId) => plan(nodeId, `mixed-${nodeId}`, items));
|
||||
fake.executePrunePlan.mockResolvedValue({
|
||||
success: false,
|
||||
reclaimedBytes: 100,
|
||||
outcomes: [
|
||||
{ target: 'images', id: 'removed', status: 'removed', sizeBytes: 100 },
|
||||
{ target: 'images', id: 'skipped', status: 'skipped', reason: 'became active' },
|
||||
{ target: 'images', id: 'failed', status: 'failed', error: 'remove failed' },
|
||||
],
|
||||
});
|
||||
const remoteId = addRemote('remote-legacy-total');
|
||||
const remotePlan = plan(remoteId, 'legacy-plan', []);
|
||||
try {
|
||||
vi.spyOn(globalThis, 'fetch')
|
||||
.mockResolvedValueOnce(new Response(JSON.stringify(remotePlan), { status: 200 }))
|
||||
.mockResolvedValueOnce(new Response(JSON.stringify({ success: true, reclaimedBytes: 999 }), { status: 200 }));
|
||||
const local = DatabaseService.getInstance().getNodes().find((node) => node.type === 'local')!;
|
||||
const response = await request(app)
|
||||
.post('/api/fleet/labels/fleet-prune')
|
||||
.set('Authorization', authHeader)
|
||||
.send({
|
||||
targets: ['images'], scope: 'managed', dryRun: false,
|
||||
reviewedNodes: [{ nodeId: local.id, reachable: true }, { nodeId: remoteId, reachable: true }],
|
||||
plans: [{ nodeId: local.id, fingerprint: `mixed-${local.id}` }, { nodeId: remoteId, fingerprint: 'legacy-plan' }],
|
||||
});
|
||||
const localResult = response.body.results.find((result: { nodeId: number }) => result.nodeId === local.id);
|
||||
expect(localResult.targets[0]).toMatchObject({
|
||||
success: false, reclaimedBytes: 100, removed: 1, skipped: 1, failed: 1,
|
||||
});
|
||||
const remoteResult = response.body.results.find((result: { nodeId: number }) => result.nodeId === remoteId);
|
||||
expect(remoteResult.reclaimedBytes).toBe(999);
|
||||
expect(remoteResult.outcomes).toBeUndefined();
|
||||
expect(remoteResult.targets[0]).toMatchObject({ success: true, reclaimedBytes: 0 });
|
||||
} finally {
|
||||
DatabaseService.getInstance().deleteNode(remoteId);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -105,6 +105,168 @@ describe('normalizePruneTargets', () => {
|
||||
});
|
||||
|
||||
describe('DockerController.buildPrunePlan', () => {
|
||||
it('projects target metadata and only safe ownership labels in all scope', async () => {
|
||||
mockDocker.listImages.mockResolvedValue([{
|
||||
Id: 'sha256:dangling',
|
||||
RepoTags: ['<none>:<none>'],
|
||||
RepoDigests: ['example/app@sha256:digest'],
|
||||
Created: 1_700_000_000,
|
||||
Size: 100,
|
||||
Containers: 0,
|
||||
Labels: { 'com.docker.compose.project': 'my-stack', secret: 'do-not-return' },
|
||||
}]);
|
||||
mockDocker.listVolumes.mockResolvedValue({ Volumes: [{
|
||||
Name: 'my-stack_data',
|
||||
Driver: 'local',
|
||||
Labels: { 'com.docker.compose.project': 'my-stack', secret: 'do-not-return' },
|
||||
}] });
|
||||
mockDocker.listNetworks.mockResolvedValue([{
|
||||
Id: 'network-id',
|
||||
Name: 'my-stack_default',
|
||||
Driver: 'bridge',
|
||||
Scope: 'local',
|
||||
Labels: {
|
||||
'com.docker.compose.project': 'my-stack',
|
||||
'com.docker.compose.network': 'default',
|
||||
secret: 'do-not-return',
|
||||
},
|
||||
}]);
|
||||
mockDocker.getNetwork.mockReturnValue({ inspect: vi.fn().mockResolvedValue({ Containers: {} }) });
|
||||
mockDocker.df.mockResolvedValue({
|
||||
Volumes: [{ Name: 'my-stack_data', UsageData: { RefCount: 0, Size: 42 } }],
|
||||
Images: [{ Id: 'sha256:dangling', SharedSize: 10 }],
|
||||
LayersSize: 0,
|
||||
});
|
||||
|
||||
const plan = await DockerController.getInstance(1).buildPrunePlan(
|
||||
['images', 'volumes', 'networks'], 'all', ['my-stack'], 1,
|
||||
);
|
||||
|
||||
expect(plan.items.find((entry) => entry.target === 'images')).toMatchObject({
|
||||
name: '<none>:<none>',
|
||||
managed: true,
|
||||
stackName: 'my-stack',
|
||||
image: {
|
||||
references: [],
|
||||
digest: 'example/app@sha256:digest',
|
||||
createdAt: 1_700_000_000,
|
||||
},
|
||||
});
|
||||
expect(plan.items.find((entry) => entry.target === 'volumes')).toMatchObject({
|
||||
managed: true,
|
||||
stackName: 'my-stack',
|
||||
volume: {
|
||||
driver: 'local',
|
||||
ownershipLabels: { 'com.docker.compose.project': 'my-stack' },
|
||||
},
|
||||
});
|
||||
expect(plan.items.find((entry) => entry.target === 'networks')).toMatchObject({
|
||||
managed: true,
|
||||
stackName: 'my-stack',
|
||||
network: {
|
||||
driver: 'bridge',
|
||||
scope: 'local',
|
||||
ownershipLabels: {
|
||||
'com.docker.compose.project': 'my-stack',
|
||||
'com.docker.compose.network': 'default',
|
||||
},
|
||||
},
|
||||
});
|
||||
expect(JSON.stringify(plan.items)).not.toContain('do-not-return');
|
||||
expect(plan.reclaimableBytes).toBe(
|
||||
plan.items.reduce((sum, entry) => sum + (entry.sizeBytes ?? 0), 0),
|
||||
);
|
||||
});
|
||||
|
||||
it('uses Compose path ownership fallbacks for non-container resources', async () => {
|
||||
const ownershipLabels = {
|
||||
'com.docker.compose.project.working_dir': '/app/compose/my-stack',
|
||||
'com.docker.compose.project.config_files': '/app/compose/my-stack/compose.yml',
|
||||
};
|
||||
mockDocker.listImages.mockResolvedValue([{
|
||||
Id: 'sha256:path-owned', RepoTags: ['example/path:latest'], Size: 100, Containers: 0, Labels: ownershipLabels,
|
||||
}]);
|
||||
mockDocker.listVolumes.mockResolvedValue({ Volumes: [{ Name: 'path_data', Labels: ownershipLabels }] });
|
||||
mockDocker.listNetworks.mockResolvedValue([{ Id: 'path-network', Name: 'path_default', Labels: ownershipLabels }]);
|
||||
mockDocker.getNetwork.mockReturnValue({ inspect: vi.fn().mockResolvedValue({ Containers: {} }) });
|
||||
mockDocker.df.mockResolvedValue({
|
||||
Volumes: [{ Name: 'path_data', UsageData: { RefCount: 0, Size: 42 } }],
|
||||
Images: [{ Id: 'sha256:path-owned', SharedSize: 0 }],
|
||||
LayersSize: 0,
|
||||
});
|
||||
|
||||
const plan = await DockerController.getInstance(1).buildPrunePlan(
|
||||
['images', 'volumes', 'networks'], 'managed', ['my-stack'], 1,
|
||||
);
|
||||
|
||||
expect(plan.items).toHaveLength(3);
|
||||
expect(plan.items.every((entry) => entry.managed && entry.stackName === 'my-stack')).toBe(true);
|
||||
});
|
||||
|
||||
it.each(['__proto__', 'constructor', 'toString', 'prototype'])(
|
||||
'does not attribute inherited project key %s to a managed stack',
|
||||
async (project) => {
|
||||
const labels = { 'com.docker.compose.project': project };
|
||||
mockDocker.listVolumes.mockResolvedValue({ Volumes: [{ Name: `${project}_data`, Labels: labels }] });
|
||||
mockDocker.df.mockResolvedValue({
|
||||
Volumes: [{ Name: `${project}_data`, UsageData: { RefCount: 0, Size: 42 } }],
|
||||
Images: [],
|
||||
LayersSize: 0,
|
||||
});
|
||||
|
||||
const managedPlan = await DockerController.getInstance(1).buildPrunePlan(
|
||||
['volumes'], 'managed', ['my-stack'], 1,
|
||||
);
|
||||
const allPlan = await DockerController.getInstance(1).buildPrunePlan(
|
||||
['volumes'], 'all', ['my-stack'], 1,
|
||||
);
|
||||
|
||||
expect(managedPlan.items).toEqual([]);
|
||||
expect(allPlan.items).toEqual([
|
||||
expect.objectContaining({ id: `${project}_data`, managed: false }),
|
||||
]);
|
||||
expect(allPlan.items[0].stackName).toBeUndefined();
|
||||
},
|
||||
);
|
||||
|
||||
it('does not plan an image referenced by a container when Docker reports Containers as unknown', async () => {
|
||||
mockDocker.listContainers.mockResolvedValue([{ Id: 'container', ImageID: 'sha256:in-use' }]);
|
||||
mockDocker.listImages.mockResolvedValue([{
|
||||
Id: 'sha256:in-use', RepoTags: ['example/in-use:latest'], Size: 100, Containers: -1,
|
||||
}]);
|
||||
mockDocker.df.mockResolvedValue({
|
||||
Volumes: [], Images: [{ Id: 'sha256:in-use', SharedSize: 0 }], LayersSize: 0,
|
||||
});
|
||||
|
||||
const plan = await DockerController.getInstance(1).buildPrunePlan(['images'], 'all', [], 1);
|
||||
expect(plan.items).toEqual([]);
|
||||
});
|
||||
|
||||
it('preserves Compose path ownership fallback during volume and network execution', async () => {
|
||||
const labels = { 'com.docker.compose.project.working_dir': '/app/compose/my-stack' };
|
||||
const volumeRemove = vi.fn().mockResolvedValue(undefined);
|
||||
const networkRemove = vi.fn().mockResolvedValue(undefined);
|
||||
const networkInspect = vi.fn().mockResolvedValue({ Name: 'path_default', Labels: labels, Containers: {} });
|
||||
mockDocker.listVolumes.mockResolvedValue({ Volumes: [{ Name: 'path_data', Labels: labels }] });
|
||||
mockDocker.listNetworks.mockResolvedValue([{ Id: 'path-network', Name: 'path_default', Labels: labels }]);
|
||||
mockDocker.df.mockResolvedValue({
|
||||
Volumes: [{ Name: 'path_data', UsageData: { RefCount: 0, Size: 42 } }], Images: [], LayersSize: 0,
|
||||
});
|
||||
mockDocker.getVolume.mockReturnValue({ remove: volumeRemove });
|
||||
mockDocker.getNetwork.mockReturnValue({ inspect: networkInspect, remove: networkRemove });
|
||||
|
||||
const controller = DockerController.getInstance(1);
|
||||
const plan = await controller.buildPrunePlan(['volumes', 'networks'], 'managed', ['my-stack'], 1);
|
||||
const result = await controller.executePrunePlan(plan, ['my-stack']);
|
||||
|
||||
expect(result.outcomes).toEqual(expect.arrayContaining([
|
||||
expect.objectContaining({ target: 'volumes', status: 'removed' }),
|
||||
expect.objectContaining({ target: 'networks', status: 'removed' }),
|
||||
]));
|
||||
expect(volumeRemove).toHaveBeenCalledWith({ force: false });
|
||||
expect(networkRemove).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('enumerates managed stopped containers and never calls pruneSystem', async () => {
|
||||
mockDocker.listContainers.mockResolvedValue([
|
||||
{
|
||||
|
||||
@@ -16,12 +16,16 @@ let app: import('express').Express;
|
||||
let authHeader: string;
|
||||
let DockerController: typeof import('../services/DockerController').default;
|
||||
let FileSystemService: typeof import('../services/FileSystemService').FileSystemService;
|
||||
let CacheService: typeof import('../services/CacheService').CacheService;
|
||||
let activeBulkActions: typeof import('../helpers/bulkActionLocks').activeBulkActions;
|
||||
|
||||
beforeAll(async () => {
|
||||
tmpDir = await setupTestDb();
|
||||
({ app } = await import('../index'));
|
||||
({ default: DockerController } = await import('../services/DockerController'));
|
||||
({ FileSystemService } = await import('../services/FileSystemService'));
|
||||
({ CacheService } = await import('../services/CacheService'));
|
||||
({ activeBulkActions } = await import('../helpers/bulkActionLocks'));
|
||||
// 10-minute expiry survives the full file even when two timeout tests
|
||||
// burn ~8.5s each in real-timer mode.
|
||||
const token = jwt.sign({ username: TEST_USERNAME }, TEST_JWT_SECRET, { expiresIn: '10m' });
|
||||
@@ -31,6 +35,7 @@ beforeAll(async () => {
|
||||
afterAll(() => cleanupTestDb(tmpDir));
|
||||
|
||||
afterEach(() => {
|
||||
activeBulkActions.clear();
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
@@ -150,6 +155,7 @@ describe('Prune plan routes', () => {
|
||||
buildPrunePlan: vi.fn().mockResolvedValue(plan),
|
||||
executePrunePlan,
|
||||
} as unknown as ReturnType<typeof DockerController.getInstance>);
|
||||
const invalidate = vi.spyOn(CacheService.getInstance(), 'invalidate');
|
||||
|
||||
const res = await request(app)
|
||||
.post('/api/system/prune/system')
|
||||
@@ -161,6 +167,45 @@ describe('Prune plan routes', () => {
|
||||
expect(res.body.reclaimedBytes).toBe(42);
|
||||
expect(res.body.outcomes).toHaveLength(1);
|
||||
expect(executePrunePlan).toHaveBeenCalled();
|
||||
expect(invalidate).toHaveBeenCalledWith('stats:1');
|
||||
expect(invalidate).toHaveBeenCalledWith('stack-statuses:1');
|
||||
});
|
||||
|
||||
it('rejects an overlapping destructive prune on the same node', async () => {
|
||||
stubFsStacks();
|
||||
const plan = samplePlan('fp-lock');
|
||||
let releaseExecution!: () => void;
|
||||
const executionBlocked = new Promise<void>((resolve) => {
|
||||
releaseExecution = resolve;
|
||||
});
|
||||
const executePrunePlan = vi.fn().mockImplementation(async () => {
|
||||
await executionBlocked;
|
||||
return { outcomes: [], reclaimedBytes: 0, success: true };
|
||||
});
|
||||
vi.spyOn(DockerController, 'getInstance').mockReturnValue({
|
||||
buildPrunePlan: vi.fn().mockResolvedValue(plan),
|
||||
executePrunePlan,
|
||||
} as unknown as ReturnType<typeof DockerController.getInstance>);
|
||||
|
||||
const firstRequest = request(app)
|
||||
.post('/api/system/prune/system')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ target: 'volumes', scope: 'managed', planFingerprint: 'fp-lock' });
|
||||
const firstResponse = firstRequest.then((response) => response);
|
||||
await vi.waitFor(() => expect(executePrunePlan).toHaveBeenCalledTimes(1));
|
||||
|
||||
const overlapping = await request(app)
|
||||
.post('/api/system/prune/system')
|
||||
.set('Authorization', authHeader)
|
||||
.send({ target: 'volumes', scope: 'managed', planFingerprint: 'fp-lock' });
|
||||
|
||||
expect(overlapping.status).toBe(409);
|
||||
expect(overlapping.body.code).toBe('PRUNE_ALREADY_RUNNING');
|
||||
expect(executePrunePlan).toHaveBeenCalledTimes(1);
|
||||
|
||||
releaseExecution();
|
||||
expect((await firstResponse).status).toBe(200);
|
||||
expect(activeBulkActions.size).toBe(0);
|
||||
});
|
||||
|
||||
it('POST /api/system/prune/system returns 409 PRUNE_PLAN_STALE on fingerprint mismatch', async () => {
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
// Process-local mutation locks shared by direct node actions and fleet-wide
|
||||
// orchestration. Callers must use the same operation-specific key format.
|
||||
export const activeBulkActions = new Set<string>();
|
||||
@@ -0,0 +1,597 @@
|
||||
import type { Node } from '../services/DatabaseService';
|
||||
import DockerController from '../services/DockerController';
|
||||
import { FileSystemService } from '../services/FileSystemService';
|
||||
import { NodeRegistry } from '../services/NodeRegistry';
|
||||
import { ServiceUpdateRecoveryService } from '../services/ServiceUpdateRecoveryService';
|
||||
import {
|
||||
PrunePlanStaleError,
|
||||
hasOnlyPruneOwnershipLabels,
|
||||
projectPruneOwnershipLabels,
|
||||
type PruneItemOutcome,
|
||||
type PrunePlan,
|
||||
type PrunePlanItem,
|
||||
type PruneScope,
|
||||
} from '../services/prunePlan';
|
||||
import { invalidateNodeCaches } from './cacheInvalidation';
|
||||
import { getErrorMessage } from '../utils/errors';
|
||||
import { TimeoutError, withTimeout } from '../utils/withTimeout';
|
||||
import { formatNoTargetError } from '../utils/remoteTarget';
|
||||
import { sanitizeForLog } from '../utils/safeLog';
|
||||
|
||||
export const FLEET_PRUNE_TARGETS = ['images', 'volumes', 'networks'] as const;
|
||||
export type FleetPruneTarget = (typeof FLEET_PRUNE_TARGETS)[number];
|
||||
|
||||
export interface ReviewedFleetNode {
|
||||
nodeId: number;
|
||||
reachable: boolean;
|
||||
}
|
||||
|
||||
export interface ReviewedFleetPlan {
|
||||
nodeId: number;
|
||||
fingerprint: string;
|
||||
}
|
||||
|
||||
export interface FleetPruneTargetResult {
|
||||
target: FleetPruneTarget;
|
||||
success: boolean;
|
||||
reclaimedBytes: number;
|
||||
dryRun: boolean;
|
||||
removed?: number;
|
||||
skipped?: number;
|
||||
failed?: number;
|
||||
error?: string;
|
||||
}
|
||||
|
||||
export interface FleetPruneNodeResult {
|
||||
nodeId: number;
|
||||
nodeName: string;
|
||||
reachable: boolean;
|
||||
code?: string;
|
||||
error?: string;
|
||||
fingerprint?: string;
|
||||
items?: PrunePlanItem[];
|
||||
reclaimableBytes?: number;
|
||||
reclaimedBytes?: number;
|
||||
outcomes?: PruneItemOutcome[];
|
||||
targets: FleetPruneTargetResult[];
|
||||
}
|
||||
|
||||
export type ParsedFleetPruneRequest = {
|
||||
targets: FleetPruneTarget[];
|
||||
scope: PruneScope;
|
||||
dryRun: boolean;
|
||||
reviewedNodes: ReviewedFleetNode[];
|
||||
plans: ReviewedFleetPlan[];
|
||||
};
|
||||
|
||||
type ParseResult = { request: ParsedFleetPruneRequest } | { error: string };
|
||||
|
||||
type Preflight = {
|
||||
node: Node;
|
||||
reachable: boolean;
|
||||
plan?: PrunePlan;
|
||||
code?: string;
|
||||
error?: string;
|
||||
};
|
||||
|
||||
type FleetPruneResponse = {
|
||||
status: number;
|
||||
body: { error?: string; code?: string; nodeId?: number; results?: FleetPruneNodeResult[] };
|
||||
};
|
||||
|
||||
const PLAN_TIMEOUT_MS = 8_000;
|
||||
const REMOTE_PLAN_TIMEOUT_MS = 120_000;
|
||||
const BUSY_DAEMON_ERROR = 'Docker daemon is busy. Please try again in a moment.';
|
||||
|
||||
function parseTargets(value: unknown): FleetPruneTarget[] | null {
|
||||
if (!Array.isArray(value) || value.length === 0) return null;
|
||||
const targets = new Set<FleetPruneTarget>();
|
||||
for (const target of value) {
|
||||
if (typeof target !== 'string' || !(FLEET_PRUNE_TARGETS as readonly string[]).includes(target)) {
|
||||
return null;
|
||||
}
|
||||
targets.add(target as FleetPruneTarget);
|
||||
}
|
||||
return [...targets];
|
||||
}
|
||||
|
||||
function parseReviewedNodes(value: unknown): ReviewedFleetNode[] | null {
|
||||
if (!Array.isArray(value) || value.length === 0) return null;
|
||||
const parsed: ReviewedFleetNode[] = [];
|
||||
const seen = new Set<number>();
|
||||
for (const entry of value) {
|
||||
if (!entry || typeof entry !== 'object') return null;
|
||||
const { nodeId, reachable } = entry as { nodeId?: unknown; reachable?: unknown };
|
||||
if (!Number.isInteger(nodeId) || typeof reachable !== 'boolean' || seen.has(nodeId as number)) return null;
|
||||
seen.add(nodeId as number);
|
||||
parsed.push({ nodeId: nodeId as number, reachable });
|
||||
}
|
||||
return parsed;
|
||||
}
|
||||
|
||||
function parsePlans(value: unknown): ReviewedFleetPlan[] | null {
|
||||
if (!Array.isArray(value)) return null;
|
||||
const parsed: ReviewedFleetPlan[] = [];
|
||||
const seen = new Set<number>();
|
||||
for (const entry of value) {
|
||||
if (!entry || typeof entry !== 'object') return null;
|
||||
const { nodeId, fingerprint } = entry as { nodeId?: unknown; fingerprint?: unknown };
|
||||
if (!Number.isInteger(nodeId) || typeof fingerprint !== 'string' || fingerprint.trim() === '' || seen.has(nodeId as number)) {
|
||||
return null;
|
||||
}
|
||||
seen.add(nodeId as number);
|
||||
parsed.push({ nodeId: nodeId as number, fingerprint: fingerprint.trim() });
|
||||
}
|
||||
return parsed;
|
||||
}
|
||||
|
||||
export function parseFleetPruneRequest(body: unknown): ParseResult {
|
||||
if (!body || typeof body !== 'object') return { error: 'Request body is required' };
|
||||
const input = body as Record<string, unknown>;
|
||||
const targets = parseTargets(input.targets);
|
||||
if (!targets) return { error: 'targets must be a non-empty array of images, volumes, or networks' };
|
||||
if (input.scope !== 'managed' && input.scope !== 'all') return { error: 'scope must be managed or all' };
|
||||
const scope: PruneScope = input.scope;
|
||||
const dryRun = input.dryRun === true;
|
||||
if (dryRun) return { request: { targets, scope, dryRun, reviewedNodes: [], plans: [] } };
|
||||
const reviewedNodes = parseReviewedNodes(input.reviewedNodes);
|
||||
const plans = parsePlans(input.plans);
|
||||
if (!reviewedNodes || !plans) return { error: 'reviewedNodes and plans are required for fleet prune execution' };
|
||||
return { request: { targets, scope, dryRun, reviewedNodes, plans } };
|
||||
}
|
||||
|
||||
function validateReviewedRoster(
|
||||
nodes: Node[],
|
||||
reviewedNodes: ReviewedFleetNode[],
|
||||
plans: ReviewedFleetPlan[],
|
||||
): string | null {
|
||||
const currentIds = nodes.map((node) => node.id).sort((a, b) => a - b);
|
||||
const reviewedIds = reviewedNodes.map((node) => node.nodeId).sort((a, b) => a - b);
|
||||
if (currentIds.length !== reviewedIds.length || currentIds.some((id, index) => id !== reviewedIds[index])) {
|
||||
return 'The fleet node roster changed after the dry run';
|
||||
}
|
||||
const reachableIds = reviewedNodes.filter((node) => node.reachable).map((node) => node.nodeId).sort((a, b) => a - b);
|
||||
const planIds = plans.map((plan) => plan.nodeId).sort((a, b) => a - b);
|
||||
if (reachableIds.length !== planIds.length || reachableIds.some((id, index) => id !== planIds[index])) {
|
||||
return 'Plans must exactly cover the reachable nodes from the dry run';
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function targetRowsFromPlan(plan: PrunePlan, targets: FleetPruneTarget[]): FleetPruneTargetResult[] {
|
||||
return targets.map((target) => ({
|
||||
target,
|
||||
success: true,
|
||||
reclaimedBytes: plan.items
|
||||
.filter((item) => item.target === target)
|
||||
.reduce((sum, item) => sum + (item.sizeBytes ?? 0), 0),
|
||||
dryRun: true,
|
||||
}));
|
||||
}
|
||||
|
||||
function failedTargetRows(
|
||||
targets: FleetPruneTarget[],
|
||||
error: string,
|
||||
dryRun: boolean,
|
||||
): FleetPruneTargetResult[] {
|
||||
return targets.map((target) => ({ target, success: false, reclaimedBytes: 0, dryRun, error }));
|
||||
}
|
||||
|
||||
function isPrunePlan(
|
||||
value: unknown,
|
||||
targets: FleetPruneTarget[],
|
||||
scope: PruneScope,
|
||||
): value is PrunePlan {
|
||||
if (!value || typeof value !== 'object') return false;
|
||||
const plan = value as Partial<PrunePlan>;
|
||||
const planTargets = Array.isArray(plan.targets) ? plan.targets : [];
|
||||
const requestedTargets = new Set(targets);
|
||||
const uniquePlanTargets = new Set(planTargets);
|
||||
const itemKeys = new Set<string>();
|
||||
const itemBytes = Array.isArray(plan.items)
|
||||
? plan.items.reduce((sum, item) => sum + (typeof item?.sizeBytes === 'number' ? item.sizeBytes : 0), 0)
|
||||
: -1;
|
||||
return plan.scope === scope
|
||||
&& planTargets.length === requestedTargets.size
|
||||
&& uniquePlanTargets.size === requestedTargets.size
|
||||
&& planTargets.every((target) => typeof target === 'string' && requestedTargets.has(target as FleetPruneTarget))
|
||||
