ocaml-docker/test/ at main · gazagnaire.org/ocaml-docker · Tangled

gazagnaire.org / ocaml-docker

0

Docker Engine API types and codecs in pure OCaml

0

ocaml-docker / test /

at main 3 folders 38 files

Thomas Gazagnaire docker: give Ping its own equality 12d ago

docs: reflow comments across the tree

1 month ago

ocaml-docker: adopt the @traces interop alias

1 month ago

docker-proxy: differential fuzz of the request parser, strict Content-Length Cross-check the proxy's hand-rolled request-head parser against the strict RFC 9112 parser in nox-http: for every generated request the proxy must never trust an n-byte body a strict parser frames differently (the smuggling root), and must refuse the ambiguous framings that parser rejects. Exposed via Proxy.classify. The fuzz immediately found the gap it was built for: content_length used int_of_string, which accepts 0x10, 5_0 and +5 -- none valid HTTP -- so the proxy trusted a length the daemon would reject. Content-Length is now parsed as a single run of ASCII digits, and a malformed or comma-list value is refused as invalid framing alongside the TE+CL and conflicting-length checks.

3 weeks ago

docker: give Ping its own equality The ping round-trip test compared two Ping.t with (=), which the house rule rejects: nothing stops the polymorphic compare being pointed at a type that cannot support it. Export Ping.equal instead. A ping is a flat record of four strings and a bool -- no floats, functions or cycles -- so structural equality is the equality here, and defining it as a monomorphic (=) keeps it right when a header field is added, which a hand-written conjunction would not.

1 week ago

docker: fold docker-runner into docker; give dockr its own package docker-runner was its own opam package but is I/O-free (deps: docker + fmt) like the main docker types, so a separate package only paid off for a future real backend depending on just the interface -- which doesn't exist. Fold it in: lib/runner.ml is now the Docker.Runner module (BACKEND renamed to the idiomatic S), the docker-runner package/opam are dropped, and its test moves to test/test_runner.ml. Merging the three binaries into one dockr also pulled docker-client and nox-crypto-rng (which the docker-server library does not use) into a library-bearing package; move the binary into its own executable-only dockr package (the etco pattern), so docker-server keeps only its real library deps (docker-client returns to with-test for the tests). Net: still 4 packages (docker, docker-client, docker-server, dockr), but each carries honest deps. Consumers use Docker.Runner.S / Docker.Runner.Memory; 65 + e2e tests pass.

1 month ago

docker: Engine API client and server, first slice New ocaml-docker package: the Docker Engine REST API on the host, in pure OCaml. The IO-free `docker` library maps request and response bodies to OCaml values with nox-json; `docker-client` (the `dockr` CLI) and `docker-server` (the `dockrd` daemon) are thin Eio adapters over a Unix socket, so the same definitions back the client, the server, and the tests. This first slice covers GET /version and GET /_ping (both also under a /v<api> prefix) -- enough to exercise the whole stack (Unix-socket transport, routing, headers, JSON codecs, client/server symmetry) without a container runtime behind it. The interop tests cover both directions. test/client drives a real daemon and test/interop/dockerd replays committed real-daemon captures (the oracle is contacted only at REGEN=1), validating our client against a real server. test/server points the stock `docker` CLI at our server, validating our server against a real client.

1 month ago

docker: Engine API client and server, first slice New ocaml-docker package: the Docker Engine REST API on the host, in pure OCaml. The IO-free `docker` library maps request and response bodies to OCaml values with nox-json; `docker-client` (the `dockr` CLI) and `docker-server` (the `dockrd` daemon) are thin Eio adapters over a Unix socket, so the same definitions back the client, the server, and the tests. This first slice covers GET /version and GET /_ping (both also under a /v<api> prefix) -- enough to exercise the whole stack (Unix-socket transport, routing, headers, JSON codecs, client/server symmetry) without a container runtime behind it. The interop tests cover both directions. test/client drives a real daemon and test/interop/dockerd replays committed real-daemon captures (the oracle is contacted only at REGEN=1), validating our client against a real server. test/server points the stock `docker` CLI at our server, validating our server against a real client.

1 month ago

docker: container changes (GET /containers/{id}/changes) Add Docker.Change, the filesystem-diff entry (Path plus a typed Modified/ Added/Deleted Kind), and serve GET /containers/{id}/changes via a new BACKEND.changes seam: a real runtime diffs the container against its image, while the in-memory backend has no writable layer and so reports nothing (404 when the container is unknown). Client gains Container.changes. Real `docker diff` round-trips against --fake.

