scripts/setup-dev-alias.sh271 of 271 statements covered (100.00%).
coveredmissednever traced by Bash (not counted)A line ending in … continues the statement above it and shares its fate.
| 1 | #!/usr/bin/env bash | |
| 2 | # | |
| 3 | # setup-dev-alias.sh — install a `gco` shell function that runs the GCO CLI | |
| 4 | # inside the dev container against your current working directory. | |
| 5 | # | |
| 6 | # Why a function instead of a bare alias? A function forwards arguments and | |
| 7 | # pipes correctly, attaches a TTY only when one is present (so it also works | |
| 8 | # in scripts and CI), and bakes in the correct container socket for the | |
| 9 | # runtime you actually have — which a copy-pasted `docker run ...` alias does | |
| 10 | # not. The block is written between marker lines, so re-running this script | |
| 11 | # updates it in place instead of appending duplicates. | |
| 12 | # | |
| 13 | # By default it also builds (or refreshes) the dev image from Dockerfile.dev | |
| 14 | # with the detected runtime before installing the function, so a single run | |
| 15 | # takes a fresh clone all the way to a working `gco`. Re-running always rebuilds | |
| 16 | # (cached layers make that cheap), which transparently replaces a stale local | |
| 17 | # image. Pass --no-build to skip the build when you manage the image yourself. | |
| 18 | # | |
| 19 | 78 | set -euo pipefail |
| 20 | ||
| 21 | 78 | MARKER_BEGIN="# >>> gco >>>" |
| 22 | 78 | MARKER_END="# <<< gco <<<" |
| 23 | 78 | IMAGE="gco-dev" |
| 24 | 78 | FORCED_RUNTIME="" |
| 25 | 78 | RC_FILE="" |
| 26 | 78 | PRINT_ONLY=0 |
| 27 | 78 | NO_BUILD=0 |
| 28 | 78 | AWS_WRITABLE=0 |
| 29 | 78 | UNINSTALL=0 |
| 30 | ||
| 31 | # Host environment variables forwarded into the container in bare `-e NAME` | |
| 32 | # form. Every runtime (Docker, Finch/nerdctl, and Podman) passes a variable only | |
| 33 | # when it is set in the caller's environment, so an unset variable never becomes | |
| 34 | # an empty override. The AWS entries preserve the host credential/Region chain; | |
| 35 | # the GCO_AUTOPILOT entries preserve engine, model, and generated-config choices. | |
| 36 | # | |
| 37 | # Values naming files outside ~/.aws are forwarded but require a matching mount. | |
| 38 | # Likewise, GCO_AUTOPILOT_CONFIG_DIR must be a writable path as seen *inside* | |
| 39 | # the container (normally under /root/.gco or /workspace), not an arbitrary host | |
| 40 | # path. Filesystem-bearing plugin paths are intentionally not forwarded. | |
| 41 | 78 | FORWARDED_ENV_VARS=( |
| 42 | AWS_PROFILE | |
| 43 | AWS_DEFAULT_PROFILE | |
| 44 | AWS_REGION | |
| 45 | AWS_DEFAULT_REGION | |
| 46 | AWS_ACCESS_KEY_ID | |
| 47 | AWS_SECRET_ACCESS_KEY | |
| 48 | AWS_SESSION_TOKEN | |
| 49 | AWS_CREDENTIAL_EXPIRATION | |
| 50 | AWS_ROLE_ARN | |
| 51 | AWS_ROLE_SESSION_NAME | |
| 52 | AWS_WEB_IDENTITY_TOKEN_FILE | |
| 53 | AWS_CONFIG_FILE | |
| 54 | AWS_SHARED_CREDENTIALS_FILE | |
| 55 | AWS_CA_BUNDLE | |
| 56 | AWS_ENDPOINT_URL | |
| 57 | AWS_USE_FIPS_ENDPOINT | |
| 58 | AWS_USE_DUALSTACK_ENDPOINT | |
| 59 | AWS_RETRY_MODE | |
| 60 | AWS_MAX_ATTEMPTS | |
| 61 | AWS_EC2_METADATA_DISABLED | |
| 62 | GCO_DEFAULT_REGION | |
| 63 | GCO_AUTOPILOT_ENGINE | |
| 64 | GCO_AUTOPILOT_MODEL | |
| 65 | GCO_AUTOPILOT_CODEX_MODEL | |
| 66 | GCO_AUTOPILOT_OPENCODE_MODEL | |
| 67 | GCO_AUTOPILOT_SMALL_FAST_MODEL | |
| 68 | GCO_AUTOPILOT_CONFIG_DIR | |
| 69 | ) | |
| 70 | ||