&& typeof plan.fingerprint === 'string'
|
||||
&& plan.fingerprint.length > 0
|
||||
&& Number.isInteger(plan.nodeId)
|
||||
&& typeof plan.createdAt === 'number' && Number.isFinite(plan.createdAt) && plan.createdAt >= 0
|
||||
&& typeof plan.reclaimableBytes === 'number' && Number.isFinite(plan.reclaimableBytes) && plan.reclaimableBytes >= 0
|
||||
&& plan.reclaimableBytes === itemBytes
|
||||
&& Array.isArray(plan.items)
|
||||
&& plan.items.every((item) => {
|
||||
if (!isPrunePlanItem(item) || !requestedTargets.has(item.target as FleetPruneTarget)) return false;
|
||||
const key = `${item.target}\0${item.id}`;
|
||||
if (itemKeys.has(key)) return false;
|
||||
itemKeys.add(key);
|
||||
return true;
|
||||
});
|
||||
}
|
||||
|
||||
function isPrunePlanItem(value: unknown): value is PrunePlanItem {
|
||||
if (!value || typeof value !== 'object') return false;
|
||||
const item = value as Record<string, unknown>;
|
||||
const validTarget = typeof item.target === 'string'
|
||||
&& ['images', 'volumes', 'networks', 'containers'].includes(item.target);
|
||||
const validSize = item.sizeBytes === undefined
|
||||
|| (typeof item.sizeBytes === 'number' && Number.isFinite(item.sizeBytes) && item.sizeBytes >= 0);
|
||||
const targetMetadata = item.target === 'images'
|
||||
? Boolean(item.image && typeof item.image === 'object'
|
||||
&& Array.isArray((item.image as { references?: unknown }).references)
|
||||
&& (item.image as { references: unknown[] }).references.every((ref) => typeof ref === 'string'))
|
||||
: item.target === 'volumes'
|
||||
? Boolean(item.volume && typeof item.volume === 'object')
|
||||
: item.target === 'networks'
|
||||
? Boolean(item.network && typeof item.network === 'object')
|
||||
: true;
|
||||
return validTarget
|
||||
&& typeof item.id === 'string'
|
||||
&& typeof item.name === 'string'
|
||||
&& typeof item.managed === 'boolean'
|
||||
&& typeof item.reason === 'string'
|
||||
&& validSize
|
||||
&& targetMetadata
|
||||
&& hasOnlyPruneOwnershipLabels((item.volume as { ownershipLabels?: unknown } | undefined)?.ownershipLabels)
|
||||
&& hasOnlyPruneOwnershipLabels((item.network as { ownershipLabels?: unknown } | undefined)?.ownershipLabels);
|
||||
}
|
||||
|
||||
function projectRemoteItem(item: PrunePlanItem): PrunePlanItem {
|
||||
const base = {
|
||||
id: item.id,
|
||||
name: item.name,
|
||||
managed: item.managed,
|
||||
reason: item.reason,
|
||||
...(typeof item.sizeBytes === 'number' ? { sizeBytes: item.sizeBytes } : {}),
|
||||
...(typeof item.stackName === 'string' ? { stackName: item.stackName } : {}),
|
||||
};
|
||||
if (item.target === 'images') {
|
||||
return { ...base, target: 'images', image: {
|
||||
references: Array.isArray(item.image.references)
|
||||
? item.image.references.filter((reference): reference is string => typeof reference === 'string')
|
||||
: [],
|
||||
...(typeof item.image.digest === 'string' ? { digest: item.image.digest } : {}),
|
||||
...(typeof item.image.createdAt === 'number' ? { createdAt: item.image.createdAt } : {}),
|
||||
} };
|
||||
}
|
||||
if (item.target === 'volumes') {
|
||||
const ownershipLabels = projectPruneOwnershipLabels(item.volume.ownershipLabels);
|
||||
return { ...base, target: 'volumes', volume: {
|
||||
...(typeof item.volume.driver === 'string' ? { driver: item.volume.driver } : {}),
|
||||
...(ownershipLabels ? { ownershipLabels } : {}),
|
||||
} };
|
||||
}
|
||||
if (item.target === 'networks') {
|
||||
const ownershipLabels = projectPruneOwnershipLabels(item.network.ownershipLabels);
|
||||
return { ...base, target: 'networks', network: {
|
||||
...(typeof item.network.driver === 'string' ? { driver: item.network.driver } : {}),
|
||||
...(typeof item.network.scope === 'string' ? { scope: item.network.scope } : {}),
|
||||
...(ownershipLabels ? { ownershipLabels } : {}),
|
||||
} };
|
||||
}
|
||||
return { ...base, target: 'containers' };
|
||||
}
|
||||
|
||||
function projectRemotePlan(plan: PrunePlan): PrunePlan {
|
||||
return {
|
||||
scope: plan.scope,
|
||||
targets: [...plan.targets],
|
||||
items: plan.items.map(projectRemoteItem),
|
||||
reclaimableBytes: plan.reclaimableBytes,
|
||||
fingerprint: plan.fingerprint,
|
||||
createdAt: plan.createdAt,
|
||||
nodeId: plan.nodeId,
|
||||
};
|
||||
}
|
||||
|
||||
function isPruneItemOutcome(value: unknown): value is PruneItemOutcome {
|
||||
if (!value || typeof value !== 'object') return false;
|
||||
const outcome = value as { id?: unknown; target?: unknown; status?: unknown; sizeBytes?: unknown; reason?: unknown; error?: unknown };
|
||||
if (typeof outcome.id !== 'string' || typeof outcome.target !== 'string') return false;
|
||||
if (outcome.status === 'removed') return outcome.sizeBytes === undefined
|
||||
|| (typeof outcome.sizeBytes === 'number' && Number.isFinite(outcome.sizeBytes) && outcome.sizeBytes >= 0);
|
||||
if (outcome.status === 'skipped') return typeof outcome.reason === 'string';
|
||||
if (outcome.status === 'failed') return typeof outcome.error === 'string';
|
||||
return false;
|
||||
}
|
||||
|
||||
function validateRemoteOutcomes(
|
||||
value: unknown,
|
||||
plan: PrunePlan,
|
||||
targets: FleetPruneTarget[],
|
||||
): PruneItemOutcome[] | null {
|
||||
if (!Array.isArray(value) || value.length !== plan.items.length) return null;
|
||||
const requestedTargets = new Set<string>(targets);
|
||||
const expected = new Set(plan.items.map((item) => `${item.target}\0${item.id}`));
|
||||
const seen = new Set<string>();
|
||||
for (const outcome of value) {
|
||||
if (!isPruneItemOutcome(outcome) || !requestedTargets.has(outcome.target)) return null;
|
||||
const key = `${outcome.target}\0${outcome.id}`;
|
||||
if (!expected.has(key) || seen.has(key)) return null;
|
||||
seen.add(key);
|
||||
}
|
||||
return seen.size === expected.size ? value : null;
|
||||
}
|
||||
|
||||
async function buildLocalPreflight(node: Node, targets: FleetPruneTarget[], scope: PruneScope): Promise<Preflight> {
|
||||
try {
|
||||
const knownStacks = await FileSystemService.getInstance(node.id).getStacks();
|
||||
const controller = DockerController.getInstance(node.id);
|
||||
const isImageHeld = ServiceUpdateRecoveryService.getInstance().buildHeldImagePredicate(node.id);
|
||||
const plan = await withTimeout(
|
||||
controller.buildPrunePlan(targets, scope, knownStacks, node.id, isImageHeld),
|
||||
PLAN_TIMEOUT_MS,
|
||||
'docker prune plan',
|
||||
);
|
||||
return { node, reachable: true, plan };
|
||||
} catch (error) {
|
||||
console.error(`[Fleet prune] Plan failed on ${sanitizeForLog(node.name)}: ${sanitizeForLog(getErrorMessage(error, 'Unknown error'))}`);
|
||||
return {
|
||||
node,
|
||||
reachable: true,
|
||||
code: error instanceof TimeoutError ? 'DOCKER_DAEMON_BUSY' : 'PRUNE_PLAN_FAILED',
|
||||
error: error instanceof TimeoutError ? BUSY_DAEMON_ERROR : getErrorMessage(error, 'Failed to build prune plan'),
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
async function fetchRemotePlan(node: Node, targets: FleetPruneTarget[], scope: PruneScope): Promise<Preflight> {
|
||||
const proxyTarget = NodeRegistry.getInstance().getProxyTarget(node.id);
|
||||
if (!proxyTarget) return { node, reachable: false, error: formatNoTargetError(node) };
|
||||
const headers: Record<string, string> = { 'Content-Type': 'application/json' };
|
||||
if (proxyTarget.apiToken) headers.Authorization = `Bearer ${proxyTarget.apiToken}`;
|
||||
try {
|
||||
const response = await fetch(`${proxyTarget.apiUrl.replace(/\/$/, '')}/api/system/prune/plan`, {
|
||||
method: 'POST',
|
||||
headers,
|
||||
body: JSON.stringify({ targets, scope }),
|
||||
signal: AbortSignal.timeout(REMOTE_PLAN_TIMEOUT_MS),
|
||||
});
|
||||
const data: unknown = await response.json().catch(() => null);
|
||||
if (!response.ok) {
|
||||
const message = data && typeof data === 'object' && typeof (data as { error?: unknown }).error === 'string'
|
||||
? (data as { error: string }).error
|
||||
: `Remote returned ${response.status}`;
|
||||
return { node, reachable: true, code: 'REMOTE_PLAN_FAILED', error: message };
|
||||
}
|
||||
if (!isPrunePlan(data, targets, scope)) {
|
||||
return { node, reachable: true, code: 'REMOTE_PLAN_INVALID', error: 'Remote returned a malformed prune plan' };
|
||||
}
|
||||
return { node, reachable: true, plan: projectRemotePlan(data) };
|
||||
} catch (error) {
|
||||
console.error(`[Fleet prune] Remote plan transport failed for ${sanitizeForLog(node.name)}: ${sanitizeForLog(getErrorMessage(error, 'Unknown error'))}`);
|
||||
return { node, reachable: false, error: getErrorMessage(error, 'Failed to reach remote node') };
|
||||
}
|
||||
}
|
||||
|
||||
function buildPreflight(node: Node, targets: FleetPruneTarget[], scope: PruneScope): Promise<Preflight> {
|
||||
return node.type === 'local'
|
||||
? buildLocalPreflight(node, targets, scope)
|
||||
: fetchRemotePlan(node, targets, scope);
|
||||
}
|
||||
|
||||
function preflightResult(entry: Preflight, targets: FleetPruneTarget[]): FleetPruneNodeResult {
|
||||
if (entry.plan) {
|
||||
return {
|
||||
nodeId: entry.node.id,
|
||||
nodeName: entry.node.name,
|
||||
reachable: true,
|
||||
fingerprint: entry.plan.fingerprint,
|
||||
items: entry.plan.items,
|
||||
reclaimableBytes: entry.plan.reclaimableBytes,
|
||||
targets: targetRowsFromPlan(entry.plan, targets),
|
||||
};
|
||||
}
|
||||
const error = entry.error ?? 'Failed to build prune plan';
|
||||
return {
|
||||
nodeId: entry.node.id,
|
||||
nodeName: entry.node.name,
|
||||
reachable: entry.reachable,
|
||||
code: entry.code,
|
||||
error,
|
||||
reclaimableBytes: 0,
|
||||
targets: failedTargetRows(targets, error, true),
|
||||
};
|
||||
}
|
||||
|
||||
function outcomeTargetRows(
|
||||
targets: FleetPruneTarget[],
|
||||
outcomes: PruneItemOutcome[],
|
||||
fallbackSuccess = true,
|
||||
): FleetPruneTargetResult[] {
|
||||
return targets.map((target) => {
|
||||
const targetOutcomes = outcomes.filter((outcome) => outcome.target === target);
|
||||
const failed = targetOutcomes.filter((outcome) => outcome.status === 'failed');
|
||||
const skipped = targetOutcomes.filter((outcome) => outcome.status === 'skipped');
|
||||
const removed = targetOutcomes.filter((outcome) => outcome.status === 'removed');
|
||||
const removedBytes = removed.reduce((sum, outcome) => sum + (outcome.status === 'removed' ? outcome.sizeBytes ?? 0 : 0), 0);
|
||||
return {
|
||||
target,
|
||||
success: outcomes.length === 0 ? fallbackSuccess : failed.length === 0,
|
||||
reclaimedBytes: outcomes.length === 0 ? 0 : removedBytes,
|
||||
dryRun: false,
|
||||
removed: removed.length,
|
||||
skipped: skipped.length,
|
||||
failed: failed.length,
|
||||
error: failed.length > 0 ? failed.map((outcome) => outcome.status === 'failed' ? outcome.error : '').filter(Boolean).join('; ') : undefined,
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
async function executeLocal(entry: Preflight, targets: FleetPruneTarget[]): Promise<FleetPruneNodeResult> {
|
||||
try {
|
||||
const plan = entry.plan;
|
||||
if (!plan) throw new Error('Local prune preflight is missing');
|
||||
const knownStacks = await FileSystemService.getInstance(entry.node.id).getStacks();
|
||||
const isImageHeld = ServiceUpdateRecoveryService.getInstance().buildHeldImagePredicate(entry.node.id);
|
||||
const result = await DockerController.getInstance(entry.node.id).executePrunePlan(plan, knownStacks, isImageHeld);
|
||||
if (result.outcomes.some((outcome) => outcome.status === 'removed')) {
|
||||
try {
|
||||
invalidateNodeCaches(entry.node.id);
|
||||
} catch (error) {
|
||||
console.error(`[Fleet prune] Cache invalidation failed on ${sanitizeForLog(entry.node.name)}: ${sanitizeForLog(getErrorMessage(error, 'Unknown error'))}`);
|
||||
}
|
||||
}
|
||||
return {
|
||||
nodeId: entry.node.id,
|
||||
nodeName: entry.node.name,
|
||||
reachable: true,
|
||||
reclaimedBytes: result.reclaimedBytes,
|
||||
outcomes: result.outcomes,
|
||||
targets: outcomeTargetRows(targets, result.outcomes),
|
||||
};
|
||||
} catch (error) {
|
||||
console.error(`[Fleet prune] Execution failed on ${sanitizeForLog(entry.node.name)}: ${sanitizeForLog(getErrorMessage(error, 'Unknown error'))}`);
|
||||
const stale = error instanceof PrunePlanStaleError;
|
||||
const message = getErrorMessage(error, stale ? 'Prune plan changed' : 'Prune failed');
|
||||
return {
|
||||
nodeId: entry.node.id,
|
||||
nodeName: entry.node.name,
|
||||
reachable: true,
|
||||
code: stale ? 'PRUNE_PLAN_STALE' : 'PRUNE_EXECUTE_FAILED',
|
||||
error: message,
|
||||
reclaimedBytes: 0,
|
||||
targets: failedTargetRows(targets, message, false),
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
async function executeRemote(entry: Preflight, targets: FleetPruneTarget[], scope: PruneScope): Promise<FleetPruneNodeResult> {
|
||||
const plan = entry.plan;
|
||||
const proxyTarget = NodeRegistry.getInstance().getProxyTarget(entry.node.id);
|
||||
if (!plan || !proxyTarget) {
|
||||
const error = 'Node became unreachable after fleet preflight';
|
||||
return {
|
||||
nodeId: entry.node.id, nodeName: entry.node.name, reachable: false, error,
|
||||
reclaimedBytes: 0, targets: failedTargetRows(targets, error, false),
|
||||
};
|
||||
}
|
||||
const headers: Record<string, string> = { 'Content-Type': 'application/json' };
|
||||
if (proxyTarget.apiToken) headers.Authorization = `Bearer ${proxyTarget.apiToken}`;
|
||||
try {
|
||||
const response = await fetch(`${proxyTarget.apiUrl.replace(/\/$/, '')}/api/system/prune/system`, {
|
||||
method: 'POST',
|
||||
headers,
|
||||
body: JSON.stringify({ targets, scope, planFingerprint: plan.fingerprint }),
|
||||
signal: AbortSignal.timeout(REMOTE_PLAN_TIMEOUT_MS),
|
||||
});
|
||||
const data: unknown = await response.json().catch(() => null);
|
||||
const record = data && typeof data === 'object' ? data as Record<string, unknown> : null;
|
||||
if (!response.ok) {
|
||||
const message = typeof record?.error === 'string' ? record.error : `Remote returned ${response.status}`;
|
||||
return {
|
||||
nodeId: entry.node.id, nodeName: entry.node.name, reachable: true,
|
||||
code: typeof record?.code === 'string' ? record.code : 'REMOTE_PRUNE_FAILED',
|
||||
error: message, reclaimedBytes: 0, targets: failedTargetRows(targets, message, false),
|
||||
};
|
||||
}
|
||||
if (!record || typeof record.reclaimedBytes !== 'number' || !Number.isFinite(record.reclaimedBytes)
|
||||
|| record.reclaimedBytes < 0 || (record.success !== undefined && typeof record.success !== 'boolean')) {
|
||||
const error = 'Remote returned a malformed prune result';
|
||||
return {
|
||||
nodeId: entry.node.id, nodeName: entry.node.name, reachable: true,
|
||||
code: 'REMOTE_PRUNE_INVALID', error, reclaimedBytes: 0, targets: failedTargetRows(targets, error, false),
|
||||
};
|
||||
}
|
||||
const hasOutcomes = Object.prototype.hasOwnProperty.call(record, 'outcomes');
|
||||
const outcomes = hasOutcomes ? validateRemoteOutcomes(record.outcomes, plan, targets) : undefined;
|
||||
if (hasOutcomes && !outcomes) {
|
||||
const error = 'Remote returned malformed or incomplete prune outcomes';
|
||||
return {
|
||||
nodeId: entry.node.id, nodeName: entry.node.name, reachable: true,
|
||||
code: 'REMOTE_PRUNE_INVALID', error, reclaimedBytes: 0, targets: failedTargetRows(targets, error, false),
|
||||
};
|
||||
}
|
||||
return {
|
||||
nodeId: entry.node.id,
|
||||
nodeName: entry.node.name,
|
||||
reachable: true,
|
||||
reclaimedBytes: record.reclaimedBytes,
|
||||
outcomes: outcomes ?? undefined,
|
||||
targets: outcomeTargetRows(targets, outcomes ?? [], record.success !== false),
|
||||
};
|
||||
} catch (error) {
|
||||
const message = getErrorMessage(error, 'Failed to reach remote node');
|
||||
console.error(`[Fleet prune] Remote execution transport failed for ${sanitizeForLog(entry.node.name)}: ${sanitizeForLog(message)}`);
|
||||
return {
|
||||
nodeId: entry.node.id, nodeName: entry.node.name, reachable: false,
|
||||
error: message, reclaimedBytes: 0, targets: failedTargetRows(targets, message, false),
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
function comparePreflight(
|
||||
preflights: Preflight[],
|
||||
reviewedNodes: ReviewedFleetNode[],
|
||||
plans: ReviewedFleetPlan[],
|
||||
): { code: string; error: string; nodeId?: number } | null {
|
||||
const reviewedById = new Map(reviewedNodes.map((node) => [node.nodeId, node]));
|
||||
const plansById = new Map(plans.map((plan) => [plan.nodeId, plan]));
|
||||
for (const entry of preflights) {
|
||||
const reviewed = reviewedById.get(entry.node.id);
|
||||
if (!reviewed) return { code: 'PRUNE_NODE_ROSTER_CHANGED', error: 'The fleet node roster changed after the dry run' };
|
||||
if (entry.reachable !== reviewed.reachable) {
|
||||
return {
|
||||
code: 'PRUNE_NODE_REACHABILITY_CHANGED',
|
||||
nodeId: entry.node.id,
|
||||
error: `Reachability changed for ${entry.node.name} after the dry run`,
|
||||
};
|
||||
}
|
||||
if (!reviewed.reachable) continue;
|
||||
if (!entry.plan) {
|
||||
return {
|
||||
code: entry.code ?? 'PRUNE_PLAN_FAILED',
|
||||
nodeId: entry.node.id,
|
||||
error: entry.error ?? `Failed to rebuild the plan for ${entry.node.name}`,
|
||||
};
|
||||
}
|
||||
if (entry.plan.fingerprint !== plansById.get(entry.node.id)?.fingerprint) {
|
||||
return {
|
||||
code: 'PRUNE_PLAN_STALE',
|
||||
nodeId: entry.node.id,
|
||||
error: `The prune plan changed on ${entry.node.name} after the dry run`,
|
||||
};
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
export async function runFleetPrune(
|
||||
nodes: Node[],
|
||||
request: ParsedFleetPruneRequest,
|
||||
activeLocks: Set<string>,
|
||||
): Promise<FleetPruneResponse> {
|
||||
if (request.dryRun) {
|
||||
const preflights = await Promise.all(nodes.map((node) => buildPreflight(node, request.targets, request.scope)));
|
||||
return { status: 200, body: { results: preflights.map((entry) => preflightResult(entry, request.targets)) } };
|
||||
}
|
||||
|
||||
const rosterError = validateReviewedRoster(nodes, request.reviewedNodes, request.plans);
|
||||
if (rosterError) return { status: 409, body: { code: 'PRUNE_NODE_ROSTER_CHANGED', error: rosterError } };
|
||||
|
||||
const lockKeys = nodes.filter((node) => node.type === 'local').map((node) => `bulk-prune:${node.id}`);
|
||||
const busyKey = lockKeys.find((key) => activeLocks.has(key));
|
||||
if (busyKey) return { status: 409, body: { code: 'PRUNE_ALREADY_RUNNING', error: 'A prune is already running on a reviewed node' } };
|
||||
for (const key of lockKeys) activeLocks.add(key);
|
||||
|
||||
try {
|
||||
const preflights = await Promise.all(nodes.map((node) => buildPreflight(node, request.targets, request.scope)));
|
||||
const conflict = comparePreflight(preflights, request.reviewedNodes, request.plans);
|
||||
if (conflict) {
|
||||
return {
|
||||
status: 409,
|
||||
body: { ...conflict, results: preflights.map((entry) => preflightResult(entry, request.targets)) },
|
||||
};
|
||||
}
|
||||
const reviewedReachable = new Set(request.reviewedNodes.filter((node) => node.reachable).map((node) => node.nodeId));
|
||||
const executable = preflights.filter((entry) => reviewedReachable.has(entry.node.id));
|
||||
const results = await Promise.all(executable.map((entry) => entry.node.type === 'local'
|
||||
? executeLocal(entry, request.targets)
|
||||
: executeRemote(entry, request.targets, request.scope)));
|
||||
return { status: 200, body: { results } };
|
||||
} finally {
|
||||
for (const key of lockKeys) activeLocks.delete(key);
|
||||
}
|
||||
}
|
||||
+19
-158
@@ -10,7 +10,6 @@ import { FleetUpdateTrackerService, type UpdateTracker, type TerminalStatus, UPD
|
||||
import { NodeRegistry } from '../services/NodeRegistry';
|
||||
import { computeNodeNetworkingSummary, type NodeNetworkingSummary } from '../services/network/networkingSummary';
|
||||
import DockerController from '../services/DockerController';
|
||||
import { ServiceUpdateRecoveryService } from '../services/ServiceUpdateRecoveryService';
|
||||
import { getHostMemory } from '../helpers/hostMemory';
|
||||
import { FileSystemService } from '../services/FileSystemService';
|
||||
import { ComposeService } from '../services/ComposeService';
|
||||
@@ -47,8 +46,14 @@ import { sanitizeForLog, redactSensitiveText } from '../utils/safeLog';
|
||||
import { formatNoTargetError } from '../utils/remoteTarget';
|
||||
import { CloudBackupService } from '../services/CloudBackupService';
|
||||
import { NotificationService } from '../services/NotificationService';
|
||||
import { invalidateNodeCaches, invalidateRemoteMetaCache } from '../helpers/cacheInvalidation';
|
||||
import { invalidateRemoteMetaCache } from '../helpers/cacheInvalidation';
|
||||
import { activeBulkActions } from './labels';
|
||||
import {
|
||||
FLEET_PRUNE_TARGETS,
|
||||
parseFleetPruneRequest,
|
||||
runFleetPrune,
|
||||
type FleetPruneTarget,
|
||||
} from '../helpers/fleetPrune';
|
||||
import { runLocalLabelStop, isLabelLocalStopResponse, type StackStopResult } from '../helpers/fleetLabelStop';
|
||||
import { collectFleetLabelSummaries } from '../helpers/fleetLabelSummary';
|
||||
import { runLocalLabelAssign, validateLabelTemplate, validateRemoteAssignResults, failAllAssign, type AssignNodeResult } from '../helpers/fleetLabelAssign';
|
||||
@@ -2202,167 +2207,23 @@ fleetRouter.post('/labels/bulk-assign', authMiddleware, async (req: Request, res
|
||||
}
|
||||
});
|
||||
|
||||
// Fleet-wide Docker prune. Fans out to every node, running per-target prune
|
||||
// (images/volumes/networks) under the chosen scope. Local nodes call
|
||||
// DockerController directly under a per-node bulk-prune lock; remote nodes
|
||||
// receive one POST /api/system/prune/system per target via the standard
|
||||
// Bearer-token path. Concurrent execution against the per-node prune route in
|
||||
// systemMaintenance.ts is safe because Docker's prune API is internally
|
||||
// serialized and idempotent (the worst case is a duplicate call returning 0
|
||||
// reclaimed bytes).