1 month ago

test_change.mli

docker: container changes (GET /containers/{id}/changes) Add Docker.Change, the filesystem-diff entry (Path plus a typed Modified/ Added/Deleted Kind), and serve GET /containers/{id}/changes via a new BACKEND.changes seam: a real runtime diffs the container against its image, while the in-memory backend has no writable layer and so reports nothing (404 when the container is unknown). Client gains Container.changes. Real `docker diff` round-trips against --fake.

1 month ago

test_container.ml

docker: container list/create/inspect over a runtime backend seam Add the first container endpoints -- GET /containers/json, POST /containers/create, GET /containers/{id}/json -- the point where the API first needs a runtime underneath it. The seam follows the Irmin Heap.Make pattern: docker-runner defines a BACKEND module type (a container runtime: an in-memory store now, runc or a VMM later) and an in-memory Memory backend; Server.Make (B : BACKEND) builds the server over it, projecting the backend's containers to the Engine API shapes. The static endpoints (/version, /_ping, /info) and the container endpoints are all served, each also under a /v<api> prefix. New docker types: Container.{Config,Create_response,Summary,Detail}. Client gains container_create / container_list / container_inspect (named after the Docker Go SDK). Errors are emitted as the {"message": ...} body via Docker.Error.to_body. The real docker 29.x CLI drives the lifecycle against dockrd end to end: `docker create`, `docker ps -a`, `docker inspect` all work. A live bug it surfaced -- the CLI sends null, not [], for empty Cmd/Env/Warnings arrays -- is fixed with a null-tolerant list codec and a regression test.

1 month ago

test_container.mli

docker: container list/create/inspect over a runtime backend seam Add the first container endpoints -- GET /containers/json, POST /containers/create, GET /containers/{id}/json -- the point where the API first needs a runtime underneath it. The seam follows the Irmin Heap.Make pattern: docker-runner defines a BACKEND module type (a container runtime: an in-memory store now, runc or a VMM later) and an in-memory Memory backend; Server.Make (B : BACKEND) builds the server over it, projecting the backend's containers to the Engine API shapes. The static endpoints (/version, /_ping, /info) and the container endpoints are all served, each also under a /v<api> prefix. New docker types: Container.{Config,Create_response,Summary,Detail}. Client gains container_create / container_list / container_inspect (named after the Docker Go SDK). Errors are emitted as the {"message": ...} body via Docker.Error.to_body. The real docker 29.x CLI drives the lifecycle against dockrd end to end: `docker create`, `docker ps -a`, `docker inspect` all work. A live bug it surfaced -- the CLI sends null, not [], for empty Cmd/Env/Warnings arrays -- is fixed with a null-tolerant list codec and a regression test.

1 month ago

tree: reformat for the upgraded ocamlformat Comment reflow and header reindent produced by the new ocamlformat; no code changes.

1 month ago

docker: system df (GET /system/df) Add Docker.Df, the SystemDiskUsage response, and serve GET /system/df by aggregating the backend's images, containers, and volumes. In --fake no bytes are tracked, so only LayersSize (the sum of recorded image sizes) is reported and the per-object size fields stay at their zero default; the object lists and counts are real. Client gains a System.df. Real `docker system df` round-trips against --fake, and our client reads back a populated report.

1 month ago

docker: capture errors as a typed value; add /info and conformance traces Errors: a failed request is now captured as `Docker.Error` carrying the HTTP status and the daemon's message. The client decodes the `{"message": ...}` error body instead of reporting a flat "unexpected HTTP status" string, and wraps transport failures (no daemon at the socket) as a status-0 error rather than letting the exception escape. New endpoint: GET /info, modelled as a useful scalar subset of the large info object (ignoring unmodelled members). Exposed as `Client.info` and the `dockr info` subcommand. Conformance: commit two more read-only captures from a real daemon -- the versioned path /v1.53/version (version negotiation) and a 404 error body -- and assert our codecs decode them. /info is covered by a synthetic unit test plus the live client test, not a committed trace, since the real /info carries host-specific data.

1 month ago

docker: capture errors as a typed value; add /info and conformance traces Errors: a failed request is now captured as `Docker.Error` carrying the HTTP status and the daemon's message. The client decodes the `{"message": ...}` error body instead of reporting a flat "unexpected HTTP status" string, and wraps transport failures (no daemon at the socket) as a status-0 error rather than letting the exception escape. New endpoint: GET /info, modelled as a useful scalar subset of the large info object (ignoring unmodelled members). Exposed as `Client.info` and the `dockr info` subcommand. Conformance: commit two more read-only captures from a real daemon -- the versioned path /v1.53/version (version negotiation) and a 404 error body -- and assert our codecs decode them. /info is covered by a synthetic unit test plus the live client test, not a committed trace, since the real /info carries host-specific data.