| 71 | # The dev image is built from Dockerfile.dev at the repository root. Resolve it | |
| 72 | # from this script's own location so the build works from any working directory. | |
| 73 | 312 | SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)" |
| 74 | 234 | REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" |
| 75 | 78 | DOCKERFILE="$REPO_ROOT/Dockerfile.dev" |
| 76 | ||
| 77 | 505 | log() { printf '%s\n' "$*"; } |
| 78 | 5 | warn() { printf 'warning: %s\n' "$*" >&2; } |
| 79 | 22 | die() { printf 'error: %s\n' "$*" >&2; exit 1; } |
| 80 | ||
| 81 | # Values supplied through --runtime, --image, CDK_DOCKER, or | |
| 82 | # XDG_RUNTIME_DIR are persisted into a shell profile and therefore cross a | |
| 83 | # second shell-parsing boundary. Emit simple image/runtime names unchanged for | |
| 84 | # readability, but POSIX-single-quote anything containing shell syntax. The | |
| 85 | # sed replacement turns each embedded apostrophe into the safe '\'' sequence. | |
| 86 | shell_quote() { | |
| 87 | 66 | printf "'" |
| 88 | 132 | printf '%s' "$1" | sed "s/'/'\\\\''/g" |
| 89 | 66 | printf "'" |
| 90 | } | |
| 91 | ||
| 92 | shell_word() { | |
| 93 | 140 | case "$1" in |
| 94 | 2 | ""|*[!A-Za-z0-9_./:@+-]*) shell_quote "$1" ;; |
| 95 | 138 | *) printf '%s' "$1" ;; |
| 96 | esac | |
| 97 | } | |
| 98 | ||
| 99 | require_single_line() { | |
| 100 | 153 | local label="$1" value="$2" |
| 101 | 232 | case "$value" in |
| 102 | 2 | *$'\n'*|*$'\r'*) die "$label must not contain line breaks" ;; |
| 103 | esac | |
| 104 | } | |
| 105 | ||
| 106 | usage() { | |
| 107 | 1 | cat <<'EOF' |
| 108 | setup-dev-alias.sh — install a `gco` shell function for the dev container. | |
| 109 | ||
| 110 | Usage: scripts/setup-dev-alias.sh [options] | |
| 111 | ||
| 112 | -p, --print Print the shell function to stdout and exit (no build, no writes). | |
| 113 | -r, --runtime NAME Force a runtime (docker|finch|podman) vs auto-detecting. | |
| 114 | --rc PATH Target this rc file instead of the one inferred from $SHELL. | |
| 115 | --image NAME Dev image to build and run (default: gco-dev). | |
| 116 | --no-build Skip building the dev image; assume it already exists. | |
| 117 | --aws-writable Mount ~/.aws read-write so `aws sso login` can run in | |
| 118 | the container and cache its token for the host (default: | |
| 119 | read-only). | |
| 120 | --uninstall Remove the managed block from the rc file and exit. | |
| 121 | -h, --help Show this help and exit. | |
| 122 | ||
| 123 | By default the script builds (or refreshes) the dev image from Dockerfile.dev | |
| 124 | with the detected runtime, then installs the `gco` function. Detection prefers | |
| 125 | docker, then finch, then podman (the first whose daemon answers `<rt> info`). | |
| 126 | GCO_CONTAINER_RUNTIME or CDK_DOCKER override detection. | |
| 127 | ||
| 128 | AWS credentials: the function mounts ~/.aws and forwards the standard AWS | |
| 129 | environment variables (AWS_PROFILE, AWS_REGION, static keys, session tokens, | |
| 130 | role/web-identity settings, endpoint and retry overrides) only when the calling | |
| 131 | shell has them set. So `AWS_PROFILE=prod gco status`, an exported SSO or | |
| 132 | assume-role session, static keys, and a plain ~/.aws/config all work the same | |
| 133 | way inside the container as they do on the host. | |
| 134 | ||
| 135 | Autopilot controls are also forwarded by name: GCO_AUTOPILOT_ENGINE, | |