|
||||
// Fleet-wide Docker prune. Dry runs collect one itemized plan per node. Execute
|
||||
// validates the reviewed roster, preflights every plan, then starts mutation.
|
||||
// Tier: requireAdmin (admin-only fleet plumbing; available on every license).
|
||||
const FLEET_PRUNE_TARGETS = ['images', 'volumes', 'networks'] as const;
|
||||
type FleetPruneTarget = (typeof FLEET_PRUNE_TARGETS)[number];
|
||||
|
||||
fleetRouter.post('/labels/fleet-prune', authMiddleware, async (req: Request, res: Response): Promise<void> => {
|
||||
if (!requireAdmin(req, res)) return;
|
||||
|
||||
const body = req.body as { targets?: unknown; scope?: unknown; dryRun?: unknown } | undefined;
|
||||
if (!body || typeof body !== 'object') {
|
||||
res.status(400).json({ error: 'Request body is required' });
|
||||
return;
|
||||
}
|
||||
const rawTargets = Array.isArray(body.targets) ? body.targets : null;
|
||||
if (!rawTargets || rawTargets.length === 0) {
|
||||
res.status(400).json({ error: 'targets must be a non-empty array' });
|
||||
return;
|
||||
}
|
||||
const dedup = new Set<FleetPruneTarget>();
|
||||
for (const t of rawTargets) {
|
||||
if (typeof t !== 'string' || !(FLEET_PRUNE_TARGETS as readonly string[]).includes(t)) {
|
||||
res.status(400).json({ error: `Invalid target: ${typeof t === 'string' ? t : typeof t}` });
|
||||
try {
|
||||
const parsed = parseFleetPruneRequest(req.body);
|
||||
if ('error' in parsed) {
|
||||
res.status(400).json({ error: parsed.error });
|
||||
return;
|
||||
}
|
||||
dedup.add(t as FleetPruneTarget);
|
||||
}
|
||||
const targets: FleetPruneTarget[] = Array.from(dedup);
|
||||
const scope: 'managed' | 'all' = body.scope === 'all' ? 'all' : 'managed';
|
||||
const isDryRun = body.dryRun === true;
|
||||
|
||||
type TargetResult = { target: FleetPruneTarget; success: boolean; reclaimedBytes: number; error?: string; dryRun?: boolean };
|
||||
type NodeResult = {
|
||||
nodeId: number; nodeName: string; reachable: boolean; error?: string; targets: TargetResult[];
|
||||
};
|
||||
|
||||
try {
|
||||
const db = DatabaseService.getInstance();
|
||||
const nodes = db.getNodes();
|
||||
if (isDebugEnabled()) console.debug('[Fleet:debug] fleet-prune:', { targets, scope, dryRun: isDryRun, nodes: nodes.length });
|
||||
|
||||
const results: NodeResult[] = await Promise.all(nodes.map(async (node): Promise<NodeResult> => {
|
||||
if (node.type === 'local') {
|
||||
const lockKey = `bulk-prune:${node.id}`;
|
||||
if (activeBulkActions.has(lockKey)) {
|
||||
return {
|
||||
nodeId: node.id, nodeName: node.name, reachable: true,
|
||||
targets: targets.map(t => ({ target: t, success: false, reclaimedBytes: 0, error: 'A prune is already running on this node' })),
|
||||
};
|
||||
}
|
||||
activeBulkActions.add(lockKey);
|
||||
try {
|
||||
const knownStacks = scope === 'managed' ? await FileSystemService.getInstance(node.id).getStacks() : [];
|
||||
const dockerController = DockerController.getInstance(node.id);
|
||||
const targetResults: TargetResult[] = [];
|
||||
let anySuccess = false;
|
||||
for (const target of targets) {
|
||||
try {
|
||||
if (isDryRun) {
|
||||
// estimateSystemReclaim hits `docker system df`; bound it
|
||||
// so a slow local daemon doesn't hang the fleet admin tab
|
||||
// (F-6). estimateManagedReclaim is fast (no df) and stays
|
||||
// unwrapped.
|
||||
const estimate = scope === 'managed'
|
||||
? await dockerController.estimateManagedReclaim(target, knownStacks)
|
||||
: await withTimeout(
|
||||
dockerController.estimateSystemReclaim(target, knownStacks),
|
||||
FLEET_DF_TIMEOUT_MS,
|
||||
'docker disk usage',
|
||||
);
|
||||
targetResults.push({ target, success: true, reclaimedBytes: estimate.reclaimableBytes, dryRun: true });
|
||||
continue;
|
||||
}
|
||||
const isImageHeld = ServiceUpdateRecoveryService.getInstance().buildHeldImagePredicate(node.id);
|
||||
const result = scope === 'managed'
|
||||
? await dockerController.pruneManagedOnly(target, knownStacks, isImageHeld)
|
||||
: await dockerController.pruneSystem(target, undefined, isImageHeld);
|
||||
targetResults.push({ target, success: true, reclaimedBytes: result.reclaimedBytes });
|
||||
if (result.reclaimedBytes > 0 || result.success) anySuccess = true;
|
||||
} catch (err) {
|
||||
const error = err instanceof TimeoutError
|
||||
? 'Docker daemon is busy. Please try again in a moment.'
|
||||
: getErrorMessage(err, 'Prune failed');
|
||||
targetResults.push({ target, success: false, reclaimedBytes: 0, error });
|
||||
}
|
||||
}
|
||||
if (anySuccess && !isDryRun) invalidateNodeCaches(node.id);
|
||||
return { nodeId: node.id, nodeName: node.name, reachable: true, targets: targetResults };
|
||||
} finally {
|
||||
activeBulkActions.delete(lockKey);
|
||||
}
|
||||
}
|
||||
|
||||
// Remote node: POST /api/system/prune/system per target, short-circuiting
|
||||
// on the first transport-level failure so we don't hammer a dead node.
|
||||
const proxyTarget = NodeRegistry.getInstance().getProxyTarget(node.id);
|
||||
if (!proxyTarget) {
|
||||
const error = formatNoTargetError(node);
|
||||
return {
|
||||
nodeId: node.id, nodeName: node.name, reachable: false, error,
|
||||
targets: targets.map(t => ({ target: t, success: false, reclaimedBytes: 0, error })),
|
||||
};
|
||||
}
|
||||
const baseUrl = proxyTarget.apiUrl.replace(/\/$/, '');
|
||||
const remoteHeaders: Record<string, string> = { 'Content-Type': 'application/json' };
|
||||
if (proxyTarget.apiToken) remoteHeaders.Authorization = `Bearer ${proxyTarget.apiToken}`;
|
||||
const targetResults: TargetResult[] = [];
|
||||
let nodeUnreachable: string | null = null;
|
||||
for (const target of targets) {
|
||||
if (nodeUnreachable) {
|
||||
targetResults.push({ target, success: false, reclaimedBytes: 0, error: nodeUnreachable });
|
||||
continue;
|
||||
}
|
||||
try {
|
||||
const response = await fetch(`${baseUrl}/api/system/prune/system`, {
|
||||
method: 'POST',
|
||||
headers: remoteHeaders,
|
||||
body: JSON.stringify({ target, scope, dryRun: isDryRun }),
|
||||
signal: AbortSignal.timeout(120000),
|
||||
});
|
||||
if (!response.ok) {
|
||||
const errBody = (await response.json().catch(() => ({}))) as { error?: string };
|
||||
const message = errBody.error || `Remote returned ${response.status}`;
|
||||
nodeUnreachable = message;
|
||||
targetResults.push({ target, success: false, reclaimedBytes: 0, error: message });
|
||||
continue;
|
||||
}
|
||||
const remote = (await response.json().catch(() => null)) as { success?: boolean; reclaimedBytes?: number; dryRun?: boolean } | null;
|
||||
if (!remote || typeof remote.reclaimedBytes !== 'number') {
|
||||
targetResults.push({ target, success: false, reclaimedBytes: 0, error: 'Invalid response from remote node' });
|
||||
continue;
|
||||
}
|
||||
const entry: TargetResult = { target, success: remote.success !== false, reclaimedBytes: remote.reclaimedBytes };
|
||||
if (remote.dryRun) entry.dryRun = true;
|
||||
targetResults.push(entry);
|
||||
} catch (err) {
|
||||
const message = getErrorMessage(err, 'Failed to reach remote node');
|
||||
nodeUnreachable = message;
|
||||
targetResults.push({ target, success: false, reclaimedBytes: 0, error: message });
|
||||
}
|
||||
}
|
||||
return {
|
||||
nodeId: node.id, nodeName: node.name,
|
||||
reachable: nodeUnreachable === null,
|
||||
error: nodeUnreachable ?? undefined,
|
||||
targets: targetResults,
|
||||
};
|
||||
}));
|
||||
|
||||
if (isDebugEnabled()) {
|
||||
const reachable = results.filter(r => r.reachable).length;
|
||||
const reclaimed = results.reduce((n, r) => n + r.targets.reduce((m, t) => m + t.reclaimedBytes, 0), 0);
|
||||
console.debug('[Fleet:debug] fleet-prune complete:', { reachable, unreachable: results.length - reachable, reclaimedBytes: reclaimed });
|
||||
}
|
||||
res.json({ results });
|
||||
const response = await runFleetPrune(
|
||||
DatabaseService.getInstance().getNodes(),
|
||||
parsed.request,
|
||||
activeBulkActions,
|
||||
);
|
||||
res.status(response.status).json(response.body);
|
||||
} catch (error) {
|
||||
console.error('[Fleet] fleet-prune error:', error);
|
||||
res.status(500).json({ error: getErrorMessage(error, 'Failed to run fleet prune') });
|
||||
|
||||
@@ -16,12 +16,11 @@ import { isDebugEnabled } from '../utils/debug';
|
||||
import { getErrorMessage, isSqliteUniqueViolation } from '../utils/errors';
|
||||
import { parseIntParam } from '../utils/parseIntParam';
|
||||
import { sanitizeForLog } from '../utils/safeLog';
|
||||
import { activeBulkActions } from '../helpers/bulkActionLocks';
|
||||
|
||||
// Module-scope lock shared by `POST /api/labels/:id/action` and the fleet-wide
|
||||
// bulk endpoints in `routes/fleet.ts`. Keyed by `${nodeId}` so concurrent bulk
|
||||
// actions targeting the same node serialize and a fleet-stop cannot race a
|
||||
// per-label action on the same containers.
|
||||
export const activeBulkActions = new Set<string>();
|
||||
// Shared with the fleet-wide bulk endpoints. Label actions use `${nodeId}` so
|
||||
// a fleet stop cannot race a per-label action on the same containers.
|
||||
export { activeBulkActions };
|
||||
|
||||
export const labelsRouter = Router();
|
||||
|
||||
|
||||
@@ -12,6 +12,7 @@ import { ServiceUpdateRecoveryService } from '../services/ServiceUpdateRecoveryS
|
||||
import SelfIdentityService from '../services/SelfIdentityService';
|
||||
import { requireAdmin } from '../middleware/tierGates';
|
||||
import { invalidateNodeCaches } from '../helpers/cacheInvalidation';
|
||||
import { activeBulkActions } from '../helpers/bulkActionLocks';
|
||||
import { isValidDockerResourceId, isValidCidr, isValidIPv4 } from '../utils/validation';
|
||||
import { isDebugEnabled } from '../utils/debug';
|
||||
import { getErrorMessage } from '../utils/errors';
|
||||
@@ -155,6 +156,7 @@ systemMaintenanceRouter.post('/prune/plan', async (req: Request, res: Response)
|
||||
|
||||
systemMaintenanceRouter.post('/prune/system', async (req: Request, res: Response) => {
|
||||
if (!requireAdmin(req, res)) return;
|
||||
let pruneLockHeld = false;
|
||||
try {
|
||||
const body = req.body as {
|
||||
target?: unknown;
|
||||
@@ -200,8 +202,17 @@ systemMaintenanceRouter.post('/prune/system', async (req: Request, res: Response
|
||||
return;
|
||||
}
|
||||
|
||||
// Resources path: fingerprint-bound execute. Fleet still calls without a
|
||||
// fingerprint and keeps the legacy pruneManagedOnly / pruneSystem path.
|
||||
const pruneLockKey = `bulk-prune:${req.nodeId}`;
|
||||
if (activeBulkActions.has(pruneLockKey)) {
|
||||
return res.status(409).json({
|
||||
error: 'A prune is already running on this node',
|
||||
code: 'PRUNE_ALREADY_RUNNING',
|
||||
});
|
||||
}
|
||||
activeBulkActions.add(pruneLockKey);
|
||||
pruneLockHeld = true;
|
||||
|
||||
// Fingerprint-bound execute used by Resources and Fleet.
|
||||
if (planFingerprint) {
|
||||
const built = await withTimeout(
|
||||
dockerController.buildPrunePlan(targets, pruneScope, knownStacks, req.nodeId, isImageHeld),
|
||||
@@ -231,7 +242,7 @@ systemMaintenanceRouter.post('/prune/system', async (req: Request, res: Response
|
||||
success: result.success,
|
||||
});
|
||||
}
|
||||
if (built.targets.includes('containers')) {
|
||||
if (result.outcomes.some((outcome) => outcome.status === 'removed')) {
|
||||
invalidateNodeCaches(req.nodeId);
|
||||
}
|
||||
res.json({
|
||||
@@ -288,6 +299,8 @@ systemMaintenanceRouter.post('/prune/system', async (req: Request, res: Response
|
||||
}
|
||||
console.error('System prune error:', error);
|
||||
res.status(500).json({ error: 'System prune failed' });
|
||||
} finally {
|
||||
if (pruneLockHeld) activeBulkActions.delete(`bulk-prune:${req.nodeId}`);
|
||||
}
|
||||
});
|
||||
|
||||
|
||||
@@ -13,6 +13,7 @@ import SelfIdentityService from './SelfIdentityService';
|
||||
import {
|
||||
fingerprintPrunePlan,
|
||||
normalizePruneTargets,
|
||||
projectPruneOwnershipLabels,
|
||||
PRUNEABLE_CONTAINER_STATES,
|
||||
PrunePlanStaleError,
|
||||
type PruneItemOutcome,
|
||||
@@ -921,17 +922,18 @@ class DockerController {
|
||||
if (selfIdentity.isOwnContainer(c.Id)) continue;
|
||||
const state = String(c.State ?? '').toLowerCase();
|
||||
if (!PRUNEABLE_CONTAINER_STATES.has(state)) continue;
|
||||
if (scope === 'managed') {
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
c.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (!stack) continue;
|
||||
}
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
c.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (scope === 'managed' && !stack) continue;
|
||||
items.push({
|
||||
target: 'containers',
|
||||
id: c.Id,
|
||||
name: containerName(c),
|
||||
sizeBytes: typeof c.SizeRw === 'number' && c.SizeRw > 0 ? c.SizeRw : undefined,
|
||||
managed: Boolean(stack),
|
||||
reason: `Container is ${state} and no longer running`,
|
||||
stackName: stack ?? undefined,
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -946,23 +948,29 @@ class DockerController {
|
||||
const rawVolumeData = await this.docker.listVolumes();
|
||||
const rawVolumes = (this.validateApiData<{ Volumes?: Array<{
|
||||
Name: string;
|
||||
Driver?: string;
|
||||
Labels?: Record<string, string>;
|
||||
}> }>(rawVolumeData)).Volumes || [];
|
||||
for (const vol of rawVolumes) {
|
||||
if (selfIdentity.isOwnVolume(vol.Name)) continue;
|
||||
const usage = volumeUsage.get(vol.Name);
|
||||
if (!usage || usage.refCount !== 0) continue;
|
||||
if (scope === 'managed') {
|
||||
const stack = DockerController.resolveProjectLabel(
|
||||
vol.Labels?.['com.docker.compose.project'], knownSet, projectToStack,
|
||||
);
|
||||
if (!stack) continue;
|
||||
}
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
vol.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (scope === 'managed' && !stack) continue;
|
||||
items.push({
|
||||
target: 'volumes',
|
||||
id: vol.Name,
|
||||
name: vol.Name,
|
||||
sizeBytes: usage.size > 0 ? usage.size : undefined,
|
||||
managed: Boolean(stack),
|
||||
reason: 'Volume is not referenced by any container',
|
||||
stackName: stack ?? undefined,
|
||||
volume: {
|
||||
driver: vol.Driver,
|
||||
ownershipLabels: projectPruneOwnershipLabels(vol.Labels),
|
||||
},
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -971,6 +979,8 @@ class DockerController {
|
||||
const rawNetworks = await this.docker.listNetworks() as Array<{
|
||||
Id: string;
|
||||
Name: string;
|
||||
Driver?: string;
|
||||
Scope?: string;
|
||||
Labels?: Record<string, string>;
|
||||
}>;
|
||||
const networksInUse = new Set<string>();
|
||||
@@ -998,19 +1008,30 @@ class DockerController {
|
||||
);
|
||||
continue;
|
||||
}
|
||||
if (scope === 'managed') {
|
||||
const stack = DockerController.resolveProjectLabel(
|
||||
net.Labels?.['com.docker.compose.project'], knownSet, projectToStack,
|
||||
);
|
||||
if (!stack) continue;
|
||||
}
|
||||
items.push({ target: 'networks', id: net.Id, name: net.Name });
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
net.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (scope === 'managed' && !stack) continue;
|
||||
items.push({
|
||||
target: 'networks',
|
||||
id: net.Id,
|
||||
name: net.Name,
|
||||
managed: Boolean(stack),
|
||||
reason: 'Network has no attached containers',
|
||||
stackName: stack ?? undefined,
|
||||
network: {
|
||||
driver: net.Driver,
|
||||
scope: net.Scope,
|
||||
ownershipLabels: projectPruneOwnershipLabels(net.Labels),
|
||||
},
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
if (ordered.includes('images')) {
|
||||
const unmanagedImageIds = new Set<string>();
|
||||
const managedImageIds = new Set<string>();
|
||||
const imageToStack = new Map<string, string>();
|
||||
const imageToContainerIds = new Map<string, string[]>();
|
||||
for (const c of allContainers) {
|
||||
if (!c.ImageID) continue;
|
||||
@@ -1020,7 +1041,10 @@ class DockerController {
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
c.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (stack) managedImageIds.add(c.ImageID);
|
||||
if (stack) {
|
||||
managedImageIds.add(c.ImageID);
|
||||
if (!imageToStack.has(c.ImageID)) imageToStack.set(c.ImageID, stack);
|
||||
}
|
||||
else unmanagedImageIds.add(c.ImageID);
|
||||
}
|
||||
const plannedContainerIds = new Set(
|
||||
@@ -1029,10 +1053,12 @@ class DockerController {
|
||||
const rawImages = await this.docker.listImages({ all: false }) as Array<{
|
||||
Id: string;
|
||||
RepoTags?: string[] | null;
|
||||
RepoDigests?: string[] | null;
|
||||
Labels?: Record<string, string>;
|
||||
Size?: number;
|
||||
VirtualSize?: number;
|
||||
Containers?: number;
|
||||
Created?: number;
|
||||
}>;
|
||||
// An image becomes free only when every container that references it is
|
||||
// also in this plan (not merely when any planned container uses it).