1 month ago

docker: daemon events (GET /events) Add Docker.Event (one JSON object per line, the id under Actor.ID) and serve GET /events. The Memory backend records the container lifecycle it simulates (create/start/stop/kill/restart/pause/unpause/destroy) and a new BACKEND.events replays the log; a real daemon would hold the connection open and push live events, so the in-memory backend returns its recorded log as a finite stream. Client gains System.events. Our client reads the log back and sees the create/start/destroy actions it drove.

1 month ago

docker: daemon events (GET /events) Add Docker.Event (one JSON object per line, the id under Actor.ID) and serve GET /events. The Memory backend records the container lifecycle it simulates (create/start/stop/kill/restart/pause/unpause/destroy) and a new BACKEND.events replays the log; a real daemon would hold the connection open and push live events, so the in-memory backend returns its recorded log as a finite stream. Client gains System.events. Our client reads the log back and sees the create/start/destroy actions it drove.

1 month ago

docker: container exec (create/start-hijack/inspect) Add Docker.Exec (create config/response, start, inspect detail) and the exec endpoints over the new respond hijack primitive: POST /containers/{id}/exec creates an instance (404 unknown, 409 not running), POST /exec/{id}/start hijacks the connection and writes a 101 upgrade then the multiplexed output, and GET /exec/{id}/json inspects it. In --fake no process runs, so an exec exits 0 with empty output. BACKEND grows exec_create/start/inspect; Memory tracks instances. The client gains an Exec module that performs the raw upgrade itself and demultiplexes stdout. Real `docker exec` round-trips against --fake, and our own client drives the same create/start/inspect path (plus the 409 on a stopped container).

1 month ago

docker: container exec (create/start-hijack/inspect) Add Docker.Exec (create config/response, start, inspect detail) and the exec endpoints over the new respond hijack primitive: POST /containers/{id}/exec creates an instance (404 unknown, 409 not running), POST /exec/{id}/start hijacks the connection and writes a 101 upgrade then the multiplexed output, and GET /exec/{id}/json inspects it. In --fake no process runs, so an exec exits 0 with empty output. BACKEND grows exec_create/start/inspect; Memory tracks instances. The client gains an Exec module that performs the raw upgrade itself and demultiplexes stdout. Real `docker exec` round-trips against --fake, and our own client drives the same create/start/inspect path (plus the 409 on a stopped container).

1 month ago

docker: image history (GET /images/{name}/history) Add Image.History, the layer-history entry, and serve GET /images/{name}/history via a new BACKEND.image_history seam: a real runtime reads the image config's layer chain, while the in-memory backend stores no layers and reports its single recorded metadata entry (404 when unknown). Client gains Image.history. Real `docker history` round-trips against --fake.

1 month ago

docker: images (list/pull/inspect/tag/remove) Add the images resource. The backend keeps a metadata store; image_pull registers an entry (no bytes moved) and the server streams back the newline-delimited JSON progress the docker CLI expects, so `docker pull` prints "Downloaded newer image for ..." and exits 0. Serves GET /images/json, POST /images/create, GET /images/{name}/json, POST /images/{name}/tag, DELETE /images/{name}; client gains Client.Image.{list, pull,inspect,tag,remove}. image_find tolerates the CLI's fully-qualified names (registry/namespace prefix, implicit :latest) so `docker rmi alpine` resolves docker.io/library/alpine:latest. Real docker pull/images/rmi round-trip.

1 month ago

tree: reformat for the upgraded ocamlformat Comment reflow and header reindent produced by the new ocamlformat; no code changes.

1 month ago

docker: capture errors as a typed value; add /info and conformance traces Errors: a failed request is now captured as `Docker.Error` carrying the HTTP status and the daemon's message. The client decodes the `{"message": ...}` error body instead of reporting a flat "unexpected HTTP status" string, and wraps transport failures (no daemon at the socket) as a status-0 error rather than letting the exception escape. New endpoint: GET /info, modelled as a useful scalar subset of the large info object (ignoring unmodelled members). Exposed as `Client.info` and the `dockr info` subcommand. Conformance: commit two more read-only captures from a real daemon -- the versioned path /v1.53/version (version negotiation) and a 404 error body -- and assert our codecs decode them. /info is covered by a synthetic unit test plus the live client test, not a committed trace, since the real /info carries host-specific data.