| 136 | GCO_AUTOPILOT_MODEL, GCO_AUTOPILOT_CODEX_MODEL, GCO_AUTOPILOT_OPENCODE_MODEL, | |
| 137 | GCO_AUTOPILOT_SMALL_FAST_MODEL, and GCO_AUTOPILOT_CONFIG_DIR. Config-directory | |
| 138 | values must name a writable path as seen inside the container. | |
| 139 | EOF | |
| 140 | 1 | } |
| 141 | 1 | |
| 142 | 264 | while [ "$#" -gt 0 ]; do |
| 143 | 187 | case "$1" in |
| 144 | 80 | -p|--print) PRINT_ONLY=1; shift ;; |
| 145 | 201 | -r|--runtime) [ "$#" -ge 2 ] || die "--runtime needs a value"; FORCED_RUNTIME="$2"; shift 2 ;; |
| 146 | 1 | --runtime=*) FORCED_RUNTIME="${1#*=}"; shift ;; |
| 147 | 111 | --rc) [ "$#" -ge 2 ] || die "--rc needs a value"; RC_FILE="$2"; shift 2 ;; |
| 148 | 1 | --rc=*) RC_FILE="${1#*=}"; shift ;; |
| 149 | 57 | --image) [ "$#" -ge 2 ] || die "--image needs a value"; IMAGE="$2"; shift 2 ;; |
| 150 | 1 | --image=*) IMAGE="${1#*=}"; shift ;; |
| 151 | 38 | --no-build) NO_BUILD=1; shift ;; |
| 152 | 2 | --aws-writable) AWS_WRITABLE=1; shift ;; |
| 153 | 6 | --uninstall) UNINSTALL=1; shift ;; |
| 154 | 2 | -h|--help) usage; exit 0 ;; |
| 155 | 1 | *) die "unknown option: $1 (try --help)" ;; |
| 156 | 1 | esac |
| 157 | 1 | done |
| 158 | 1 | |
| 159 | 1 | # Detection mirrors cli/_container_runtime.py: only accept a runtime whose |
| 160 | 1 | # daemon actually answers `<rt> info`. |
| 161 | 1 | runtime_responds() { |
| 162 | 86 | command -v "$1" >/dev/null 2>&1 || return 1 |
| 163 | 76 | "$1" info >/dev/null 2>&1 |
| 164 | 1 | } |
| 165 | 1 | |
| 166 | 1 | detect_runtime() { |
| 167 | 5 | local rt |
| 168 | 12 | for rt in docker finch podman; do |
| 169 | 12 | if runtime_responds "$rt"; then |
| 170 | 3 | printf '%s\n' "$rt" |
| 171 | 3 | return 0 |
| 172 | 1 | fi |
| 173 | 1 | done |
| 174 | 2 | return 1 |
| 175 | 1 | } |
| 176 | 1 | |
| 177 | 1 | resolve_runtime() { |
| 178 | 74 | local override="" |
| 179 | 74 | if [ -n "$FORCED_RUNTIME" ]; then |
| 180 | 67 | override="$FORCED_RUNTIME" |
| 181 | 7 | elif [ -n "${GCO_CONTAINER_RUNTIME:-}" ]; then |
| 182 | 1 | override="$GCO_CONTAINER_RUNTIME" |
| 183 | 6 | elif [ -n "${CDK_DOCKER:-}" ]; then |
| 184 | 1 | override="$CDK_DOCKER" |
| 185 | 1 | fi |
| 186 | 74 | if [ -n "$override" ]; then |
| 187 | 74 | runtime_responds "$override" || warn "runtime '$override' is not answering '$override info' yet; using it anyway" |
| 188 | 69 | printf '%s\n' "$override" |
| 189 | 69 | return 0 |
| 190 | 1 | fi |
| 191 | 5 | detect_runtime |
| 192 | 1 | } |
| 193 | 1 | |
| 194 | 1 | socket_args_for() { |
| 195 | 72 | local mount="" |
| 196 | 72 | case "$1" in |
| 197 | 55 | docker) mount="/var/run/docker.sock:/var/run/docker.sock" ;; |
| 198 | 9 | podman) mount="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/podman/podman.sock:/var/run/docker.sock" ;; |
| 199 | 8 | *) return 0 ;; |
| 200 | 1 | esac |
| 201 | 128 | printf -- '-v %s ' "$(shell_quote "$mount")" |
| 202 | 1 | } |
| 203 | 1 | |
| 204 | 1 | socket_desc_for() { |
| 205 | 24 | case "$1" in |
| 206 | 23 | docker) printf '%s' "host Docker socket -> /var/run/docker.sock" ;; |
| 207 | 1 | podman) printf '%s' "Podman socket (${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/podman/podman.sock) -> /var/run/docker.sock" ;; |
| 208 | 1 | *) printf '%s' "none ($1 has no host socket to share)" ;; |
| 209 | 1 | esac |
| 210 | 1 | } |
| 211 | 1 | |
| 212 | 1 | choose_rc_file() { |
| 213 | 28 | if [ -n "$RC_FILE" ]; then |
| 214 | 27 | printf '%s\n' "$RC_FILE" |
| 215 | 27 | return |
| 216 | 1 | fi |