|
||||
@@ -1040,31 +1066,39 @@ class DockerController {
|
||||
for (const img of rawImages) {
|
||||
if (selfIdentity.isOwnImage(img.Id)) continue;
|
||||
if (isImageHeld?.(img.Id)) continue;
|
||||
const containers = img.Containers ?? 0;
|
||||
const refs = imageToContainerIds.get(img.Id) ?? [];
|
||||
const becomesFree = freeingImages
|
||||
&& refs.length > 0
|
||||
&& refs.length >= containers
|
||||
&& refs.every((id) => plannedContainerIds.has(id));
|
||||
if (containers > 0 && !becomesFree) continue;
|
||||
if (refs.length > 0 && !becomesFree) continue;
|
||||
const labeled = DockerController.resolveContainerStack(
|
||||
img.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
const stack = labeled ?? imageToStack.get(img.Id) ?? null;
|
||||
if (scope === 'managed') {
|
||||
if (unmanagedImageIds.has(img.Id)) continue;
|
||||
const labeled = DockerController.resolveProjectLabel(
|
||||
img.Labels?.['com.docker.compose.project'], knownSet, projectToStack,
|
||||
);
|
||||
// Unattributed unused images (no managed container, no compose label)
|
||||
// are not Sencho-managed; keep them out of managed prune.
|
||||
if (!becomesFree && !labeled && !managedImageIds.has(img.Id)) continue;
|
||||
if (!becomesFree && !stack && !managedImageIds.has(img.Id)) continue;
|
||||
}
|
||||
const name = img.RepoTags?.[0] && img.RepoTags[0] !== '<none>:<none>'
|
||||
? img.RepoTags[0]
|
||||
: img.Id.slice(0, 12);
|
||||
const references = (img.RepoTags ?? []).filter((ref) => ref && ref !== '<none>:<none>');
|
||||
const name = references[0] ?? '<none>:<none>';
|
||||
const unique = DockerController.imageUniqueBytes(img, sharedSizes);
|
||||
items.push({
|
||||
target: 'images',
|
||||
id: img.Id,
|
||||
name,
|
||||
sizeBytes: unique > 0 ? unique : undefined,
|
||||
managed: Boolean(stack || managedImageIds.has(img.Id)),
|
||||
reason: becomesFree
|
||||
? 'Image becomes unused after planned container removal'
|
||||
: 'Image is not used by any container',
|
||||
stackName: stack ?? undefined,
|
||||
image: {
|
||||
references,
|
||||
digest: img.RepoDigests?.find((digest) => Boolean(digest)),
|
||||
createdAt: typeof img.Created === 'number' ? img.Created : undefined,
|
||||
},
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -1093,7 +1127,8 @@ class DockerController {
|
||||
|
||||
/**
|
||||
* Rebuild the plan with the same targets/scope. Returns the fresh plan when
|
||||
* the fingerprint still matches, otherwise null (caller maps to 409).
|
||||
* the fingerprint still matches, otherwise null so the caller can report
|
||||
* staleness through its route-specific response contract.
|
||||
*/
|
||||
public async assertPlanFresh(
|
||||
plan: PrunePlan,
|
||||
@@ -1173,14 +1208,18 @@ class DockerController {
|
||||
}
|
||||
|
||||
if (target === 'volumes') {
|
||||
const outcome = await this.executePlannedVolume(item, fresh.scope, knownSet, projectToStack, selfIdentity);
|
||||
const outcome = await this.executePlannedVolume(
|
||||
item, fresh.scope, knownSet, projectToStack, absDirToStack, resolvedBase, selfIdentity,
|
||||
);
|
||||
outcomes.push(outcome);
|
||||
if (outcome.status === 'removed') reclaimedBytes += outcome.sizeBytes ?? item.sizeBytes ?? 0;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (target === 'networks') {
|
||||
outcomes.push(await this.executePlannedNetwork(item, fresh.scope, knownSet, projectToStack, selfIdentity));
|
||||
outcomes.push(await this.executePlannedNetwork(
|
||||
item, fresh.scope, knownSet, projectToStack, absDirToStack, resolvedBase, selfIdentity,
|
||||
));
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -1207,7 +1246,7 @@ class DockerController {
|
||||
}
|
||||
}
|
||||
const outcome = await this.executePlannedImage(
|
||||
item, fresh.scope, knownSet, projectToStack, absDirToStack, resolvedBase, selfIdentity,
|
||||
item, selfIdentity,
|
||||
);
|
||||
outcomes.push(outcome);
|
||||
if (outcome.status === 'removed') reclaimedBytes += outcome.sizeBytes ?? item.sizeBytes ?? 0;
|
||||
@@ -1238,9 +1277,10 @@ class DockerController {
|
||||
|
||||
private async imageStillReferenced(imageId: string): Promise<boolean> {
|
||||
try {
|
||||
const images = await this.docker.listImages({ all: false }) as Array<{ Id: string; Containers?: number }>;
|
||||
const match = images.find((img) => img.Id === imageId || img.Id.startsWith(imageId) || imageId.startsWith(img.Id));
|
||||
return (match?.Containers ?? 0) > 0;
|
||||
const containers = await this.docker.listContainers({ all: true }) as Array<{ ImageID?: string }>;
|
||||
return containers.some((container) => container.ImageID === imageId
|
||||
|| Boolean(container.ImageID?.startsWith(imageId))
|
||||
|| imageId.startsWith(container.ImageID ?? ''));
|
||||
} catch {
|
||||
return true;
|
||||
}
|
||||
@@ -1250,8 +1290,8 @@ class DockerController {
|
||||
item: PrunePlanItem,
|
||||
scope: PruneScope,
|
||||
knownSet: Set<string>,
|
||||
projectToStack: Record<string, string>,
|
||||
absDirToStack: Record<string, string>,
|
||||
projectToStack: Map<string, string>,
|
||||
absDirToStack: Map<string, string>,
|
||||
resolvedBase: string,
|
||||
selfIdentity: SelfIdentityService,
|
||||
): Promise<
|
||||
@@ -1305,7 +1345,9 @@ class DockerController {
|
||||
item: PrunePlanItem,
|
||||
scope: PruneScope,
|
||||
knownSet: Set<string>,
|
||||
projectToStack: Record<string, string>,
|
||||
projectToStack: Map<string, string>,
|
||||
absDirToStack: Map<string, string>,
|
||||
resolvedBase: string,
|
||||
selfIdentity: SelfIdentityService,
|
||||
): Promise<PruneItemOutcome> {
|
||||
if (selfIdentity.isOwnVolume(item.id)) {
|
||||
@@ -1325,8 +1367,8 @@ class DockerController {
|
||||
return { id: item.id, target: 'volumes', status: 'skipped', reason: 'Volume is in use' };
|
||||
}
|
||||
if (scope === 'managed') {
|
||||
const stack = DockerController.resolveProjectLabel(
|
||||
vol.Labels?.['com.docker.compose.project'], knownSet, projectToStack,
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
vol.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (!stack) {
|
||||
return { id: item.id, target: 'volumes', status: 'skipped', reason: 'No longer a managed volume' };
|
||||
@@ -1340,7 +1382,9 @@ class DockerController {
|
||||
item: PrunePlanItem,
|
||||
scope: PruneScope,
|
||||
knownSet: Set<string>,
|
||||
projectToStack: Record<string, string>,
|
||||
projectToStack: Map<string, string>,
|
||||
absDirToStack: Map<string, string>,
|
||||
resolvedBase: string,
|
||||
selfIdentity: SelfIdentityService,
|
||||
): Promise<PruneItemOutcome> {
|
||||
if (selfIdentity.isOwnNetwork(item.id)) {
|
||||
@@ -1363,8 +1407,8 @@ class DockerController {
|
||||
return { id: item.id, target: 'networks', status: 'skipped', reason: 'Network is in use' };
|
||||
}
|
||||
if (scope === 'managed') {
|
||||
const stack = DockerController.resolveProjectLabel(
|
||||
inspected.Labels?.['com.docker.compose.project'], knownSet, projectToStack,
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
inspected.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (!stack) {
|
||||
return { id: item.id, target: 'networks', status: 'skipped', reason: 'No longer a managed network' };
|
||||
@@ -1376,11 +1420,6 @@ class DockerController {
|
||||
|
||||
private async executePlannedImage(
|
||||
item: PrunePlanItem,
|
||||
scope: PruneScope,
|
||||
knownSet: Set<string>,
|
||||
projectToStack: Record<string, string>,
|
||||
absDirToStack: Record<string, string>,
|
||||
resolvedBase: string,
|
||||
selfIdentity: SelfIdentityService,
|
||||
): Promise<PruneItemOutcome> {
|
||||
if (selfIdentity.isOwnImage(item.id)) {
|
||||
@@ -1389,30 +1428,21 @@ class DockerController {
|
||||
const rawImages = await this.docker.listImages({ all: false }) as Array<{
|
||||
Id: string;
|
||||
Size?: number;
|
||||
Containers?: number;
|
||||
}>;
|
||||
const img = rawImages.find((i) => i.Id === item.id || i.Id.startsWith(item.id) || item.id.startsWith(i.Id));
|
||||
if (!img) {
|
||||
return { id: item.id, target: 'images', status: 'skipped', reason: 'Image no longer exists' };
|
||||
}
|
||||
if ((img.Containers ?? 0) > 0) {
|
||||
const allContainers = await this.docker.listContainers({ all: true }) as Array<{
|
||||
ImageID?: string;
|
||||
Labels?: Record<string, string>;
|
||||
}>;
|
||||
const references = allContainers.filter((container) => container.ImageID === img.Id
|
||||
|| Boolean(container.ImageID?.startsWith(img.Id))
|
||||
|| img.Id.startsWith(container.ImageID ?? ''));
|
||||
if (references.length > 0) {
|
||||
return { id: item.id, target: 'images', status: 'skipped', reason: 'Image still has container references' };
|
||||
}
|
||||
if (scope === 'managed') {
|
||||
const allContainers = await this.docker.listContainers({ all: true }) as Array<{
|
||||
ImageID?: string;
|
||||
Labels?: Record<string, string>;
|
||||
}>;
|
||||
for (const c of allContainers) {
|
||||
if (c.ImageID !== img.Id) continue;
|
||||
const stack = DockerController.resolveContainerStack(
|
||||
c.Labels, projectToStack, knownSet, absDirToStack, resolvedBase,
|
||||
);
|
||||
if (!stack) {
|
||||
return { id: item.id, target: 'images', status: 'skipped', reason: 'Image referenced by unmanaged container' };
|
||||
}
|
||||
}
|
||||
}
|
||||
await this.docker.getImage(item.id).remove({ force: false });
|
||||
// Prefer plan unique-bytes; do not fall back to full Size (shared layers).
|
||||
return { id: item.id, target: 'images', status: 'removed', sizeBytes: item.sizeBytes ?? 0 };
|
||||
@@ -1925,19 +1955,20 @@ class DockerController {
|
||||
private static resolveProjectLabel(
|
||||
project: string | undefined,
|
||||
knownSet: Set<string>,
|
||||
projectToStack: Record<string, string>,
|
||||
projectToStack: Map<string, string>,
|
||||
): string | null {
|
||||
if (!project) return null;
|
||||
if (knownSet.has(project)) return project;
|
||||
if (projectToStack[project]) return projectToStack[project];
|
||||
return null;
|
||||
return projectToStack.get(project) ?? null;
|
||||
}
|
||||
|
||||
/** Builds a map from absolute stack directory paths to stack names. */
|
||||
private static buildAbsDirMap(stackNames: string[]): Record<string, string> {
|
||||
const map: Record<string, string> = {};
|
||||
private static buildAbsDirMap(stackNames: string[]): Map<string, string> {
|
||||
const map = new Map<string, string>();
|
||||
for (const stackDir of stackNames) {
|
||||
map[path.join(COMPOSE_DIR, stackDir)] = stackDir;
|
||||
const stackPath = path.join(COMPOSE_DIR, stackDir);
|
||||
map.set(stackPath, stackDir);
|
||||
map.set(path.resolve(stackPath), stackDir);
|
||||
}
|
||||
return map;
|
||||
}
|
||||
@@ -1948,21 +1979,24 @@ class DockerController {
|
||||
*/
|
||||
private static resolveContainerStack(
|
||||
containerLabels: Record<string, string> | undefined,
|
||||
projectToStack: Record<string, string>,
|
||||
projectToStack: Map<string, string>,
|
||||
knownStackSet: Set<string>,
|
||||
absDirToStack: Record<string, string>,
|
||||
absDirToStack: Map<string, string>,
|
||||
resolvedBase: string,
|
||||
): string | null {
|
||||
if (!containerLabels) return null;
|
||||
|
||||
// Primary: match by project name (handles name: overrides and standard directory-based names)
|
||||
const project = containerLabels['com.docker.compose.project'];
|
||||
if (project && projectToStack[project]) return projectToStack[project];
|
||||
if (project) {
|
||||
const stack = projectToStack.get(project);
|
||||
if (stack) return stack;
|
||||
}
|
||||
|
||||
// Fallback 1: match by working_dir
|
||||
const workingDir = containerLabels['com.docker.compose.project.working_dir'];
|
||||
if (workingDir) {
|
||||
const match = absDirToStack[workingDir] ?? absDirToStack[path.resolve(workingDir)];
|
||||
const match = absDirToStack.get(workingDir) ?? absDirToStack.get(path.resolve(workingDir));
|
||||
if (match) return match;
|
||||
}
|
||||
|
||||
@@ -1989,15 +2023,15 @@ class DockerController {
|
||||
* Builds (or returns cached) mapping from Docker project name to Sencho stack directory name.
|
||||
* Compose files with a top-level `name:` field override the default project name.
|
||||
*/
|
||||
private static async resolveProjectNameMap(stackNames: string[]): Promise<Record<string, string>> {
|
||||
private static async resolveProjectNameMap(stackNames: string[]): Promise<Map<string, string>> {
|
||||
return CacheService.getInstance().getOrFetch(
|
||||
PROJECT_NAME_CACHE_KEY,
|
||||
PROJECT_NAME_CACHE_TTL_MS,
|
||||
async () => {
|
||||
const map: Record<string, string> = {};
|
||||
const map = new Map<string, string>();
|
||||
|
||||
await Promise.all(stackNames.map(async (stackDir) => {
|
||||
map[stackDir] = stackDir;
|
||||
map.set(stackDir, stackDir);
|
||||
|
||||
for (const fileName of COMPOSE_FILE_NAMES) {
|
||||
const filePath = path.join(COMPOSE_DIR, stackDir, fileName);
|
||||
@@ -2005,7 +2039,7 @@ class DockerController {
|
||||
const content = await fs.readFile(filePath, 'utf-8');
|
||||
const parsed = yaml.parse(content);
|
||||
if (parsed?.name && typeof parsed.name === 'string') {
|
||||
map[parsed.name] = stackDir;
|
||||
map.set(parsed.name, stackDir);
|
||||
}
|
||||
break;
|
||||
} catch (err: unknown) {
|
||||
|
||||
@@ -3,13 +3,47 @@ import { createHash } from 'crypto';
|
||||
export type PruneTarget = 'images' | 'volumes' | 'networks' | 'containers';
|
||||
export type PruneScope = 'managed' | 'all';
|
||||
|
||||
export interface PrunePlanItem {
|
||||
target: PruneTarget;
|
||||
interface PrunePlanItemBase {
|
||||
id: string;
|
||||
name: string;
|
||||
sizeBytes?: number;
|
||||
managed: boolean;
|
||||
reason: string;
|
||||
stackName?: string;
|
||||
}
|
||||
|
||||
export type PrunePlanItem =
|
||||
| (PrunePlanItemBase & { target: 'containers'; image?: never; volume?: never; network?: never })
|
||||
| (PrunePlanItemBase & {
|
||||
target: 'images';
|
||||
image: {
|
||||
references: string[];
|
||||
digest?: string;
|
||||
createdAt?: number;
|
||||
};
|
||||
volume?: never;
|
||||
network?: never;
|
||||
})
|
||||
| (PrunePlanItemBase & {
|
||||
target: 'volumes';
|
||||
volume: {
|
||||
driver?: string;
|
||||
ownershipLabels?: Record<string, string>;
|
||||
};
|
||||
image?: never;
|
||||
network?: never;
|
||||
})
|
||||
| (PrunePlanItemBase & {
|
||||
target: 'networks';
|
||||
network: {
|
||||
driver?: string;
|
||||
scope?: string;
|
||||
ownershipLabels?: Record<string, string>;
|
||||
};
|
||||
image?: never;
|
||||
volume?: never;
|
||||
});
|
||||
|
||||
export interface PrunePlan {
|
||||
scope: PruneScope;
|
||||
/** Ordered execution sequence (dependency-safe when multi-target). */
|
||||
@@ -34,6 +68,36 @@ export const PRUNE_EXECUTION_ORDER: readonly PruneTarget[] = ['volumes', 'contai
|
||||
|
||||
export const PRUNEABLE_CONTAINER_STATES = new Set(['created', 'exited', 'dead']);
|
||||
|
||||
const COMPOSE_OWNERSHIP_LABEL_KEYS = new Set([
|
||||
'com.docker.compose.project',
|
||||
'com.docker.compose.project.working_dir',
|
||||
'com.docker.compose.project.config_files',
|
||||
'com.docker.compose.volume',
|
||||
'com.docker.compose.network',
|
||||
'com.docker.compose.service',
|
||||
]);
|
||||
|
||||
/**
|
||||
* Disclosure allowlist for ownership evidence returned to API clients.
|
||||
* Do not broaden it without reviewing Docker label values for sensitive data.
|
||||
*/
|
||||
export function projectPruneOwnershipLabels(value: unknown): Record<string, string> | undefined {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
|
||||
const projected = Object.entries(value).filter(
|
||||
(entry): entry is [string, string] => COMPOSE_OWNERSHIP_LABEL_KEYS.has(entry[0])
|
||||
&& typeof entry[1] === 'string' && entry[1].length > 0,
|
||||
);
|
||||
return projected.length > 0 ? Object.fromEntries(projected) : undefined;
|
||||
}
|
||||
|
||||
export function hasOnlyPruneOwnershipLabels(value: unknown): boolean {
|
||||
if (value === undefined) return true;
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
|
||||
return Object.entries(value).every(
|
||||
([key, label]) => COMPOSE_OWNERSHIP_LABEL_KEYS.has(key) && typeof label === 'string' && label.length > 0,
|
||||
);
|
||||
}
|
||||
|
||||
export function isPruneTarget(value: unknown): value is PruneTarget {
|
||||
return typeof value === 'string' && (PRUNE_TARGETS as readonly string[]).includes(value);
|
||||
}
|
||||
|
||||
@@ -5,7 +5,7 @@ description: "Bulk operations across the fleet from one tab: stop stacks by labe
|
||||
|
||||
The **Actions** tab on the Fleet view groups bulk operations that touch more than a single stack on a single node. Each action lives in its own card, orchestrates from the control instance, and reports per-node and per-stack results inline so you never have to click through a modal to learn what happened.
|
||||
|
||||
Three cards ship today: **Prune Docker resources fleet-wide**, **Bulk label assign**, and **Stop by label**. Every card follows the same discipline before it touches anything: a live, debounced readout resolves the exact blast radius as you type or select, and the destructive or state-changing button stays disabled until that readout resolves to a concrete node and stack list. You confirm against real names, not a label string or a byte estimate.
|
||||
Three cards ship today: **Prune Docker resources fleet-wide**, **Bulk label assign**, and **Stop by label**. Every card resolves its blast radius before it touches anything. Fleet Prune also requires an itemized dry run, so its destructive button stays disabled until every reachable node has returned the exact resources and fingerprint that will authorize execution.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/fleet-actions/fleet-actions-overview.png" alt="Fleet view with the Actions tab selected. A two-column grid: Prune fleet-wide (top left, Maintenance chip), Bulk label assign (top right, Transformative chip), and Stop by label (bottom, Destructive chip). Each card shows a toolbar row with an action-class chip, a live blast-radius readout, a Dry run or Reset button, and the primary action." />
|
||||
@@ -26,17 +26,17 @@ Fleet Actions is the home for operations that span the fleet but don't fit anywh
|
||||
| Trigger a Sencho self-update across remote nodes | **Check Updates** button on the Fleet masthead |
|
||||
| Steer where new blueprint deployments land | [Fleet Federation](/features/fleet-federation) |
|
||||
| Replicate scan policies and CVE suppressions to remotes | [Fleet Sync](/features/fleet-sync) |
|
||||
| Reclaim disk space on a single node with an itemized, undo-safe preview | **Resources → Prune** on that node (a different endpoint and flow from the fleet-wide card; see [Prune Docker resources fleet-wide](#prune-docker-resources-fleet-wide)) |
|
||||
| Reclaim disk space on a single node with an itemized preview | **Resources → Prune** on that node (the single-node version of the fingerprint-bound flow described in [Prune Docker resources fleet-wide](#prune-docker-resources-fleet-wide)) |
|
||||
|
||||
## How every card works: preview, confirm, execute
|
||||
|
||||
All three cards share one execution model, and understanding it explains every result panel, timeout, and edge case below.
|
||||
|
||||
1. **You describe the target.** A stack label name (Stop by label), a label plus checked stacks (Bulk label assign), or a set of resource targets and a scope (Prune).
|
||||
2. **A live, debounced readout resolves the real blast radius.** Typing a label name or checking a target fires a non-destructive preview call (`POST /api/fleet/labels/match-preview` or `POST /api/fleet/prune/estimate`) roughly 350-500ms after you stop changing input. The readout in the card's toolbar shows `awaiting target` until something is selected, `resolving…` while the call is in flight, and then a concrete count (`7 stacks · 1 nodes`, `~ 6.09 GB reclaimable`). The primary button stays disabled until this resolves to a non-zero, non-loading result.
|
||||
3. **You confirm against the resolved list, not the input.** Clicking the primary button opens a confirmation dialog that lists the actual nodes and stacks (Stop, Bulk assign) or restates the scope (Prune). For Stop by label specifically, the confirmation carries the exact node/stack list the preview resolved, and the real stop only touches stacks that are still in that list *and* still carry the label at execution time: a stack that gains the label after you opened the confirmation is never touched, and a node that reconnects after the preview does not get pulled into the stop.