1 month ago

test_network.ml

docker: networks create/inspect/remove; config types use option Extend networks from the read-only defaults to full CRUD: the backend now keeps a network store seeded with bridge/host/none, and serves POST /networks/create, GET /networks/{id}, DELETE /networks/{id}. Client gains Network.{create,inspect,remove}. Real `docker network create/ls/rm` works. Replace the ""-as-unspecified sentinel in Volume.Config / Network.Config with proper string option fields (None = unspecified). The optional-string codec uses (option string) with dec_absent, since opt_member rejects an explicit JSON null the docker CLI may send.

1 month ago

test_network.mli

docker: GET /networks; e2e/runner tests follow the test.ml convention Add the networks resource: Docker.Network with the three networks every daemon has (bridge/host/none), served at GET /networks and exposed as Client.Network.list. Real network management is a follow-up; the defaults are honest. The real docker CLI's `docker network ls` lists them. Also restructure the standalone e2e/runner tests to the merlint test convention (E600/E617): test_*.ml export a `suite` named after the file, Alcotest.run moves into a sibling test.ml, and each e2e case drives its own Eio main. test/runner, test/client, test/server each gain a test.ml + test_*.mli.

1 month ago

docker: give Ping its own equality The ping round-trip test compared two Ping.t with (=), which the house rule rejects: nothing stops the polymorphic compare being pointed at a type that cannot support it. Export Ping.equal instead. A ping is a flat record of four strings and a bool -- no floats, functions or cycles -- so structural equality is the equality here, and defining it as a monomorphic (=) keeps it right when a header field is added, which a hand-written conjunction would not.

1 week ago

docker: Engine API client and server, first slice New ocaml-docker package: the Docker Engine REST API on the host, in pure OCaml. The IO-free `docker` library maps request and response bodies to OCaml values with nox-json; `docker-client` (the `dockr` CLI) and `docker-server` (the `dockrd` daemon) are thin Eio adapters over a Unix socket, so the same definitions back the client, the server, and the tests. This first slice covers GET /version and GET /_ping (both also under a /v<api> prefix) -- enough to exercise the whole stack (Unix-socket transport, routing, headers, JSON codecs, client/server symmetry) without a container runtime behind it. The interop tests cover both directions. test/client drives a real daemon and test/interop/dockerd replays committed real-daemon captures (the oracle is contacted only at REGEN=1), validating our client against a real server. test/server points the stock `docker` CLI at our server, validating our server against a real client.

1 month ago

tree: reformat for the upgraded ocamlformat Comment reflow and header reindent produced by the new ocamlformat; no code changes.

1 month ago

docker: prune (containers/images/volumes/networks) and container wait Add the prune endpoints backing `docker system prune`: the backend bulk- removes non-running containers, dangling images, all volumes, and non- default networks, returning the removed identifiers; Docker.Prune encodes each response shape. Also POST /containers/{id}/wait, returning a simulated {StatusCode:0}. Client gains {Container,Image,Volume,Network}.prune and Container.wait. Real `docker container prune -f` round-trips against --fake.

1 month ago

tree: reformat for the upgraded ocamlformat Comment reflow and header reindent produced by the new ocamlformat; no code changes.

1 month ago

test_runner.mli

docker: fold docker-runner into docker; give dockr its own package docker-runner was its own opam package but is I/O-free (deps: docker + fmt) like the main docker types, so a separate package only paid off for a future real backend depending on just the interface -- which doesn't exist. Fold it in: lib/runner.ml is now the Docker.Runner module (BACKEND renamed to the idiomatic S), the docker-runner package/opam are dropped, and its test moves to test/test_runner.ml. Merging the three binaries into one dockr also pulled docker-client and nox-crypto-rng (which the docker-server library does not use) into a library-bearing package; move the binary into its own executable-only dockr package (the etco pattern), so docker-server keeps only its real library deps (docker-client returns to with-test for the tests). Net: still 4 packages (docker, docker-client, docker-server, dockr), but each carries honest deps. Consumers use Docker.Runner.S / Docker.Runner.Memory; 65 + e2e tests pass.

1 month ago

tree: reformat for the upgraded ocamlformat Comment reflow and header reindent produced by the new ocamlformat; no code changes.

1 month ago

docker: container stats (GET /containers/{id}/stats) Add Docker.Stats (the cpu/memory/pids counters the CLI reads, nested under cpu_stats/memory_stats/pids_stats) and serve GET /containers/{id}/stats via a new BACKEND.stats seam: a real backend samples the cgroup, the in-memory backend reports zeros (404 when unknown). A client reading one object then EOF (the --no-stream case) gets exactly this sample. Client gains Container.stats. Real `docker stats --no-stream` names the container against --fake, and our client reads the zeroed sample back.