| 217 | 3 | case "$(basename "${SHELL:-sh}")" in |
| 218 | 1 | zsh) printf '%s\n' "$HOME/.zshrc" ;; |
| 219 | 1 | bash) printf '%s\n' "$HOME/.bashrc" ;; |
| 220 | 1 | # fish cannot parse POSIX function syntax, so writing this block into a |
| 221 | 1 | # fish config would produce a file fish errors on at every new shell — |
| 222 | 1 | # and writing it to ~/.profile (which fish does not read) would look |
| 223 | 1 | # like a successful install that silently never provides `gco`. Fail |
| 224 | 1 | # loudly with the two real options instead. |
| 225 | 1 | fish) die "fish shell cannot source this POSIX function. |
| 226 | Either run the CLI through a POSIX shell: | |
| 227 | bash -lc 'gco --help' | |
| 228 | or add a fish wrapper of your own using the printed command as the body: | |
| 229 | scripts/setup-dev-alias.sh --print | |
| 230 | Pass --rc PATH to install into a specific file anyway." ;; | |
| 231 | 1 | *) printf '%s\n' "$HOME/.profile" ;; |
| 232 | 1 | esac |
| 233 | 1 | } |
| 234 | 1 | |
| 235 | 1 | # Remove the managed block, leaving any surrounding rc content untouched. |
| 236 | 1 | remove_block() { |
| 237 | 3 | local rc="$1" tmp |
| 238 | 3 | [ -f "$rc" ] || { log "Nothing to remove: $rc does not exist."; return 0; } |
| 239 | 3 | if ! grep -qF "$MARKER_BEGIN" "$rc"; then |
| 240 | 1 | log "Nothing to remove: no gco block found in $rc." |
| 241 | 1 | return 0 |
| 242 | 1 | fi |
| 243 | 4 | tmp="$(mktemp)" |
| 244 | 2 | awk -v b="$MARKER_BEGIN" -v e="$MARKER_END" ' |
| 245 | $0 == b { skip = 1 } | |
| 246 | skip != 1 { print } | |
| 247 | $0 == e { skip = 0 } | |
| 248 | ' "$rc" > "$tmp" | |
| 249 | 2 | mv "$tmp" "$rc" |
| 250 | 2 | log "Removed the 'gco' function block from $rc." |
| 251 | 2 | log "Open a new shell (or unset it with: unset -f gco) to finish." |
| 252 | 1 | } |
| 253 | 1 | |
| 254 | 1 | # SELinux-enforcing hosts (Fedora, RHEL, CentOS Stream and friends) deny a |
| 255 | 1 | # container access to every bind mount unless the mount carries a relabel |
| 256 | 1 | # option. Without it `gco` starts and then fails on "permission denied" for |
| 257 | 1 | # /workspace and ~/.aws, which reads like a GCO bug rather than a host policy. |
| 258 | 1 | # `z` (lowercase) applies a shared label so several containers — and the host — |
| 259 | 1 | # keep access; `Z` would relabel exclusively and break other consumers of |
| 260 | 1 | # ~/.aws. Non-SELinux hosts get no suffix, keeping their command lines clean. |
| 261 | 1 | mount_suffix_for_host() { |
| 262 | 71 | if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled 2>/dev/null; then |
| 263 | 1 | printf ',z' |
| 264 | 1 | fi |
| 265 | 1 | } |
| 266 | 1 | |
| 267 | 1 | # Emit one bare `-e NAME` flag per forwarded host variable. |
| 268 | 1 | forwarded_env_args() { |
| 269 | 70 | local name |
| 270 | 1890 | for name in "${FORWARDED_ENV_VARS[@]}"; do |
| 271 | 1890 | printf -- '-e %s ' "$name" |
| 272 | 1 | done |
| 273 | 1 | } |
| 274 | 1 | |
| 275 | 1 | emit_block() { |
| 276 | 70 | local rt="$1" socket="$2" image="$3" forwarded_env="$4" mount_opts="$5" rt_word image_word |
| 277 | 140 | rt_word="$(shell_word "$rt")" |
| 278 | 140 | image_word="$(shell_word "$image")" |
| 279 | 1 | # Four persistence mounts make every `gco autopilot` engine (and anything |
| 280 | 1 | # else that keeps state under ~/.gco) survive the --rm container lifecycle: |
| 281 | 1 | # gco-dev-tools -> /root/.npm-global named volume; pinned |
| 282 | 1 | # Claude Code, Codex, and |