|
||||
4. **The control instance fans the confirmed action out to every node in parallel.** The local node runs in-process; each remote node is called over the standard Bearer-token proxy path. A node that cannot be reached, returns a non-2xx response, or returns a shape Sencho does not recognize is reported as a failure for that node only; the fan-out to every other node still completes.
|
||||
5. **Results render per node, grouped and expandable**, in a `Per-node breakdown` section below the form. Stop and Prune also expose a **Dry run** button that walks the identical code path and locks without performing the destructive step, so you can rehearse the exact fan-out before committing.
|
||||
2. **A live, debounced readout estimates the blast radius.** Typing a label name or checking a target fires a non-destructive preview call (`POST /api/fleet/labels/match-preview` or `POST /api/fleet/prune/estimate`) roughly 350-500ms after you stop changing input. The toolbar shows a stack count or approximate reclaimable bytes while you refine the action.
|
||||
3. **You review the resolved list, not only the input.** Stop and Bulk assign resolve concrete stacks. Prune requires **Dry run**, which lists every candidate image, volume, and network for each reachable node. Changing the targets, scope, node roster, or node reachability clears that authorization.
|
||||
4. **The control instance verifies before mutation.** Fleet Prune rebuilds every reviewed plan and checks the complete node roster before any node starts deleting. A stale plan or changed reachability rejects the whole preflight. A later race can still produce an explicit partial result because each node revalidates again immediately before deletion.
|
||||
5. **Results render per node, grouped and expandable.** Prune retains the reviewed item identity and, when the node returns item outcomes, marks each candidate Removed, Skipped, or Failed after execution. Unreachable nodes remain visible as excluded rather than appearing as successful empty plans.
|
||||
|
||||
## The three cards
|
||||
|
||||
@@ -46,7 +46,7 @@ All three cards share one execution model, and understanding it explains every r
|
||||
| Bulk label assign | Transformative | `POST /api/fleet/labels/bulk-assign` | (computed client-side from `/api/labels` and `/api/fleet/node/:id/stacks` per node) | Only the nodes whose stacks you select |
|
||||
| Prune Docker resources fleet-wide | Maintenance | `POST /api/fleet/labels/fleet-prune` | `POST /api/fleet/prune/estimate` | Every configured node |
|
||||
|
||||
Every card is admin-only and available on every license tier. Stop and Prune iterate every node in **Settings → Nodes**; Bulk label assign iterates only the nodes whose stacks you actually checked. Each card runs the authoritative work on the executing node (the local node in process, every remote over the node proxy), so an unreachable node shows up in the results with a transport error rather than blocking the rest of the batch.
|
||||
Every card is admin-only and available on every license tier. Stop and Prune iterate every node in **Settings → Nodes**; Bulk label assign iterates only the nodes whose stacks you actually checked. Each card runs the authoritative work on the executing node (the local node in process, every remote over the node proxy). Stop and Bulk label assign report unreachable nodes without blocking work elsewhere. Fleet Prune excludes unreachable nodes during review, then rejects execution if that reviewed reachability changes.
|
||||
|
||||
## Stop by label
|
||||
|
||||
@@ -120,7 +120,7 @@ A single Apply accepts up to **1,000 stack assignments** summed across every tar
|
||||
|
||||
## Prune Docker resources fleet-wide
|
||||
|
||||
Reclaim disk space on every reachable node by deleting unused images, volumes, and networks. The control instance fans out to each node and reports reclaimed bytes per node and per target.
|
||||
Reclaim disk space on every reachable node by deleting unused images, volumes, and networks. A dry run lists the exact candidates on each node, and the real prune is authorized by the fingerprint of each reviewed plan.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/fleet-actions/fleet-actions-prune.png" alt="Prune fleet-wide card with Images and Volumes targets checked, scope set to All unused, and a live per-node estimate: Local 153.85 MB, Opsix 3.06 GB, Pitt-Moba 1.37 GB, SLX-Mars 1.51 GB, totaling roughly 6.09 GB reclaimable in the toolbar readout." />
|
||||
@@ -135,33 +135,48 @@ The **Targets** checkboxes are independent and at least one must be ticked: **Im
|
||||
Scope is a segmented control with two options:
|
||||
|
||||
- **Managed only** (default). Sencho looks up the stacks it knows about on the node, then prunes only resources owned by those stacks. Active containers and resources placed by other tools are untouched.
|
||||
- **All unused**. Sencho runs the equivalent of `docker system prune` for each selected target. Any image, volume, or network not currently in use is deleted, including resources from workloads Sencho does not manage. The confirmation title flips to **Prune ALL unused resources across the fleet?**.
|
||||
- **All unused**. Sencho applies the target-specific Docker prune eligibility rules to each selected resource type. Any selected image, volume, or network not currently in use is deleted, including resources from workloads Sencho does not manage. The confirmation title flips to **Prune ALL unused resources across the fleet?**.
|
||||
|
||||
### Live estimate and behaviour
|
||||
### Review the itemized dry run
|
||||
|
||||
- Changing a target or the scope re-triggers a debounced call to `POST /api/fleet/prune/estimate`, which walks the same Docker enumeration the destructive path uses so the estimate matches what pruning would actually reclaim. A completed real prune that succeeds on at least one target re-triggers the same estimate so the toolbar total and per-node list reflect post-prune Docker state. **Prune fleet** stays disabled until the estimate resolves: you cannot confirm a destructive fleet-wide prune with no context on what it will reclaim.
|
||||
- Each remote node receives one `POST /api/system/prune/system` call per selected target, with a 120-second timeout. If a transport error fires for one target, the remaining targets on that node are short-circuited with the same error rather than retried, so a dead node doesn't absorb the full multi-target timeout budget.
|
||||
- Local nodes serialize against a per-node lock (`bulk-prune:<nodeId>`). A second fleet prune launched against the same local node while the first is still in flight returns *A prune is already running on this node* for each target.
|
||||
- Reclaimed bytes are reported by the Docker daemon and are approximate. Per-node rows in the results panel sum the per-target reclaim; the per-target children show how much each individual prune actually freed.
|
||||
Click **Dry run** after choosing targets and scope. Each reachable node returns one multi-target plan grouped into Images, Volumes, and Networks. Candidate rows show the stable ID, display name, reclaimable size when Docker provides one, why the resource is unused, managed or unmanaged ownership, and the associated stack when it can be resolved. Images also show available digest and creation details; volumes show their driver; networks show driver and scope. Only Compose ownership labels are shown, not arbitrary Docker labels.
|
||||
|
||||
<Note>
|
||||
Fleet Actions' prune card calls the same node-local prune route as the single-node **Resources → Prune** page, but without that page's itemized plan-and-fingerprint flow. It never returns the `PRUNE_PLAN_STALE` (409) error you can see on Resources; each fleet prune call targets exactly one resource type per node and executes immediately. If you want an itemized, reviewable plan before pruning a specific node, use that node's own Resources page instead.
|
||||
</Note>
|
||||
An untagged image is identified as `<none>:<none>` alongside its short ID. Under **All unused**, unmanaged candidates carry an **UNMANAGED** badge. Nodes that cannot be reached are shown as **excluded** and never as zero-candidate success. A reachable plan with zero items is still valid.
|
||||
|
||||
The node total is the sum of the sizes shown in that node's candidate rows. Image totals are estimates because Docker layers may be shared; the actual bytes reclaimed can differ after Docker accounts for layers still referenced by other images.
|
||||
|
||||
### Fingerprint-bound execution
|
||||
|
||||
**Prune fleet** remains disabled until the current targets, scope, and node roster have a valid reviewed plan for every reachable node. Execution sends one fingerprint per reviewed reachable node. Before deletion begins, the control instance rebuilds all plans, confirms that reviewed-unreachable nodes are still unreachable, and compares the complete configured-node roster.
|
||||
|
||||
If a node was added, removed, connected, disconnected, or changed candidates after the dry run, no node starts pruning. Run **Dry run** again to review the new state. Once fleet-wide preflight passes, each node revalidates immediately before deletion. A race at that point can produce a partial result, which is reported rather than hidden.
|
||||
|
||||
Local plan enumeration has an eight-second Docker-daemon timeout. Real local execution holds the per-node prune lock from preflight through mutation. Proxy remotes and Pilot nodes use one multi-target plan request and one fingerprint-bound execute request through their normal fleet transport. Mesh-managed stacks follow the transport of the node that hosts them.
|
||||
|
||||
### Read post-prune outcomes
|
||||
|
||||
The result keeps the reviewed name and metadata for every candidate and adds one outcome when the node returns itemized outcomes:
|
||||
|
||||
- **Removed** means the reviewed resource was deleted.
|
||||
- **Skipped** means it became active, was already absent, or became protected before deletion.
|
||||
- **Failed** includes the resource-level error returned by the node.
|
||||
|
||||
If a remote reports only its reclaimed total, the node shows that total without inventing per-item statuses. A completed mutation refreshes the live estimate.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
| Requirement | Why it matters |
|
||||
|---|---|
|
||||
| **Configured remote nodes in Settings → Nodes** | Stop and Prune iterate the configured node list; Bulk label assign iterates whichever nodes you select stacks on. A node missing its `api_url` or `api_token`, or one that cannot be reached, is reported once per node as unreachable and never blocks the reachable nodes. |
|
||||
| **Configured remote nodes in Settings → Nodes** | Stop and Prune iterate the configured node list; Bulk label assign iterates whichever nodes you select stacks on. Stop and Bulk label assign report an unreachable node without blocking other nodes. Prune excludes it from the reviewed plan and rejects execution if its reachability later changes. |
|
||||
| **Admin role** | Every card requires the admin role to apply. |
|
||||
| **Labels you intend to target** | Stop by label and its autocomplete depend on stack labels existing on at least one node; Bulk label assign depends on at least one stack label existing anywhere in the fleet. See [Stack Labels](/features/stack-labels) for the authoring flow. |
|
||||
|
||||
## Behaviour and lifecycle
|
||||
|
||||
- **Always returns 200.** Every destructive endpoint is structured so the HTTP status reflects the request shape, not the operational outcome. Partial failure is encoded in per-row fields, not in the status code.
|
||||
- **Operational outcomes are itemized.** Normal fan-out results use per-node and per-item fields. Fleet Prune uses `409` when the reviewed roster, reachability, or fingerprint changes before mutation, because that rejection guarantees no node has started deleting.
|
||||
- **No retry, no scheduling, no undo.** Fleet Actions runs synchronously and is operator-driven; there is no background scheduler and no roll-back. For recurrence, use [Scheduled Operations](/features/scheduled-operations).
|
||||
- **Offline remotes still receive the request.** A node that is down at the moment of the action returns a transport-error row but does not block the fan-out across the rest of the fleet.
|
||||
- **Concurrent runs serialize per node.** All three cards take per-node locks before touching Docker or the label tables, so kicking off a second prune, a second fleet stop, or a fleet stop overlapping a per-label stop on the same node yields a calm "already running on this node" row rather than silent double-execution.
|
||||
- **Offline remotes stay visible.** Dry run marks an unreachable node as excluded. If its reachability changes before Prune executes, the reviewed authorization is rejected and must be rebuilt.
|
||||
- **Concurrent mutations serialize per node.** A real local Fleet Prune holds its prune lock through preflight and execution. Dry-run enumeration stays outside the destructive lock.
|
||||
|
||||
## Limitations and non-goals
|
||||
|
||||
@@ -174,7 +189,7 @@ Fleet Actions is intentionally narrow. The following are deliberately out of sco
|
||||
- **No undo.** A stopped stack stays stopped until you start it again; a pruned image is gone until it is pulled or rebuilt.
|
||||
- **Approximate reclaim numbers.** The bytes the Prune card reports come from the Docker daemon and are best-effort, not authoritative.
|
||||
- **Confirmed-target stops need a current remote.** A real (non-dry-run) stop bound to specific stacks refuses to run against a remote that doesn't advertise support for confirmed-target binding; upgrade the remote to retry.
|
||||
- **Timeouts scale with the fan-out, not with any one node.** 60 seconds per remote on fleet-stop and bulk-assign, 120 seconds per remote per prune target. A remote with many stacks or a very slow filesystem may produce a timeout row before the underlying work fully completes; the action itself usually still finishes on the remote, the control instance just stopped waiting.
|
||||
- **Timeouts scale with the fan-out, not with any one node.** Remote fleet-stop and bulk-assign calls allow 60 seconds. Fleet Prune allows 120 seconds for each node's combined multi-target plan or execute request. A remote with many stacks or a very slow filesystem may produce a timeout row before the underlying work fully completes; during execution, check that remote's logs before retrying because the control instance may have stopped waiting after mutation began.
|
||||
|
||||
## Practical workflows
|
||||
|
||||
@@ -184,7 +199,7 @@ Tag the stacks you want to bring down with a dedicated label (for example `eveni
|
||||
|
||||
### Rehearse a destructive action before committing
|
||||
|
||||
For Stop and Prune, click **Dry run** first. It walks the identical lock, fan-out, and per-node logic as the real action but skips the destructive leaf call, so the results panel shows exactly what would happen (including which nodes are unreachable right now) before you commit to it.
|
||||
For Stop and Prune, click **Dry run** first. Fleet Prune shows the exact Docker candidates, including which nodes are excluded, and stores the fingerprints needed to unlock the destructive action.
|
||||
|
||||
### Propagate a label across the fleet
|
||||
|
||||
@@ -192,7 +207,7 @@ Define a label like `Media` on one node (for example the local node) under **Set
|
||||
|
||||
### Free disk before a heavy deploy
|
||||
|
||||
Run **Prune Docker resources fleet-wide** with **Images** selected and **Managed only** scope, and check the live per-node estimate before confirming. It gives a quick read on which hosts have accumulated the most stale layers. Switch to **All unused** if you want the prune to reach workloads that Sencho does not manage.
|
||||
Run **Prune Docker resources fleet-wide** with **Images** selected and **Managed only** scope. Check the live estimate, run the itemized dry run, and review each image before confirming. Switch to **All unused** if you want the plan to include workloads that Sencho does not manage.
|
||||
|
||||
## Common questions
|
||||
|
||||
@@ -201,13 +216,13 @@ Run **Prune Docker resources fleet-wide** with **Images** selected and **Managed
|
||||
Bulk mode operates on a hand-picked set of stacks **on one node** and supports start, stop, restart, and update. Fleet Actions operates **across every configured node** by selector (a label, or a checked cross-node set), and only Stop is a lifecycle action here (Bulk mode covers restart and update, Fleet Actions does not).
|
||||
</Accordion>
|
||||
<Accordion title="Does Dry run touch anything?">
|
||||
No. Dry run walks the same code path, including acquiring the per-node lock, but every card skips the destructive Docker or label-table call and returns what it would have done instead. It is safe to run repeatedly.
|
||||
No. Fleet Prune enumerates candidates without calling Docker remove methods or invalidating caches. It is safe to run repeatedly.
|
||||
</Accordion>
|
||||
<Accordion title="Why is the primary button disabled even though I typed a label or checked a target?">
|
||||
Every destructive or state-changing button stays disabled until the live preview or estimate resolves to a non-zero, non-loading result. This is deliberate: you always confirm against a concrete, current blast radius rather than an unresolved input.
|
||||
Fleet Prune requires a successful **Dry run** for the current targets, scope, and node roster. Run it again after any of those inputs or a node's reachability changes.
|
||||
</Accordion>
|
||||
<Accordion title="Why does Fleet's Prune never show the 'stale plan' error I've seen on Resources?">
|
||||
Resources → Prune builds an itemized plan with a fingerprint and re-validates it at execute time, which is where that error comes from. Fleet Actions' prune card calls the simpler legacy single-target path on each node instead, so there is no plan to go stale.
|
||||
<Accordion title="Why did Fleet Prune ask for another dry run?">
|
||||
The reviewed node roster, reachability, or candidate fingerprint changed before deletion began. Sencho rejected the entire fleet preflight so you can review the current candidates before trying again.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -239,7 +254,7 @@ Run **Prune Docker resources fleet-wide** with **Images** selected and **Managed
|
||||
Fleet Actions runs admin-only. Confirm the active user has the admin role under **Settings → Users**; operator and viewer roles see every card but cannot apply them.
|
||||
</Accordion>
|
||||
<Accordion title="A node is reported as unreachable">
|
||||
The node is in **Settings → Nodes** but its `api_url` or `api_token` is missing, expired, or unreachable. Stop by label reports it once as a single `<node> (unreachable)` row; Prune reports it per target. Open **Settings → Nodes** on the control instance and test the connection for the remote; fix the credential or the reachability, then re-run the action.