1 month ago

test_stdcopy.ml

docker: container logs (GET /containers/{id}/logs) + stdcopy framing Add Docker.Stdcopy, the multiplexed stdout/stderr stream framing (8-byte header: stream byte, three zeros, big-endian payload length) used by the logs and attach streams, with frame/demux unit-tested on known vectors. Serve GET /containers/{id}/logs: any existing container's logs are a multiplexed stream (404 when unknown), empty in --fake since no process runs, carrying the stream content type so clients demux it. Client gains Container.logs, which demuxes and returns stdout. Real `docker logs` round-trips against --fake.

1 month ago

test_stdcopy.mli

docker: container logs (GET /containers/{id}/logs) + stdcopy framing Add Docker.Stdcopy, the multiplexed stdout/stderr stream framing (8-byte header: stream byte, three zeros, big-endian payload length) used by the logs and attach streams, with frame/demux unit-tested on known vectors. Serve GET /containers/{id}/logs: any existing container's logs are a multiplexed stream (404 when unknown), empty in --fake since no process runs, carrying the stream content type so clients demux it. Client gains Container.logs, which demuxes and returns stdout. Real `docker logs` round-trips against --fake.

1 month ago

docker: container top (GET /containers/{id}/top) Add Docker.Top, the process-listing response, and serve GET /containers/{id}/top. Like the daemon it requires the container to be running (404 when unknown, 409 when stopped); Top.of_command builds the simulated ps -ef table reported for a running --fake container. Client gains Container.top. Real `docker top` prints the listing against --fake, and our client reads the command back (and sees the 409 once stopped).

1 month ago

docker: container top (GET /containers/{id}/top) Add Docker.Top, the process-listing response, and serve GET /containers/{id}/top. Like the daemon it requires the container to be running (404 when unknown, 409 when stopped); Top.of_command builds the simulated ps -ef table reported for a running --fake container. Client gains Container.top. Real `docker top` prints the listing against --fake, and our client reads the command back (and sees the 409 once stopped).

1 month ago

test_version.ml

docker: Engine API client and server, first slice New ocaml-docker package: the Docker Engine REST API on the host, in pure OCaml. The IO-free `docker` library maps request and response bodies to OCaml values with nox-json; `docker-client` (the `dockr` CLI) and `docker-server` (the `dockrd` daemon) are thin Eio adapters over a Unix socket, so the same definitions back the client, the server, and the tests. This first slice covers GET /version and GET /_ping (both also under a /v<api> prefix) -- enough to exercise the whole stack (Unix-socket transport, routing, headers, JSON codecs, client/server symmetry) without a container runtime behind it. The interop tests cover both directions. test/client drives a real daemon and test/interop/dockerd replays committed real-daemon captures (the oracle is contacted only at REGEN=1), validating our client against a real server. test/server points the stock `docker` CLI at our server, validating our server against a real client.

1 month ago

test_version.mli

docker: Engine API client and server, first slice New ocaml-docker package: the Docker Engine REST API on the host, in pure OCaml. The IO-free `docker` library maps request and response bodies to OCaml values with nox-json; `docker-client` (the `dockr` CLI) and `docker-server` (the `dockrd` daemon) are thin Eio adapters over a Unix socket, so the same definitions back the client, the server, and the tests. This first slice covers GET /version and GET /_ping (both also under a /v<api> prefix) -- enough to exercise the whole stack (Unix-socket transport, routing, headers, JSON codecs, client/server symmetry) without a container runtime behind it. The interop tests cover both directions. test/client drives a real daemon and test/interop/dockerd replays committed real-daemon captures (the oracle is contacted only at REGEN=1), validating our client against a real server. test/server points the stock `docker` CLI at our server, validating our server against a real client.

1 month ago

docker: networks create/inspect/remove; config types use option Extend networks from the read-only defaults to full CRUD: the backend now keeps a network store seeded with bridge/host/none, and serves POST /networks/create, GET /networks/{id}, DELETE /networks/{id}. Client gains Network.{create,inspect,remove}. Real `docker network create/ls/rm` works. Replace the ""-as-unspecified sentinel in Volume.Config / Network.Config with proper string option fields (None = unspecified). The optional-string codec uses (option string) with dec_absent, since opt_member rejects an explicit JSON null the docker CLI may send.

1 month ago

test_volume.mli

docker: volumes (list/create/inspect/remove) Add the volumes resource: Docker.Volume + the BACKEND volume_* ops backed by an in-memory store in Memory (metadata-only; a real backend would provision storage). Server serves GET /volumes, POST /volumes/create, GET/DELETE /volumes/{name}; client gains Client.Volume.{list,create, inspect,remove}. The real docker CLI's `docker volume create/ls/rm` round trips against dockrd --fake.

1 month ago