|
||||
The node is in **Settings → Nodes** but its `api_url` or `api_token` is missing, expired, or unreachable. Stop by label reports one `<node> (unreachable)` row. Fleet Prune keeps the node visible as excluded from the reviewed plan; its target rows carry the same reachability error. Open **Settings → Nodes** on the control instance and test the connection for the remote; fix the credential or reachability, then run a new dry run.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
|
||||
@@ -33,6 +33,7 @@ import { VolumeBrowserSheet } from './resources/VolumeBrowserSheet';
|
||||
import { VolumeNameLabel } from './resources/VolumeNameLabel';
|
||||
import { useTableSort } from '@/hooks/useTableSort';
|
||||
import { SortableTableHead } from '@/components/ui/sortable-table';
|
||||
import { isPrunePlan, type PrunePlan, type PruneScope, type PruneTarget } from '@/lib/prunePlan';
|
||||
|
||||
// ── Interfaces ─────────────────────────────────────────────────────────────────
|
||||
|
||||
@@ -90,25 +91,6 @@ interface UnmanagedContainer {
|
||||
}
|
||||
|
||||
type ResourceFilter = 'all' | 'managed' | 'unmanaged';
|
||||
type PruneTarget = 'containers' | 'images' | 'networks' | 'volumes';
|
||||
type PruneScope = 'managed' | 'all';
|
||||
|
||||
interface PrunePlanItem {
|
||||
target: PruneTarget;
|
||||
id: string;
|
||||
name: string;
|
||||
sizeBytes?: number;
|
||||
}
|
||||
|
||||
interface PrunePlan {
|
||||
scope: PruneScope;
|
||||
targets: PruneTarget[];
|
||||
items: PrunePlanItem[];
|
||||
reclaimableBytes: number;
|
||||
fingerprint: string;
|
||||
createdAt: number;
|
||||
nodeId: number;
|
||||
}
|
||||
|
||||
const PLAN_PREVIEW_CAP = 30;
|
||||
|
||||
@@ -530,8 +512,9 @@ export default function ResourcesView({ headerActions }: ResourcesViewProps = {}
|
||||
if (!res.ok) {
|
||||
throw new Error(data?.error || 'Failed to build prune plan');
|
||||
}
|
||||
setPrunePlan(data as PrunePlan);
|
||||
return data as PrunePlan;
|
||||
if (!isPrunePlan(data)) throw new Error('The node returned a malformed prune plan');
|
||||
setPrunePlan(data);
|
||||
return data;
|
||||
} catch (error) {
|
||||
if (planFetchGenRef.current !== generation) return null;
|
||||
const err = error as { message?: string };
|
||||
|
||||
@@ -120,7 +120,10 @@ function samplePrunePlan(overrides: Record<string, unknown> = {}) {
|
||||
return {
|
||||
scope: 'managed',
|
||||
targets: ['images'],
|
||||
items: [{ target: 'images', id: 'img1', name: 'old:v1', sizeBytes: 1000 }],
|
||||
items: [{
|
||||
target: 'images', id: 'img1', name: 'old:v1', sizeBytes: 1000,
|
||||
managed: true, reason: 'Image is not used by any container', image: { references: ['old:v1'] },
|
||||
}],
|
||||
reclaimableBytes: 1000,
|
||||
fingerprint: 'fp-test',
|
||||
createdAt: Date.now(),
|
||||
@@ -134,8 +137,14 @@ function reclaimPlan() {
|
||||
scope: 'all',
|
||||
targets: ['volumes', 'containers', 'images'],
|
||||
items: [
|
||||
{ target: 'volumes', id: 'v1', name: 'v1', sizeBytes: 500 },
|
||||
{ target: 'images', id: 'img1', name: 'old:v1', sizeBytes: 1000 },
|
||||
{
|
||||
target: 'volumes', id: 'v1', name: 'v1', sizeBytes: 500,
|
||||
managed: true, reason: 'Volume is not referenced by any container', volume: {},
|
||||
},
|
||||
{
|
||||
target: 'images', id: 'img1', name: 'old:v1', sizeBytes: 1000,
|
||||
managed: true, reason: 'Image is not used by any container', image: { references: ['old:v1'] },
|
||||
},
|
||||
],
|
||||
reclaimableBytes: 1500,
|
||||
fingerprint: 'fp-reclaim',
|
||||
|
||||
@@ -0,0 +1,60 @@
|
||||
import { expect, it } from 'vitest';
|
||||
import { render, screen } from '@testing-library/react';
|
||||
import type { FleetPruneNodeResult, PrunePlanItem } from '@/lib/prunePlan';
|
||||
import { PrunePlanResults } from './PrunePlanResults';
|
||||
|
||||
const items: PrunePlanItem[] = [
|
||||
{ target: 'images', id: 'removed-id', name: 'removed:latest', managed: true, reason: 'unused', image: { references: ['removed:latest'] } },
|
||||
{ target: 'images', id: 'skipped-id', name: 'skipped:latest', managed: true, reason: 'unused', image: { references: ['skipped:latest'] } },
|
||||
{ target: 'images', id: 'failed-id', name: 'failed:latest', managed: false, reason: 'unused', image: { references: ['failed:latest'] } },
|
||||
];
|
||||
|
||||
const plan: FleetPruneNodeResult = {
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
fingerprint: 'plan',
|
||||
items,
|
||||
reclaimableBytes: 0,
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 0, dryRun: true }],
|
||||
};
|
||||
|
||||
it('renders removed, skipped, and failed outcomes with reviewed item names', () => {
|
||||
const execution: FleetPruneNodeResult = {
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
reclaimedBytes: 0,
|
||||
outcomes: [
|
||||
{ target: 'images', id: 'removed-id', status: 'removed' },
|
||||
{ target: 'images', id: 'skipped-id', status: 'skipped', reason: 'Became active' },
|
||||
{ target: 'images', id: 'failed-id', status: 'failed', error: 'Docker refused removal' },
|
||||
],
|
||||
targets: [{
|
||||
target: 'images', success: false, reclaimedBytes: 0, dryRun: false,
|
||||
removed: 1, skipped: 1, failed: 1,
|
||||
}],
|
||||
};
|
||||
render(<PrunePlanResults planResults={[plan]} executeResults={[execution]} />);
|
||||
|
||||
expect(screen.getByText('removed:latest')).toBeInTheDocument();
|
||||
expect(screen.getByText('skipped:latest')).toBeInTheDocument();
|
||||
expect(screen.getByText('failed:latest')).toBeInTheDocument();
|
||||
expect(screen.getByText('removed')).toBeInTheDocument();
|
||||
expect(screen.getByText('skipped')).toBeInTheDocument();
|
||||
expect(screen.getByText('failed')).toBeInTheDocument();
|
||||
expect(screen.getByText('Became active')).toBeInTheDocument();
|
||||
expect(screen.getByText('Docker refused removal')).toBeInTheDocument();
|
||||
});
|
||||
|
||||
it('renders the total-only fallback when a remote omits outcomes', () => {
|
||||
const execution: FleetPruneNodeResult = {
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
reclaimedBytes: 1024,
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 1024, dryRun: false }],
|
||||
};
|
||||
render(<PrunePlanResults planResults={[plan]} executeResults={[execution]} />);
|
||||
expect(screen.getByText('This node reported 1 KB reclaimed without itemized outcomes.')).toBeInTheDocument();
|
||||
});
|
||||
@@ -0,0 +1,156 @@
|
||||
import { cn, formatBytes } from '@/lib/utils';
|
||||
import type {
|
||||
FleetPruneNodeResult,
|
||||
FleetPruneTarget,
|
||||
PruneItemOutcome,
|
||||
PrunePlanItem,
|
||||
} from '@/lib/prunePlan';
|
||||
|
||||
const TARGET_LABELS: Record<FleetPruneTarget, string> = {
|
||||
images: 'Images',
|
||||
volumes: 'Volumes',
|
||||
networks: 'Networks',
|
||||
};
|
||||
|
||||
interface Props {
|
||||
planResults: FleetPruneNodeResult[];
|
||||
executeResults?: FleetPruneNodeResult[];
|
||||
}
|
||||
|
||||
function shortId(id: string): string {
|
||||
return id.replace(/^sha256:/, '').slice(0, 12);
|
||||
}
|
||||
|
||||
function metadata(item: PrunePlanItem): string[] {
|
||||
const values: string[] = [];
|
||||
if (item.image?.references) {
|
||||
values.push(...item.image.references.filter((reference) => reference !== item.name));
|
||||
}
|
||||
if (item.image?.digest) values.push(item.image.digest);
|
||||
if (item.image?.createdAt) values.push(new Date(item.image.createdAt * 1000).toLocaleString());
|
||||
if (item.volume?.driver) values.push(`driver ${item.volume.driver}`);
|
||||
if (item.network?.driver) values.push(`driver ${item.network.driver}`);
|
||||
if (item.network?.scope) values.push(`scope ${item.network.scope}`);
|
||||
const labels = item.volume?.ownershipLabels ?? item.network?.ownershipLabels;
|
||||
if (labels) values.push(...Object.entries(labels).map(([key, value]) => `${key}=${value}`));
|
||||
return values;
|
||||
}
|
||||
|
||||
function OutcomeBadge({ outcome }: { outcome?: PruneItemOutcome }) {
|
||||
if (!outcome) return null;
|
||||
const tone = outcome.status === 'removed'
|
||||
? 'border-success/40 bg-success/10 text-success'
|
||||
: outcome.status === 'skipped'
|
||||
? 'border-warning/40 bg-warning/10 text-warning'
|
||||
: 'border-destructive/40 bg-destructive/10 text-destructive';
|
||||
return (
|
||||
<span className={cn('rounded-sm border px-1.5 py-0.5 font-mono text-[9px] uppercase tracking-[0.14em]', tone)}>
|
||||
{outcome.status}
|
||||
</span>
|
||||
);
|
||||
}
|
||||
|
||||
function ItemRow({ item, outcome }: { item: PrunePlanItem; outcome?: PruneItemOutcome }) {
|
||||
const detail = outcome?.status === 'skipped'
|
||||
? outcome.reason
|
||||
: outcome?.status === 'failed'
|
||||
? outcome.error
|
||||
: item.reason;
|
||||
return (
|
||||
<li className="rounded border border-card-border/50 bg-card/40 px-2.5 py-2">
|
||||
<div className="flex items-start gap-2 max-md:flex-col">
|
||||
<div className="min-w-0 flex-1">
|
||||
<div className="flex flex-wrap items-center gap-1.5">
|
||||
<span className="break-all font-mono text-xs text-stat-value">{item.name}</span>
|
||||
<span className={cn(
|
||||
'rounded-sm border px-1 py-0.5 font-mono text-[9px] uppercase tracking-[0.14em]',
|
||||
item.managed
|
||||
? 'border-success/40 bg-success/10 text-success'
|
||||
: 'border-warning/40 bg-warning/10 text-warning',
|
||||
)}>
|
||||
{item.managed ? 'managed' : 'unmanaged'}
|
||||
</span>
|
||||
<OutcomeBadge outcome={outcome} />
|
||||
</div>
|
||||
<p className="mt-1 break-all font-mono text-[10px] text-stat-subtitle">
|
||||
{shortId(item.id)}{item.stackName ? ` · stack ${item.stackName}` : ''}
|
||||
</p>
|
||||
{metadata(item).map((value) => (
|
||||
<p key={value} className="mt-0.5 break-all font-mono text-[10px] text-stat-icon">{value}</p>
|
||||
))}
|
||||
<p className="mt-1 text-[11px] text-stat-subtitle">{detail}</p>
|
||||
</div>
|
||||
<span className="shrink-0 font-mono text-[11px] tabular-nums text-stat-value">
|
||||
{item.sizeBytes == null ? 'size unavailable' : formatBytes(item.sizeBytes)}
|
||||
</span>
|
||||
</div>
|
||||
</li>
|
||||
);
|
||||
}
|
||||
|
||||
function NodePlan({ plan, execution }: { plan: FleetPruneNodeResult; execution?: FleetPruneNodeResult }) {
|
||||
if (!plan.reachable || !plan.fingerprint) {
|
||||
return (
|
||||
<div className="rounded border border-card-border/60 bg-card/30 p-2.5">
|
||||
<div className="font-mono text-xs text-stat-value">{plan.nodeName} · excluded</div>
|
||||
<p className="mt-1 text-[11px] text-stat-subtitle">{plan.error ?? 'Node was unreachable during the dry run.'}</p>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
const items = plan.items ?? [];
|
||||
const outcomesByItem = new Map<string, PruneItemOutcome>(
|
||||
execution?.outcomes?.map((outcome) => [`${outcome.target}\0${outcome.id}`, outcome]) ?? [],
|
||||
);
|
||||
return (
|
||||
<details open className="rounded border border-card-border/60 bg-card/30">
|
||||
<summary className="cursor-pointer px-2.5 py-2 font-mono text-xs text-stat-value">
|
||||
{plan.nodeName} · {formatBytes(execution?.reclaimedBytes ?? plan.reclaimableBytes ?? 0)}
|
||||
</summary>
|
||||
<div className="space-y-2 border-t border-card-border/50 p-2.5">
|
||||
{execution?.error && (
|
||||
<p className="rounded border border-destructive/40 bg-destructive/10 p-2 text-[11px] text-destructive">
|
||||
{execution.error}
|
||||
</p>
|
||||
)}
|
||||
{(['images', 'volumes', 'networks'] as FleetPruneTarget[]).map((target) => {
|
||||
const targetItems = items.filter((item) => item.target === target);
|
||||
const bytes = targetItems.reduce((sum, item) => sum + (item.sizeBytes ?? 0), 0);
|
||||
return (
|
||||
<details key={target} open={targetItems.length > 0} className="rounded border border-card-border/40">
|
||||
<summary className="cursor-pointer px-2 py-1.5 font-mono text-[11px] text-stat-subtitle">
|
||||
{TARGET_LABELS[target]} · {targetItems.length} · {formatBytes(bytes)}
|
||||
</summary>
|
||||
{targetItems.length > 0 && (
|
||||
<ul className="space-y-1.5 border-t border-card-border/40 p-2">
|
||||
{targetItems.map((item) => (
|
||||
<ItemRow
|
||||
key={`${item.target}:${item.id}`}
|
||||
item={item}
|
||||
outcome={outcomesByItem.get(`${item.target}\0${item.id}`)}
|
||||
/>
|
||||
))}
|
||||
</ul>
|
||||
)}
|
||||
</details>
|
||||
);
|
||||
})}
|
||||
{execution && !execution.error && !execution.outcomes && (
|
||||
<p className="text-[11px] text-stat-subtitle">
|
||||
This node reported {formatBytes(execution.reclaimedBytes ?? 0)} reclaimed without itemized outcomes.
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
</details>
|
||||
);
|
||||
}
|
||||
|
||||
export function PrunePlanResults({ planResults, executeResults }: Props) {
|
||||
const executionByNode = new Map(executeResults?.map((result) => [result.nodeId, result]));
|
||||
return (
|
||||
<div className="space-y-2">
|
||||
{planResults.map((plan) => (
|
||||
<NodePlan key={plan.nodeId} plan={plan} execution={executionByNode.get(plan.nodeId)} />
|
||||
))}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -1,11 +1,4 @@
|
||||
/**
|
||||
* Coverage for FleetPruneCard.
|
||||
*
|
||||
* The key safety property: the destructive "Prune fleet" confirm is blocked
|
||||
* until the operator has seen a live reclaim estimate. Also locks dry-run
|
||||
* payload shape, the all-scope confirm copy, and the failure toast.
|
||||
*/
|
||||
import { it, expect, vi, beforeEach } from 'vitest';
|
||||
import { beforeEach, expect, it, vi } from 'vitest';
|
||||
import { render, screen, waitFor, within } from '@testing-library/react';
|
||||
import userEvent from '@testing-library/user-event';
|
||||
|
||||
@@ -16,18 +9,18 @@ const toastSuccess = vi.fn();
|
||||
const toastWarning = vi.fn();
|
||||
vi.mock('@/components/ui/toast-store', () => ({
|
||||
toast: {
|
||||
error: (...a: unknown[]) => toastError(...a),
|
||||
success: (...a: unknown[]) => toastSuccess(...a),
|
||||
error: (...args: unknown[]) => toastError(...args),
|
||||
success: (...args: unknown[]) => toastSuccess(...args),
|
||||
warning: (...args: unknown[]) => toastWarning(...args),
|
||||
info: vi.fn(),
|
||||
warning: (...a: unknown[]) => toastWarning(...a),
|
||||
loading: vi.fn(() => 'toast-id'),
|
||||
dismiss: vi.fn(),
|
||||
},
|
||||
}));
|
||||
|
||||
import { apiFetch } from '@/lib/api';
|
||||
import { FleetPruneCard } from './FleetPruneCard';
|
||||
import type { FleetNode } from '@/components/FleetView/types';
|
||||
import { FleetPruneCard } from './FleetPruneCard';
|
||||
|
||||
const mockedFetch = apiFetch as unknown as ReturnType<typeof vi.fn>;
|
||||
|
||||
@@ -37,241 +30,322 @@ function jsonResponse(status: number, body: unknown): Response {
|
||||
|
||||
const nodes = [{ id: 1, name: 'central', status: 'online' }] as unknown as FleetNode[];
|
||||
|
||||
const planResult = {
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
fingerprint: 'reviewed-fingerprint',
|
||||
reclaimableBytes: 4096,
|
||||
items: [{
|
||||
target: 'images',
|
||||
id: 'sha256:abcdef1234567890',
|
||||
name: 'example/app:latest',
|
||||
sizeBytes: 4096,
|
||||
managed: true,
|
||||
reason: 'Image is not used by any container',
|
||||
stackName: 'app',
|
||||
image: {
|
||||
references: ['example/app:latest'],
|
||||
digest: 'example/app@sha256:digest',
|
||||
createdAt: 1_700_000_000,
|
||||
},
|
||||
}],
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 4096, dryRun: true }],
|
||||
};
|
||||
|
||||
function estimateResponse() {
|
||||
return jsonResponse(200, {
|
||||
totalBytes: 4096,
|
||||
perNode: [{ nodeId: 1, nodeName: 'central', reclaimableBytes: 4096, reachable: true }],
|
||||
});
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
mockedFetch.mockResolvedValue(jsonResponse(404, {}));
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
});
|
||||
|
||||
it('blocks the prune confirm until a reclaim estimate is ready', async () => {
|
||||
// Estimate endpoint never resolves to ready (404 -> unavailable).
|
||||
it('keeps destructive prune disabled until an itemized dry run is reviewed', async () => {
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
// images is selected by default, so an estimate is requested but unavailable.
|
||||
await waitFor(() => expect(screen.getByText('~ estimate unavailable')).toBeInTheDocument());
|
||||
await waitFor(() => expect(screen.getByText('~ 4 KB reclaimable')).toBeInTheDocument());
|
||||
expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeDisabled();
|
||||
});
|
||||
|
||||
it('enables the prune confirm once the estimate resolves', async () => {
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') {
|
||||
return Promise.resolve(jsonResponse(200, { totalBytes: 1024, perNode: [{ nodeId: 1, nodeName: 'central', reclaimableBytes: 1024, reachable: true }] }));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
});
|
||||
|
||||
it('all-scope confirm spells out the irreversible all-unused prune', async () => {
|
||||
it('renders item metadata and enables prune after a valid dry run', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') {
|
||||
return Promise.resolve(jsonResponse(200, { totalBytes: 2048, perNode: [] }));
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') return Promise.resolve(jsonResponse(200, { results: [planResult] }));
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
expect(screen.getByText('example/app:latest')).toBeInTheDocument();
|
||||
expect(screen.getByText('managed')).toBeInTheDocument();
|
||||
expect(screen.getByText(/stack app/)).toBeInTheDocument();
|
||||
expect(screen.getByText('example/app@sha256:digest')).toBeInTheDocument();
|
||||
const dryRunCall = mockedFetch.mock.calls.find((call) => call[0] === '/fleet/labels/fleet-prune');
|
||||
expect(JSON.parse(dryRunCall![1].body)).toEqual({ targets: ['images'], scope: 'managed', dryRun: true });
|
||||
});
|
||||
|
||||
it('submits the reviewed roster and fingerprint then renders item outcomes', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string, init?: RequestInit) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
const body = JSON.parse(String(init?.body));
|
||||
if (body.dryRun) return Promise.resolve(jsonResponse(200, { results: [planResult] }));
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
results: [{
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
reclaimedBytes: 4096,
|
||||
outcomes: [{ id: 'sha256:abcdef1234567890', target: 'images', status: 'removed', sizeBytes: 4096 }],
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 4096, dryRun: false, removed: 1, skipped: 0, failed: 0 }],
|
||||
}],
|
||||
}));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'All unused' }));
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
await user.click(screen.getByRole('button', { name: 'Prune fleet' }));
|
||||
const dialog = await screen.findByRole('alertdialog');
|
||||
expect(within(dialog).getByText('Prune ALL unused resources across the fleet?')).toBeInTheDocument();
|
||||
expect(within(dialog).getByText(/This cannot be undone\./)).toBeInTheDocument();
|
||||
await user.click(within(await screen.findByRole('alertdialog')).getByRole('button', { name: 'Prune managed' }));
|
||||
|
||||
await waitFor(() => expect(screen.getByText('removed')).toBeInTheDocument());
|
||||
const executeCall = mockedFetch.mock.calls
|
||||
.filter((call) => call[0] === '/fleet/labels/fleet-prune')
|
||||
.find((call) => JSON.parse(call[1].body).dryRun === false);
|
||||
expect(JSON.parse(executeCall![1].body)).toEqual({
|
||||
targets: ['images'],
|
||||
scope: 'managed',
|
||||
dryRun: false,
|
||||
reviewedNodes: [{ nodeId: 1, reachable: true }],
|
||||
plans: [{ nodeId: 1, fingerprint: 'reviewed-fingerprint' }],
|
||||
});
|
||||
expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeDisabled();
|
||||
});
|
||||
|
||||
it('dry run sends dryRun:true and reports reclaimable bytes', async () => {
|
||||
it('invalidates authorization when targets or scope change', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') {
|
||||
return Promise.resolve(jsonResponse(200, { totalBytes: 0, perNode: [] }));
|
||||
}
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') return Promise.resolve(jsonResponse(200, { results: [planResult] }));
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
await user.click(screen.getByRole('checkbox', { name: 'Volumes' }));
|
||||
expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeDisabled();
|
||||
expect(screen.queryByText('example/app:latest')).not.toBeInTheDocument();
|
||||
});
|
||||
|
||||
it('invalidates authorization when the node roster or status changes', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') return Promise.resolve(jsonResponse(200, { results: [planResult] }));
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
const view = render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
view.rerender(<FleetPruneCard nodes={[{ ...nodes[0], status: 'offline' }]} />);
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeDisabled());
|
||||
});
|
||||
|
||||
it('shows unreachable nodes as excluded without treating them as empty plans', async () => {
|
||||
const user = userEvent.setup();
|
||||
const unreachable = {
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: false,
|
||||
error: 'Pilot tunnel is disconnected',
|
||||
reclaimableBytes: 0,
|
||||
targets: [{ target: 'images', success: false, reclaimedBytes: 0, dryRun: true, error: 'Pilot tunnel is disconnected' }],
|
||||
};
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') return Promise.resolve(jsonResponse(200, { results: [unreachable] }));
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
expect(await screen.findByText('central · excluded')).toBeInTheDocument();
|
||||
expect(screen.getByText('Pilot tunnel is disconnected')).toBeInTheDocument();
|
||||
});
|
||||
|
||||
it('accepts a valid empty plan', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') return Promise.resolve(jsonResponse(200, {
|
||||
results: [{ ...planResult, items: [], reclaimableBytes: 0, targets: [{ ...planResult.targets[0], reclaimedBytes: 0 }] }],
|
||||
}));
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
expect(screen.getByText('Images · 0 · 0 Bytes')).toBeInTheDocument();
|
||||
});
|
||||
|
||||
it('uses the exact stale-plan toast and clears authorization', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string, init?: RequestInit) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
results: [{ nodeId: 1, nodeName: 'central', reachable: true, targets: [{ target: 'images', success: true, reclaimedBytes: 4096, dryRun: true }] }],
|
||||
const body = JSON.parse(String(init?.body));
|
||||
if (body.dryRun) return Promise.resolve(jsonResponse(200, { results: [planResult] }));
|
||||
return Promise.resolve(jsonResponse(409, {
|
||||
code: 'PRUNE_PLAN_STALE',
|
||||
nodeId: 1,
|
||||
error: 'The prune plan changed on central after the dry run',
|
||||
}));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => {
|
||||
const call = mockedFetch.mock.calls.find(c => c[0] === '/fleet/labels/fleet-prune');
|
||||
expect(call).toBeTruthy();
|
||||
expect(JSON.parse(call![1].body)).toEqual({ targets: ['images'], scope: 'managed', dryRun: true });
|
||||
});
|
||||
await waitFor(() => expect(toastSuccess).toHaveBeenCalled());
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
await user.click(screen.getByRole('button', { name: 'Prune fleet' }));
|
||||
await user.click(within(await screen.findByRole('alertdialog')).getByRole('button', { name: 'Prune managed' }));
|
||||
await waitFor(() => expect(toastError).toHaveBeenCalledWith(
|
||||
'The prune plan changed on “central” after the dry run. Run the dry run again before pruning.',
|
||||
));
|
||||
expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeDisabled();
|
||||
expect(screen.queryByText('example/app:latest')).not.toBeInTheDocument();
|
||||
});
|
||||
|
||||
it('surfaces an error toast when the prune returns non-ok', async () => {
|
||||
it('reports an execution-time stale race from a partial result', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
mockedFetch.mockImplementation((url: string, init?: RequestInit) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
return Promise.resolve(jsonResponse(500, { error: 'prune blew up' }));
|
||||
const body = JSON.parse(String(init?.body));
|
||||
if (body.dryRun) return Promise.resolve(jsonResponse(200, { results: [planResult] }));
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
results: [{
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
code: 'PRUNE_PLAN_STALE',
|
||||
error: 'Prune plan changed',
|
||||
reclaimedBytes: 0,
|
||||
targets: [{ target: 'images', success: false, reclaimedBytes: 0, dryRun: false, error: 'Prune plan changed' }],
|
||||
}],
|
||||
}));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(toastError).toHaveBeenCalledWith('prune blew up'));
|
||||
});
|
||||
|
||||
function estimateCallCount(): number {
|
||||
return mockedFetch.mock.calls.filter(c => c[0] === '/fleet/prune/estimate').length;
|
||||
}
|
||||
|
||||
it('re-fetches the estimate after a partial-success real prune', async () => {
|
||||
const user = userEvent.setup();
|
||||
let estimatePhase: 'pre' | 'post' = 'pre';
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') {
|
||||
if (estimatePhase === 'pre') {
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
totalBytes: 1024,
|
||||
perNode: [{ nodeId: 1, nodeName: 'central', reclaimableBytes: 1024, reachable: true }],
|
||||
}));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
totalBytes: 0,
|
||||
perNode: [{ nodeId: 1, nodeName: 'central', reclaimableBytes: 0, reachable: true }],
|
||||
}));
|
||||
}
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
// One target succeeded before a later failure left the node unreachable.
|
||||
// reachable:false must not suppress the refresh (target.success is the signal).
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
results: [{
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: false,
|
||||
error: 'transport failed after images',
|
||||
targets: [
|
||||
{ target: 'images', success: true, reclaimedBytes: 1024 },
|
||||
{ target: 'volumes', success: false, reclaimedBytes: 0, error: 'unreachable' },
|
||||
],
|
||||
}],
|
||||
}));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
expect(screen.getByText('~ 1 KB reclaimable')).toBeInTheDocument();
|
||||
expect(screen.getByText('1 KB')).toBeInTheDocument();
|
||||
const callsBeforePrune = estimateCallCount();
|
||||
|
||||
await user.click(screen.getByRole('button', { name: 'Prune fleet' }));
|
||||
const dialog = await screen.findByRole('alertdialog');
|
||||
estimatePhase = 'post';
|
||||
await user.click(within(dialog).getByRole('button', { name: 'Prune managed' }));
|
||||
await user.click(within(await screen.findByRole('alertdialog')).getByRole('button', { name: 'Prune managed' }));
|
||||
|
||||
await waitFor(() => expect(estimateCallCount()).toBe(callsBeforePrune + 1));
|
||||
const postEstimateCall = [...mockedFetch.mock.calls].reverse().find(c => c[0] === '/fleet/prune/estimate');
|
||||
expect(postEstimateCall).toBeTruthy();
|
||||
expect(JSON.parse(postEstimateCall![1].body)).toEqual({ targets: ['images'], scope: 'managed' });
|
||||
await waitFor(() => expect(screen.getByText('0 reclaimable')).toBeInTheDocument());
|
||||
await waitFor(() => expect(screen.getByText('0 Bytes')).toBeInTheDocument());
|
||||
await waitFor(() => expect(toastError).toHaveBeenCalledWith(
|
||||
'The prune plan changed on “central” after the dry run. Run the dry run again before pruning.',
|
||||
));
|
||||
expect(toastWarning).not.toHaveBeenCalled();
|
||||
expect(screen.getByText('Prune plan changed')).toBeInTheDocument();
|
||||
});
|
||||
|
||||
it('does not re-fetch the estimate after a dry run', async () => {
|
||||
it('rejects an incomplete successful execute response', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') {
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
totalBytes: 1024,
|
||||
perNode: [{ nodeId: 1, nodeName: 'central', reclaimableBytes: 1024, reachable: true }],
|
||||
}));
|
||||
}
|
||||
mockedFetch.mockImplementation((url: string, init?: RequestInit) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
results: [{
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 4096, dryRun: true }],
|
||||
}],
|
||||
}));
|
||||
const body = JSON.parse(String(init?.body));
|
||||
if (body.dryRun) return Promise.resolve(jsonResponse(200, { results: [planResult] }));
|
||||
return Promise.resolve(jsonResponse(200, { results: [] }));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
const callsBefore = estimateCallCount();
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(toastSuccess).toHaveBeenCalled());
|
||||
// Debounce window: a refresh would schedule another estimate within 350ms.
|
||||
await new Promise(r => setTimeout(r, 500));
|
||||
expect(estimateCallCount()).toBe(callsBefore);
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
await user.click(screen.getByRole('button', { name: 'Prune fleet' }));
|
||||
await user.click(within(await screen.findByRole('alertdialog')).getByRole('button', { name: 'Prune managed' }));
|
||||
|
||||
await waitFor(() => expect(toastError).toHaveBeenCalledWith('Fleet prune returned an incomplete node result set'));
|
||||
expect(toastSuccess).not.toHaveBeenCalledWith(expect.stringContaining('Reclaimed'));
|
||||
});
|
||||
|
||||
it('does not re-fetch the estimate when every target fails on a 2xx response', async () => {
|
||||
it.each([
|
||||
['unexpected node', [{ nodeId: 99, nodeName: 'other', reachable: true, reclaimedBytes: 0, targets: [] }]],
|
||||
['malformed target', [{ nodeId: 1, nodeName: 'central', reachable: true, reclaimedBytes: 0, targets: [null] }]],
|
||||
['negative total', [{
|
||||
nodeId: 1, nodeName: 'central', reachable: true, reclaimedBytes: -1,
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 0, dryRun: false }],
|
||||
}]],
|
||||
['malformed outcomes', [{
|
||||
nodeId: 1, nodeName: 'central', reachable: true, reclaimedBytes: 0,
|
||||
outcomes: [{ target: 'images', id: 'sha256:abcdef1234567890', status: 'failed' }],
|
||||
targets: [{ target: 'images', success: false, reclaimedBytes: 0, dryRun: false }],
|
||||
}]],
|
||||
])('rejects an execute response with %s', async (_label, results) => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') {
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
totalBytes: 1024,
|
||||
perNode: [{ nodeId: 1, nodeName: 'central', reclaimableBytes: 1024, reachable: true }],
|
||||
}));
|
||||
}
|
||||
mockedFetch.mockImplementation((url: string, init?: RequestInit) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
const body = JSON.parse(String(init?.body));
|
||||
return Promise.resolve(jsonResponse(200, body.dryRun ? { results: [planResult] } : { results }));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
await user.click(screen.getByRole('button', { name: 'Prune fleet' }));
|
||||
await user.click(within(await screen.findByRole('alertdialog')).getByRole('button', { name: 'Prune managed' }));
|
||||
await waitFor(() => expect(toastError).toHaveBeenCalledWith('Fleet prune returned an incomplete node result set'));
|
||||
expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeDisabled();
|
||||
});
|
||||
|
||||
it('warns when another node mutated before an execution-time stale result', async () => {
|
||||
const user = userEvent.setup();
|
||||
const twoNodes = [...nodes, { id: 2, name: 'edge', status: 'online' }] as unknown as FleetNode[];
|
||||
const edgePlan = { ...planResult, nodeId: 2, nodeName: 'edge', fingerprint: 'edge-fingerprint' };
|
||||
mockedFetch.mockImplementation((url: string, init?: RequestInit) => {
|
||||
if (url === '/fleet/prune/estimate') return Promise.resolve(estimateResponse());
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
const body = JSON.parse(String(init?.body));
|
||||
if (body.dryRun) return Promise.resolve(jsonResponse(200, { results: [planResult, edgePlan] }));
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
results: [{
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
targets: [{ target: 'images', success: false, reclaimedBytes: 0, error: 'A prune is already running on this node' }],
|
||||
}],
|
||||
results: [
|
||||
{
|
||||
nodeId: 1, nodeName: 'central', reachable: true, reclaimedBytes: 4096,
|
||||
outcomes: [{ id: 'sha256:abcdef1234567890', target: 'images', status: 'removed', sizeBytes: 4096 }],
|
||||
targets: [{ target: 'images', success: true, reclaimedBytes: 4096, dryRun: false }],
|
||||
},
|
||||
{
|
||||
nodeId: 2, nodeName: 'edge', reachable: true, code: 'PRUNE_PLAN_STALE',
|
||||
error: 'Prune plan changed', reclaimedBytes: 0,
|
||||
targets: [{ target: 'images', success: false, reclaimedBytes: 0, dryRun: false, error: 'Prune plan changed' }],
|
||||
},
|
||||
],
|
||||
}));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
const callsBefore = estimateCallCount();
|
||||
await user.click(screen.getByRole('button', { name: 'Prune fleet' }));
|
||||
const dialog = await screen.findByRole('alertdialog');
|
||||
await user.click(within(dialog).getByRole('button', { name: 'Prune managed' }));
|
||||
await waitFor(() => expect(toastError).toHaveBeenCalled());
|
||||
await new Promise(r => setTimeout(r, 500));
|
||||
expect(estimateCallCount()).toBe(callsBefore);
|
||||
});
|
||||
|
||||
it('warns instead of claiming total failure when a reachable node has mixed per-target outcomes', async () => {
|
||||
const user = userEvent.setup();
|
||||
mockedFetch.mockImplementation((url: string) => {
|
||||
if (url === '/fleet/prune/estimate') {
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
totalBytes: 1024,
|
||||
perNode: [{ nodeId: 1, nodeName: 'central', reclaimableBytes: 1024, reachable: true }],
|
||||
}));
|
||||
}
|
||||
if (url === '/fleet/labels/fleet-prune') {
|
||||
// Images succeed, volumes fail on the same reachable node. Pre-fix toast
|
||||
// logic treated the node as fully failed (okNodes=0) and said every node
|
||||
// failed even though Docker mutated for images.
|
||||
return Promise.resolve(jsonResponse(200, {
|
||||
results: [{
|
||||
nodeId: 1,
|
||||
nodeName: 'central',
|
||||
reachable: true,
|
||||
targets: [
|
||||
{ target: 'images', success: true, reclaimedBytes: 1024 },
|
||||
{ target: 'volumes', success: false, reclaimedBytes: 0, error: 'volume prune failed' },
|
||||
],
|
||||
}],
|
||||
}));
|
||||
}
|
||||
return Promise.resolve(jsonResponse(404, {}));
|
||||
});
|
||||
|
||||
render(<FleetPruneCard nodes={nodes} />);
|
||||
render(<FleetPruneCard nodes={twoNodes} />);
|
||||
await user.click(screen.getByRole('button', { name: 'Dry run' }));
|
||||
await waitFor(() => expect(screen.getByRole('button', { name: 'Prune fleet' })).toBeEnabled());
|
||||
await user.click(screen.getByRole('button', { name: 'Prune fleet' }));
|
||||
const dialog = await screen.findByRole('alertdialog');
|
||||
await user.click(within(dialog).getByRole('button', { name: 'Prune managed' }));
|
||||
await user.click(within(await screen.findByRole('alertdialog')).getByRole('button', { name: 'Prune managed' }));
|
||||
|
||||
await waitFor(() => expect(toastWarning).toHaveBeenCalled());
|
||||
expect(toastWarning.mock.calls[0][0]).toMatch(/1\/1 nodes reclaimed space/);
|
||||
expect(toastError).not.toHaveBeenCalledWith('Prune failed on every node. See results below.');
|
||||
await waitFor(() => expect(toastWarning).toHaveBeenCalledWith(
|
||||
'Fleet prune partially completed: 4 KB reclaimed before the plan changed on “edge”. Run the dry run again before pruning.',
|
||||
));
|
||||
});
|
||||
|
||||
@@ -8,24 +8,32 @@ import { apiFetch } from '@/lib/api';
|
||||
import { toast } from '@/components/ui/toast-store';
|
||||
import { cn, formatBytes } from '@/lib/utils';
|
||||
import type { FleetNode } from '@/components/FleetView/types';
|
||||
import { ResultsList, type ResultRow } from '../ResultsList';
|
||||
import type {
|
||||
FleetPruneNodeResult,
|
||||
FleetPruneTarget,
|
||||
PruneScope,
|
||||
} from '@/lib/prunePlan';
|
||||
import { isPruneItemOutcome, isPrunePlanItem } from '@/lib/prunePlan';
|
||||
import { PrunePlanResults } from '../PrunePlanResults';
|
||||
|
||||
type PruneTarget = 'images' | 'volumes' | 'networks';
|
||||
type PruneScope = 'managed' | 'all';
|
||||
|
||||
const ALL_TARGETS: ReadonlyArray<{ id: PruneTarget; label: string }> = [
|
||||
const ALL_TARGETS: ReadonlyArray<{ id: FleetPruneTarget; label: string }> = [
|
||||
{ id: 'images', label: 'Images' },
|
||||
{ id: 'volumes', label: 'Volumes' },
|
||||
{ id: 'networks', label: 'Networks' },
|
||||
];
|
||||
|
||||
interface TargetResult { target: PruneTarget; success: boolean; reclaimedBytes: number; error?: string; dryRun?: boolean }
|
||||
interface FleetPruneNodeResult {
|
||||
nodeId: number; nodeName: string; reachable: boolean; error?: string; targets: TargetResult[];
|
||||
interface PruneEstimateNode {
|
||||
nodeId: number;
|
||||
nodeName: string;
|
||||
reclaimableBytes: number;
|
||||
reachable: boolean;
|
||||
error?: string;
|
||||
}
|
||||
|
||||
interface PruneEstimateNode { nodeId: number; nodeName: string; reclaimableBytes: number; reachable: boolean; error?: string }
|
||||
interface PruneEstimateResponse { totalBytes: number; perNode: PruneEstimateNode[] }
|
||||
interface PruneEstimateResponse {
|
||||
totalBytes: number;
|
||||
perNode: PruneEstimateNode[];
|
||||
}
|
||||
|
||||
type EstimateState =
|
||||
| { kind: 'idle' }
|
||||
@@ -33,6 +41,11 @@ type EstimateState =
|
||||
| { kind: 'unavailable' }
|
||||
| { kind: 'ready'; data: PruneEstimateResponse };
|
||||
|
||||
interface ReviewedPlanState {
|
||||
key: string;
|
||||
results: FleetPruneNodeResult[];
|
||||
}
|
||||
|
||||
interface Props {
|
||||
nodes: FleetNode[];
|
||||
}
|
||||
@@ -40,54 +53,128 @@ interface Props {
|
||||
const KICKER = 'font-mono text-[10px] uppercase tracking-[0.18em]';
|
||||
const ESTIMATE_ROW_LIMIT = 6;
|
||||
|
||||
function reviewStateIsValid(
|
||||
reviewed: ReviewedPlanState | null,
|
||||
reviewKey: string,
|
||||
nodes: FleetNode[],
|
||||
selectedTargets: FleetPruneTarget[],
|
||||
): reviewed is ReviewedPlanState {
|
||||
if (!reviewed || reviewed.key !== reviewKey || reviewed.results.length !== nodes.length) return false;
|
||||
const currentIds = new Set(nodes.map((node) => node.id));
|
||||
const resultIds = new Set(reviewed.results.map((result) => result.nodeId));
|
||||
return resultIds.size === reviewed.results.length
|
||||
&& reviewed.results.every((result) => currentIds.has(result.nodeId)
|
||||
&& (result.reachable
|
||||
? typeof result.fingerprint === 'string' && result.fingerprint.length > 0
|
||||
&& Array.isArray(result.items) && result.items.every((item) => isPrunePlanItem(item) && selectedTargets.includes(item.target as FleetPruneTarget))
|
||||
: !result.fingerprint));
|
||||
}
|
||||
|
||||
function executeResultsAreValid(
|
||||
value: unknown,
|
||||
reviewedResults: FleetPruneNodeResult[],
|
||||
selectedTargets: FleetPruneTarget[],
|
||||
): value is FleetPruneNodeResult[] {
|
||||
if (!Array.isArray(value)) return false;
|
||||
const expectedIds = reviewedResults.filter((result) => result.reachable).map((result) => result.nodeId);
|
||||
if (value.length !== expectedIds.length) return false;
|
||||
const seen = new Set<number>();
|
||||
return value.every((result) => {
|
||||
if (!result || typeof result !== 'object') return false;
|
||||
const entry = result as Partial<FleetPruneNodeResult>;
|
||||
if (!Number.isInteger(entry.nodeId) || seen.has(entry.nodeId as number)) return false;
|
||||
seen.add(entry.nodeId as number);
|
||||
if (!expectedIds.includes(entry.nodeId as number)) return false;
|
||||
if (typeof entry.nodeName !== 'string' || typeof entry.reachable !== 'boolean' || !Array.isArray(entry.targets)) return false;
|
||||
const targetIds = new Set<FleetPruneTarget>();
|
||||
for (const target of entry.targets) {
|
||||
if (!target || typeof target !== 'object') return false;
|
||||
const row = target as Partial<FleetPruneNodeResult['targets'][number]>;
|
||||
if (!selectedTargets.includes(row.target as FleetPruneTarget) || targetIds.has(row.target as FleetPruneTarget)
|
||||
|| typeof row.success !== 'boolean' || row.dryRun !== false
|
||||
|| typeof row.reclaimedBytes !== 'number' || !Number.isFinite(row.reclaimedBytes) || row.reclaimedBytes < 0) return false;
|
||||
for (const count of [row.removed, row.skipped, row.failed]) {
|
||||
if (count !== undefined && (!Number.isInteger(count) || count < 0)) return false;
|
||||
}
|
||||
targetIds.add(row.target as FleetPruneTarget);
|
||||
}
|
||||
if (targetIds.size !== selectedTargets.length) return false;
|
||||
if (entry.reclaimedBytes !== undefined
|
||||
&& (typeof entry.reclaimedBytes !== 'number' || !Number.isFinite(entry.reclaimedBytes) || entry.reclaimedBytes < 0)) return false;
|
||||
if (entry.outcomes !== undefined) {
|
||||
if (!Array.isArray(entry.outcomes) || !entry.outcomes.every(isPruneItemOutcome)) return false;
|
||||
const reviewed = reviewedResults.find((result) => result.nodeId === entry.nodeId);
|
||||
const expectedItems = new Set((reviewed?.items ?? []).map((item) => `${item.target}\0${item.id}`));
|
||||
const outcomeKeys = new Set(entry.outcomes.map((outcome) => `${outcome.target}\0${outcome.id}`));
|
||||
if (outcomeKeys.size !== entry.outcomes.length || outcomeKeys.size !== expectedItems.size
|
||||
|| [...outcomeKeys].some((key) => !expectedItems.has(key))) return false;
|
||||
}
|
||||
return true;
|
||||
});
|
||||
}
|
||||
|
||||
export function FleetPruneCard({ nodes }: Props) {
|
||||
const nodeCount = nodes.length;
|
||||
const [targets, setTargets] = useState<Set<PruneTarget>>(new Set(['images']));
|
||||
const [targets, setTargets] = useState<Set<FleetPruneTarget>>(new Set(['images']));
|
||||
const [scope, setScope] = useState<PruneScope>('managed');
|
||||
const [confirmOpen, setConfirmOpen] = useState(false);
|
||||
const [running, setRunning] = useState(false);
|
||||
const [results, setResults] = useState<ResultRow[]>([]);
|
||||
const [estimate, setEstimate] = useState<EstimateState>({ kind: 'idle' });
|
||||
// Bumped after a real prune mutates at least one target so the estimate
|
||||
// effect re-runs without changing targets/scope.
|
||||
const [planResults, setPlanResults] = useState<FleetPruneNodeResult[]>([]);
|
||||
const [displayKey, setDisplayKey] = useState('');
|
||||
const [executeResults, setExecuteResults] = useState<FleetPruneNodeResult[] | undefined>();
|
||||
const [reviewed, setReviewed] = useState<ReviewedPlanState | null>(null);
|
||||
const [estimate, setEstimate] = useState<EstimateState>({ kind: 'loading' });
|
||||
const [estimateEpoch, setEstimateEpoch] = useState(0);
|
||||
|
||||
const toggleTarget = (target: PruneTarget) => {
|
||||
setTargets(prev => {
|
||||
const next = new Set(prev);
|
||||
const selectedTargets = useMemo(() => [...targets].sort(), [targets]);
|
||||
const rosterKey = useMemo(
|
||||
() => nodes.map((node) => `${node.id}:${node.status}`).sort().join(','),
|
||||
[nodes],
|
||||
);
|
||||
const reviewKey = `${selectedTargets.join(',')}|${scope}|${rosterKey}`;
|
||||
const reviewValid = reviewStateIsValid(reviewed, reviewKey, nodes, selectedTargets);
|
||||
|
||||
const toggleTarget = (target: FleetPruneTarget) => {
|
||||
setReviewed(null);
|
||||
setExecuteResults(undefined);
|
||||
setEstimate({ kind: 'loading' });
|
||||
setTargets((current) => {
|
||||
const next = new Set(current);
|
||||
if (next.has(target)) next.delete(target);
|
||||
else next.add(target);
|
||||
return next;
|
||||
});
|
||||
};
|
||||
|
||||
// Re-estimate when the operator's choices change. Debounced because each
|
||||
// tick fans out per-target HTTP to every remote node; back-to-back clicks
|
||||
// on the target checkboxes would otherwise pile concurrent fleet-wide fans
|
||||
// onto the backend.
|
||||
const changeScope = (nextScope: PruneScope) => {
|
||||
setReviewed(null);
|
||||
setExecuteResults(undefined);
|
||||
setEstimate({ kind: 'loading' });
|
||||
setScope(nextScope);
|
||||
};
|
||||
|
||||
const estimateDebounceRef = useRef<ReturnType<typeof setTimeout> | null>(null);
|
||||
useEffect(() => {
|
||||
if (estimateDebounceRef.current) clearTimeout(estimateDebounceRef.current);
|
||||
if (targets.size === 0) {
|
||||
setEstimate({ kind: 'idle' });
|
||||
return;
|
||||
}
|
||||
let cancelled = false;
|
||||
setEstimate({ kind: 'loading' });
|
||||
estimateDebounceRef.current = setTimeout(async () => {
|
||||
if (!cancelled) setEstimate({ kind: 'loading' });
|
||||
try {
|
||||
const res = await apiFetch('/fleet/prune/estimate', {
|
||||
const response = await apiFetch('/fleet/prune/estimate', {
|
||||
method: 'POST',
|
||||
body: JSON.stringify({ targets: Array.from(targets), scope }),
|
||||
body: JSON.stringify({ targets: selectedTargets, scope }),
|
||||
});
|
||||
if (cancelled) return;
|
||||
if (res.status === 404 || !res.ok) {
|
||||
if (!response.ok) {
|
||||
setEstimate({ kind: 'unavailable' });
|
||||
return;
|
||||
}
|
||||
const data = (await res.json()) as PruneEstimateResponse;
|
||||
const data = await response.json() as PruneEstimateResponse;
|
||||
if (!cancelled) setEstimate({ kind: 'ready', data });
|
||||
} catch {
|
||||
} catch (error) {
|
||||
console.error('Failed to estimate fleet prune', error);
|
||||
if (!cancelled) setEstimate({ kind: 'unavailable' });
|
||||
}
|
||||
}, 350);
|
||||
@@ -95,178 +182,173 @@ export function FleetPruneCard({ nodes }: Props) {
|
||||
cancelled = true;
|
||||
if (estimateDebounceRef.current) clearTimeout(estimateDebounceRef.current);
|
||||
};
|
||||
}, [targets, scope, estimateEpoch]);
|
||||
}, [selectedTargets, scope, targets.size, estimateEpoch]);
|
||||
|
||||
async function run(opts: { dryRun: boolean }) {
|
||||
if (targets.size === 0) return;
|
||||
const selected = Array.from(targets);
|
||||
const verb = opts.dryRun ? 'Dry-running prune of' : 'Pruning';
|
||||
const toastId = toast.loading(`${verb} ${selected.join(', ')} across the fleet…`);
|
||||
const runDryRun = async () => {
|
||||
if (selectedTargets.length === 0) return;
|
||||
const toastId = toast.loading(`Building prune plans for ${selectedTargets.join(', ')}…`);
|
||||
setRunning(true);
|
||||
setResults([]);
|
||||
setReviewed(null);
|
||||
setExecuteResults(undefined);
|
||||
try {
|
||||
const res = await apiFetch('/fleet/labels/fleet-prune', {
|
||||
const response = await apiFetch('/fleet/labels/fleet-prune', {
|
||||
method: 'POST',
|
||||
body: JSON.stringify({ targets: selected, scope, dryRun: opts.dryRun }),
|
||||
body: JSON.stringify({ targets: selectedTargets, scope, dryRun: true }),
|
||||
});
|
||||
const body = await res.json().catch(() => ({}));
|
||||
toast.dismiss(toastId);
|
||||
if (!res.ok) {
|
||||
toast.error(body.error || 'Fleet prune failed');
|
||||
return;
|
||||
}
|
||||
const apiResults = (body.results as FleetPruneNodeResult[]) ?? [];
|
||||
// HTTP 200 still arrives when every target fails; only a successful
|
||||
// target means Docker state changed and the live estimate is stale.
|
||||
// Scan targets independently of node.reachable (an early remote target
|
||||
// can succeed before a later transport error marks the node unreachable).
|
||||
if (!opts.dryRun && apiResults.some(node => node.targets.some(target => target.success))) {
|
||||
setEstimateEpoch(e => e + 1);
|
||||
}
|
||||
const rows: ResultRow[] = apiResults.map((node) => {
|
||||
const totalBytes = node.targets.reduce((sum, t) => sum + (t.reclaimedBytes ?? 0), 0);
|
||||
const allOk = node.reachable && node.targets.every(t => t.success);
|
||||
return {
|
||||
key: `node-${node.nodeId}`,
|
||||
label: node.reachable
|
||||
? `${node.nodeName} · ${formatBytes(totalBytes)}${opts.dryRun ? ' (dry run)' : ''}`
|
||||
: `${node.nodeName} (unreachable)`,
|
||||
success: allOk,
|
||||
error: node.reachable ? undefined : node.error,
|
||||
sub: node.targets.map((t, i) => ({
|
||||
key: `${node.nodeId}-${t.target}-${i}`,
|
||||
label: `${t.target} · ${formatBytes(t.reclaimedBytes ?? 0)}`,
|
||||
success: t.success,
|
||||
error: t.error,
|
||||
})),
|
||||
};
|
||||
});
|
||||
setResults(rows);
|
||||
const totalNodes = apiResults.length;
|
||||
// Fully OK: every target on a reachable node succeeded. Partial: at
|
||||
// least one target succeeded anywhere (mixed per-target on one node
|
||||
// still counts). "Failed on every node" only when zero targets succeeded.
|
||||
const fullyOkNodes = apiResults.filter(n => n.reachable && n.targets.every(t => t.success)).length;
|
||||
const nodesWithAnySuccess = apiResults.filter(n => n.targets.some(t => t.success)).length;
|
||||
const anyTargetSucceeded = nodesWithAnySuccess > 0;
|
||||
const totalReclaimed = apiResults.reduce(
|
||||
(sum, n) => sum + n.targets.reduce((s, t) => s + (t.reclaimedBytes ?? 0), 0),
|
||||
0,
|
||||
);
|
||||
if (opts.dryRun) {
|
||||
toast.success(`Dry run: ${formatBytes(totalReclaimed)} would be reclaimed across ${totalNodes} node${totalNodes === 1 ? '' : 's'}.`);
|
||||
} else if (fullyOkNodes === totalNodes && totalNodes > 0) {
|
||||
toast.success(`Reclaimed ${formatBytes(totalReclaimed)} across ${totalNodes} node${totalNodes === 1 ? '' : 's'}.`);
|
||||
} else if (!anyTargetSucceeded) {
|
||||
toast.error('Prune failed on every node. See results below.');
|
||||
const data = await response.json().catch(() => null) as { error?: string; results?: FleetPruneNodeResult[] } | null;
|
||||
if (!response.ok) throw new Error(data?.error || 'Failed to build fleet prune plans');
|
||||
const results = Array.isArray(data?.results) ? data.results : [];
|
||||
setPlanResults(results);
|
||||
setDisplayKey(reviewKey);
|
||||
const nextReview = { key: reviewKey, results };
|
||||
if (reviewStateIsValid(nextReview, reviewKey, nodes, selectedTargets)) {
|
||||
setReviewed(nextReview);
|
||||
const total = results.reduce((sum, result) => sum + (result.reclaimableBytes ?? 0), 0);
|
||||
toast.success(`Dry run ready: ${formatBytes(total)} across ${results.length} node${results.length === 1 ? '' : 's'}.`);
|
||||
} else {
|
||||
toast.warning(`${nodesWithAnySuccess}/${totalNodes} nodes reclaimed space · ${formatBytes(totalReclaimed)} reclaimed. See results below.`);
|
||||
toast.error('Dry run did not return a valid plan for every reachable node.');
|
||||
}
|
||||
} catch (err) {
|
||||
toast.dismiss(toastId);
|
||||
toast.error(err instanceof Error ? err.message : 'Network error');
|
||||
} catch (error) {
|
||||
console.error('Failed to build fleet prune plans', error);
|
||||
toast.error(error instanceof Error ? error.message : 'Failed to build fleet prune plans');
|
||||
} finally {
|
||||
toast.dismiss(toastId);
|
||||
setRunning(false);
|
||||
}
|
||||
};
|
||||
|
||||
const runExecute = async () => {
|
||||
if (!reviewValid) return;
|
||||
const reviewedSnapshot = reviewed;
|
||||
const toastId = toast.loading(`Pruning ${selectedTargets.join(', ')} across the fleet…`);
|
||||
setRunning(true);
|
||||
setExecuteResults(undefined);
|
||||
try {
|
||||
const reviewedNodes = reviewedSnapshot.results.map((result) => ({
|
||||
nodeId: result.nodeId,
|
||||
reachable: result.reachable,
|
||||
}));
|
||||
const plans = reviewedSnapshot.results
|
||||
.filter((result) => result.reachable && result.fingerprint)
|
||||
.map((result) => ({ nodeId: result.nodeId, fingerprint: result.fingerprint as string }));
|
||||
const response = await apiFetch('/fleet/labels/fleet-prune', {
|
||||
method: 'POST',
|
||||
body: JSON.stringify({ targets: selectedTargets, scope, dryRun: false, reviewedNodes, plans }),
|
||||
});
|
||||
const data = await response.json().catch(() => null) as {
|
||||
error?: string;
|
||||
code?: string;
|
||||
nodeId?: number;
|
||||
results?: FleetPruneNodeResult[];
|
||||
} | null;
|
||||
if (!response.ok) {
|
||||
if (data?.code === 'PRUNE_PLAN_STALE') {
|
||||
setPlanResults([]);
|
||||
setDisplayKey('');
|
||||
const nodeName = reviewedSnapshot.results.find((result) => result.nodeId === data.nodeId)?.nodeName
|
||||
?? data.error?.match(/on (.+) after/)?.[1]
|
||||
?? 'a node';
|
||||
toast.error(`The prune plan changed on “${nodeName}” after the dry run. Run the dry run again before pruning.`);
|
||||
return;
|
||||
}
|
||||
throw new Error(data?.error || 'Fleet prune failed');
|
||||
}
|
||||
if (!executeResultsAreValid(data?.results, reviewedSnapshot.results, selectedTargets)) {
|
||||
throw new Error('Fleet prune returned an incomplete node result set');
|
||||
}
|
||||
const results = data.results;
|
||||
setExecuteResults(results);
|
||||
const reclaimed = results.reduce((sum, result) => sum + (result.reclaimedBytes ?? 0), 0);
|
||||
const staleResult = results.find((result) => result.code === 'PRUNE_PLAN_STALE');
|
||||
const removedAny = results.some((result) => result.outcomes?.some((outcome) => outcome.status === 'removed'));
|
||||
const failed = results.some((result) => result.targets.some((target) => !target.success));
|
||||
if (staleResult && removedAny) {
|
||||
toast.warning(`Fleet prune partially completed: ${formatBytes(reclaimed)} reclaimed before the plan changed on “${staleResult.nodeName}”. Run the dry run again before pruning.`);
|
||||
} else if (staleResult) {
|
||||
toast.error(`The prune plan changed on “${staleResult.nodeName}” after the dry run. Run the dry run again before pruning.`);
|
||||
} else if (failed) toast.warning(`Fleet prune completed with item failures. ${formatBytes(reclaimed)} reclaimed.`);
|
||||
else toast.success(`Reclaimed ${formatBytes(reclaimed)} across ${results.length} node${results.length === 1 ? '' : 's'}.`);
|
||||
if (removedAny) {
|
||||
setEstimateEpoch((epoch) => epoch + 1);
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('Fleet prune failed', error);
|
||||
toast.error(error instanceof Error ? error.message : 'Fleet prune failed');
|
||||
} finally {
|
||||
setReviewed(null);
|
||||
toast.dismiss(toastId);
|
||||
setRunning(false);
|
||||
setConfirmOpen(false);
|
||||
}
|
||||
}
|
||||
|
||||
const isAllScope = scope === 'all';
|
||||
};
|
||||
|
||||
const blastValue = useMemo(() => {
|
||||
if (targets.size === 0) return 'awaiting target';
|
||||
if (estimate.kind === 'loading') return '~ estimating…';
|
||||
if (estimate.kind === 'unavailable') return '~ estimate unavailable';
|
||||
if (estimate.kind === 'ready') {
|
||||
const { totalBytes } = estimate.data;
|
||||
if (totalBytes === 0) return '0 reclaimable';
|
||||
return `~ ${formatBytes(totalBytes)} reclaimable`;
|
||||
if (estimate.data.totalBytes === 0) return '0 reclaimable';
|
||||
return `~ ${formatBytes(estimate.data.totalBytes)} reclaimable`;
|
||||
}
|
||||
return 'awaiting target';
|
||||
}, [targets.size, estimate]);
|
||||
|
||||
const blastTone = estimate.kind === 'loading' || estimate.kind === 'unavailable' ? 'muted' as const : undefined;
|
||||
const isAllScope = scope === 'all';
|
||||
|
||||
return (
|
||||
<>
|
||||
<FleetActionCard
|
||||
crumb={['Fleet', 'Actions', 'Prune resources']}
|
||||
name="Prune fleet-wide."
|
||||
meta="images · volumes · networks · serial per node"
|
||||
meta="images · volumes · networks · reviewed per node"
|
||||
actionClass="maintenance"
|
||||
blastRadius={{ value: blastValue, tone: blastTone }}
|
||||
secondaryAction={{
|
||||
label: running ? 'Running…' : 'Dry run',
|
||||
onClick: () => run({ dryRun: true }),
|
||||
onClick: runDryRun,
|
||||
disabled: running || targets.size === 0,
|
||||
}}
|
||||
primaryAction={{
|
||||
label: 'Prune fleet',
|
||||
onClick: () => setConfirmOpen(true),
|
||||
variant: 'destructive',
|
||||
// Block the destructive confirm until the operator has actually
|
||||
// seen what the readout says will be reclaimed. Falling back to a
|
||||
// confirm modal with no estimate context is the audit §F20.3 problem.
|
||||
disabled: running || targets.size === 0 || estimate.kind !== 'ready',
|
||||
disabled: running || !reviewValid,
|
||||
}}
|
||||
footerContext={`Reversible · no · serial across ${nodeCount} node${nodeCount === 1 ? '' : 's'}`}
|
||||
footerContext={`Reversible · no · reviewed across ${nodes.length} node${nodes.length === 1 ? '' : 's'}`}
|
||||
>
|
||||
<SheetSection
|
||||
title={`Targets · ${targets.size} / ${ALL_TARGETS.length}`}
|
||||
meta={targets.size === 0 ? 'pick at least one' : undefined}
|
||||
>
|
||||
<SheetSection title={`Targets · ${targets.size} / ${ALL_TARGETS.length}`} meta={targets.size === 0 ? 'pick at least one' : undefined}>
|
||||
<div className="flex flex-wrap gap-3">
|
||||
{ALL_TARGETS.map(t => (
|
||||
<label
|
||||
key={t.id}
|
||||
className="flex items-center gap-2 py-1 px-2 rounded hover:bg-glass-highlight cursor-pointer"
|
||||
>
|
||||
<Checkbox
|
||||
checked={targets.has(t.id)}
|
||||
onCheckedChange={() => toggleTarget(t.id)}
|
||||
disabled={running}
|
||||
/>
|
||||
<span className="text-xs text-stat-value">{t.label}</span>
|
||||
{ALL_TARGETS.map((target) => (
|
||||
<label key={target.id} className="flex cursor-pointer items-center gap-2 rounded px-2 py-1 hover:bg-glass-highlight">
|
||||
<Checkbox checked={targets.has(target.id)} onCheckedChange={() => toggleTarget(target.id)} disabled={running} />
|
||||
<span className="text-xs text-stat-value">{target.label}</span>
|
||||
</label>
|
||||
))}
|
||||
</div>
|
||||
</SheetSection>
|
||||
|
||||
<SheetSection title="Scope" meta={scope === 'managed' ? 'sencho-owned only' : 'all unused'}>
|
||||
<div className="inline-flex rounded-md border border-card-border/60 overflow-hidden">
|
||||
<Button
|
||||
type="button"
|
||||
variant={scope === 'managed' ? 'default' : 'outline'}
|
||||
size="sm"
|
||||
disabled={running}
|
||||
onClick={() => setScope('managed')}
|
||||
className="rounded-none border-0 h-8 px-3 text-xs"
|
||||
>
|
||||
<div className="inline-flex overflow-hidden rounded-md border border-card-border/60">
|
||||
<Button type="button" variant={scope === 'managed' ? 'default' : 'outline'} size="sm" disabled={running} onClick={() => changeScope('managed')} className="h-8 rounded-none border-0 px-3 text-xs">
|
||||
Managed only
|
||||
</Button>
|
||||
<Button
|
||||
type="button"
|
||||
variant={scope === 'all' ? 'default' : 'outline'}
|
||||
size="sm"
|
||||
disabled={running}
|
||||
onClick={() => setScope('all')}
|
||||
className="rounded-none border-0 h-8 px-3 text-xs"
|
||||
>
|
||||
<Button type="button" variant={scope === 'all' ? 'default' : 'outline'} size="sm" disabled={running} onClick={() => changeScope('all')} className="h-8 rounded-none border-0 px-3 text-xs">
|
||||
All unused
|
||||
</Button>
|
||||
</div>
|
||||
<p className="mt-2 text-[11px] text-stat-subtitle">
|
||||
{scope === 'managed'
|
||||
? 'Restricts to resources owned by stacks Sencho manages.'
|
||||
: 'Removes every unused resource, including workloads Sencho does not manage.'}
|
||||
? 'Restricts candidates to resources owned by stacks Sencho manages.'
|
||||
: 'Includes unused resources from workloads Sencho does not manage.'}
|
||||
</p>
|
||||
</SheetSection>
|
||||
|
||||
{targets.size > 0 && <EstimateSection estimate={estimate} />}
|
||||
|
||||
{results.length > 0 && (
|
||||
<SheetSection title="Per-node breakdown">
|
||||
<ResultsList results={results} />
|
||||
{displayKey === reviewKey && planResults.length > 0 && (
|
||||
<SheetSection title={executeResults ? 'Prune outcomes' : 'Reviewed prune plan'}>
|
||||
<PrunePlanResults planResults={planResults} executeResults={executeResults} />
|
||||
</SheetSection>
|
||||
)}
|
||||
</FleetActionCard>
|
||||
@@ -277,14 +359,12 @@ export function FleetPruneCard({ nodes }: Props) {
|
||||
variant="destructive"
|
||||
kicker="Fleet prune"
|
||||
title={isAllScope ? 'Prune ALL unused resources across the fleet?' : 'Prune managed resources across the fleet?'}
|
||||
description={
|
||||
isAllScope
|
||||
? 'This runs docker prune --all on every reachable node. Any image, volume, or network not currently in use will be deleted, including resources from workloads Sencho does not manage. This cannot be undone.'
|
||||
: 'Sencho will remove unused Docker resources owned by stacks known to this fleet on every reachable node. Active resources are not touched.'
|
||||
}
|
||||
description={isAllScope
|
||||
? 'This removes the reviewed unused images, volumes, and networks, including resources from workloads Sencho does not manage. This cannot be undone.'
|
||||
: 'Sencho will remove only the reviewed unused resources owned by stacks known to this fleet. Active resources are not touched.'}
|
||||
confirmLabel={isAllScope ? 'Prune everything unused' : 'Prune managed'}
|
||||
confirming={running}
|
||||
onConfirm={() => run({ dryRun: false })}
|
||||
onConfirm={runExecute}
|
||||
/>
|
||||
</>
|
||||
);
|
||||
@@ -305,35 +385,28 @@ function EstimateSection({ estimate }: { estimate: EstimateState }) {
|
||||
</SheetSection>
|
||||
);
|
||||
}
|
||||
const { perNode } = estimate.data;
|
||||
const visible = perNode.slice(0, ESTIMATE_ROW_LIMIT);
|
||||
const remaining = perNode.length - visible.length;
|
||||
const visible = estimate.data.perNode.slice(0, ESTIMATE_ROW_LIMIT);
|
||||
const remaining = estimate.data.perNode.length - visible.length;
|
||||
return (
|
||||
<SheetSection title="Estimate · per node" meta={`${perNode.length} node${perNode.length === 1 ? '' : 's'}`}>
|
||||
<div className="rounded border border-card-border/60 bg-card/40 shadow-[inset_0_2px_4px_0_oklch(0_0_0_/_0.35)] p-2">
|
||||
<SheetSection title="Estimate · per node" meta={`${estimate.data.perNode.length} node${estimate.data.perNode.length === 1 ? '' : 's'}`}>
|
||||
<div className="rounded border border-card-border/60 bg-card/40 p-2 shadow-[inset_0_2px_4px_0_oklch(0_0_0_/_0.35)]">
|
||||
<ul className="space-y-1">
|
||||
{visible.map((n) => (
|
||||
<li key={n.nodeId} className="flex items-center gap-2">
|
||||
{visible.map((node) => (
|
||||
<li key={node.nodeId} className="flex items-center gap-2">
|
||||
<span className={cn(
|
||||
KICKER,
|
||||
'inline-flex items-center px-1 py-0.5 rounded-sm border shrink-0',
|
||||
n.reachable
|
||||
? 'border-success/40 bg-success/10 text-success'
|
||||
: 'border-stat-subtitle/40 bg-card text-stat-subtitle',
|
||||
'inline-flex shrink-0 items-center rounded-sm border px-1 py-0.5',
|
||||
node.reachable ? 'border-success/40 bg-success/10 text-success' : 'border-stat-subtitle/40 bg-card text-stat-subtitle',
|
||||
)}>
|
||||
{n.reachable ? 'OK' : '--'}
|
||||
{node.reachable ? 'OK' : '--'}
|
||||
</span>
|
||||
<span className="flex-1 min-w-0 truncate font-mono text-[11px] text-stat-value">{n.nodeName}</span>
|
||||
<span className={cn(KICKER, 'shrink-0 tabular-nums', n.reachable ? 'text-stat-subtitle' : 'text-stat-icon')}>
|
||||
{n.reachable ? formatBytes(n.reclaimableBytes) : (n.error ?? 'unreachable')}
|
||||
<span className="min-w-0 flex-1 truncate font-mono text-[11px] text-stat-value">{node.nodeName}</span>
|
||||
<span className={cn(KICKER, 'shrink-0 tabular-nums', node.reachable ? 'text-stat-subtitle' : 'text-stat-icon')}>
|
||||
{node.reachable ? formatBytes(node.reclaimableBytes) : (node.error ?? 'unreachable')}
|
||||
</span>
|
||||
</li>
|
||||
))}
|
||||
{remaining > 0 && (
|
||||
<li className={cn(KICKER, 'text-stat-icon pt-1')}>
|
||||
+ {remaining} more node{remaining === 1 ? '' : 's'}
|
||||
</li>
|
||||
)}
|
||||
{remaining > 0 && <li className={cn(KICKER, 'pt-1 text-stat-icon')}>+ {remaining} more node{remaining === 1 ? '' : 's'}</li>}
|
||||
</ul>
|
||||
</div>
|
||||
</SheetSection>
|
||||
|
||||
@@ -0,0 +1,135 @@
|
||||
export type PruneTarget = 'containers' | 'images' | 'volumes' | 'networks';
|
||||
export type FleetPruneTarget = Exclude<PruneTarget, 'containers'>;
|
||||
export type PruneScope = 'managed' | 'all';
|
||||
|
||||
interface PrunePlanItemBase {
|
||||
id: string;
|
||||
name: string;
|
||||
sizeBytes?: number;
|
||||
managed: boolean;
|
||||
reason: string;
|
||||
stackName?: string;
|
||||
}
|
||||
|
||||
export type PrunePlanItem =
|
||||
| (PrunePlanItemBase & { target: 'containers'; image?: never; volume?: never; network?: never })
|
||||
| (PrunePlanItemBase & {
|
||||
target: 'images';
|
||||
image: {
|
||||
references: string[];
|
||||
digest?: string;
|
||||
createdAt?: number;
|
||||
};
|
||||
volume?: never;
|
||||
network?: never;
|
||||
})
|
||||
| (PrunePlanItemBase & {
|
||||
target: 'volumes';
|
||||
volume: {
|
||||
driver?: string;
|
||||
ownershipLabels?: Record<string, string>;
|
||||
};
|
||||
image?: never;
|
||||
network?: never;
|
||||
})
|
||||
| (PrunePlanItemBase & {
|
||||
target: 'networks';
|
||||
network: {
|
||||
driver?: string;
|
||||
scope?: string;
|
||||
ownershipLabels?: Record<string, string>;
|
||||
};
|
||||
image?: never;
|
||||
volume?: never;
|
||||
});
|
||||
|
||||
export interface PrunePlan {
|
||||
scope: PruneScope;
|
||||
targets: PruneTarget[];
|
||||
items: PrunePlanItem[];
|
||||
reclaimableBytes: number;
|
||||
fingerprint: string;
|
||||
createdAt: number;
|
||||
nodeId: number;
|
||||
}
|
||||
|
||||
export type PruneItemOutcome =
|
||||
| { id: string; target: PruneTarget; status: 'removed'; sizeBytes?: number }
|
||||
| { id: string; target: PruneTarget; status: 'skipped'; reason: string }
|
||||
| { id: string; target: PruneTarget; status: 'failed'; error: string };
|
||||
|
||||
export interface FleetPruneTargetResult {
|
||||
target: FleetPruneTarget;
|
||||
success: boolean;
|
||||
reclaimedBytes: number;
|
||||
dryRun: boolean;
|
||||
removed?: number;
|
||||
skipped?: number;
|
||||
failed?: number;
|
||||
error?: string;
|
||||
}
|
||||
|
||||
export interface FleetPruneNodeResult {
|
||||
nodeId: number;
|
||||
nodeName: string;
|
||||
reachable: boolean;
|
||||
code?: string;
|
||||
error?: string;
|
||||
fingerprint?: string;
|
||||
items?: PrunePlanItem[];
|
||||
reclaimableBytes?: number;
|
||||
reclaimedBytes?: number;
|
||||
outcomes?: PruneItemOutcome[];
|
||||
targets: FleetPruneTargetResult[];
|
||||
}
|
||||
|
||||
function finiteNonnegative(value: unknown): value is number {
|
||||
return typeof value === 'number' && Number.isFinite(value) && value >= 0;
|
||||
}
|
||||
|
||||
export function isPrunePlanItem(value: unknown): value is PrunePlanItem {
|
||||
if (!value || typeof value !== 'object') return false;
|
||||
const item = value as Record<string, unknown>;
|
||||
if (typeof item.id !== 'string' || typeof item.name !== 'string'
|
||||
|| typeof item.managed !== 'boolean' || typeof item.reason !== 'string'
|
||||
|| (item.sizeBytes !== undefined && !finiteNonnegative(item.sizeBytes))) return false;
|
||||
if (item.target === 'containers') return true;
|
||||
if (item.target === 'images') {
|
||||
const image = item.image as Record<string, unknown> | undefined;
|
||||
return Boolean(image && Array.isArray(image.references) && image.references.every((ref) => typeof ref === 'string'));
|
||||
}
|
||||
if (item.target === 'volumes') return Boolean(item.volume && typeof item.volume === 'object');
|
||||
if (item.target === 'networks') return Boolean(item.network && typeof item.network === 'object');
|
||||
return false;
|
||||
}
|
||||
|
||||
export function isPruneItemOutcome(value: unknown): value is PruneItemOutcome {
|
||||
if (!value || typeof value !== 'object') return false;
|
||||
const outcome = value as Record<string, unknown>;
|
||||
if (typeof outcome.id !== 'string' || typeof outcome.target !== 'string') return false;
|
||||
if (outcome.status === 'removed') return outcome.sizeBytes === undefined || finiteNonnegative(outcome.sizeBytes);
|
||||
if (outcome.status === 'skipped') return typeof outcome.reason === 'string';
|
||||
if (outcome.status === 'failed') return typeof outcome.error === 'string';
|
||||
return false;
|
||||
}
|
||||
|
||||
export function isPrunePlan(value: unknown): value is PrunePlan {
|
||||
if (!value || typeof value !== 'object') return false;
|
||||
const plan = value as Partial<PrunePlan>;
|
||||
if ((plan.scope !== 'managed' && plan.scope !== 'all') || !Array.isArray(plan.targets)
|
||||
|| new Set(plan.targets).size !== plan.targets.length || !Array.isArray(plan.items)
|
||||
|| !finiteNonnegative(plan.reclaimableBytes) || typeof plan.fingerprint !== 'string'
|
||||
|| plan.fingerprint.length === 0 || !Number.isInteger(plan.nodeId)
|
||||
|| !finiteNonnegative(plan.createdAt)) return false;
|
||||
const targets = new Set<PruneTarget>(plan.targets);
|
||||
const itemKeys = new Set<string>();
|
||||
let total = 0;
|
||||
for (const item of plan.items) {
|
||||
if (!isPrunePlanItem(item) || !targets.has(item.target)) return false;
|
||||
const key = `${item.target}\0${item.id}`;
|
||||
if (itemKeys.has(key)) return false;
|
||||
itemKeys.add(key);
|
||||
total += item.sizeBytes ?? 0;
|
||||
}
|
||||
return total === plan.reclaimableBytes;
|
||||
}
|
||||
Reference in New Issue
Block a user