| 283 | 1 | # OpenCode lazy installs |
| 284 | 1 | # ~/.claude -> /root/.claude host dir; CLAUDE_CONFIG_DIR |
| 285 | 1 | # keeps Claude onboarding |
| 286 | 1 | # and transcripts |
| 287 | 1 | # ~/.gco -> /root/.gco host dir; GCO CLI state |
| 288 | 1 | # plus the generated MCP/ |
| 289 | 1 | # Codex/OpenCode configs and |
| 290 | 1 | # isolated Codex sessions |
| 291 | 1 | # gco-dev-opencode -> /root/.local/share/opencode named volume; OpenCode's |
| 292 | 1 | # session database, so |
| 293 | 1 | # --continue/--resume work |
| 294 | 1 | # across container runs |
| 295 | 1 | # OpenCode state is a named volume rather than a host mount on purpose: the |
| 296 | 1 | # host's own ~/.local/share/opencode may belong to a different OpenCode |
| 297 | 1 | # release, and sharing one SQLite database across versions is not safe. |
| 298 | 1 | # The host dirs are pre-created so a root-owned mount point is never |
| 299 | 1 | # created on Linux hosts. |
| 300 | 70 | cat <<EOF |
| 301 | $MARKER_BEGIN | |
| 302 | # Run the \`gco\` CLI inside the GCO dev container, against \$PWD. | |
| 303 | # Managed by scripts/setup-dev-alias.sh — re-run that script to regenerate | |
| 304 | # after switching container runtimes or image names. | |
| 305 | # ~/.aws is created (empty is fine) so hosts that authenticate purely through | |
| 306 | # environment variables, an OIDC/web-identity file, or instance metadata still | |
| 307 | # get a valid mount source instead of the runtime materialising a root-owned | |
| 308 | # directory on the host. Forwarded host variables use bare \`-e NAME\`, so | |
| 309 | # each is passed only when the calling shell actually has it set. | |
| 310 | gco() { | |
| 311 | mkdir -p "\$HOME/.aws" "\$HOME/.claude" "\$HOME/.gco" | |
| 312 | if [ -t 0 ] && [ -t 1 ]; then | |
| 313 | $rt_word run --rm -it -v "\$HOME/.aws:/root/.aws:${mount_opts}" -v "\$HOME/.claude:/root/.claude" -v "\$HOME/.gco:/root/.gco" -v gco-dev-tools:/root/.npm-global -v gco-dev-opencode:/root/.local/share/opencode -e CLAUDE_CONFIG_DIR=/root/.claude ${forwarded_env}-v "\$PWD:/workspace" ${socket}-w /workspace $image_word gco "\$@" | |
| 314 | else | |
| 315 | $rt_word run --rm -i -v "\$HOME/.aws:/root/.aws:${mount_opts}" -v "\$HOME/.claude:/root/.claude" -v "\$HOME/.gco:/root/.gco" -v gco-dev-tools:/root/.npm-global -v gco-dev-opencode:/root/.local/share/opencode -e CLAUDE_CONFIG_DIR=/root/.claude ${forwarded_env}-v "\$PWD:/workspace" ${socket}-w /workspace $image_word gco "\$@" | |
| 316 | fi | |
| 317 | } | |
| 318 | $MARKER_END | |
| 319 | EOF | |
| 320 | } | |
| 321 | ||
| 322 | # Number of times to try the image build, and the backoff between tries. | |
| 323 | # The build's first act is resolving the Dockerfile.dev base image from Docker | |
| 324 | # Hub, which is a public registry the build does not control: a single DNS or | |
| 325 | # TCP timeout there ("failed to resolve source metadata ... i/o timeout") fails | |
| 326 | # an otherwise healthy build. Retrying makes that transient class self-healing | |
| 327 | # while a genuine build error still fails on the last attempt with its own | |
| 328 | # output. Override the count to 1 to disable retries. | |
| 329 | 77 | BUILD_ATTEMPTS="${GCO_DEV_IMAGE_BUILD_ATTEMPTS:-3}" |
| 330 | 77 | BUILD_RETRY_DELAY="${GCO_DEV_IMAGE_BUILD_RETRY_DELAY:-15}" |
| 331 | ||
| 332 | build_image() { | |
| 333 | 14 | local rt="$1" |
| 334 | 14 | [ -f "$DOCKERFILE" ] || die "cannot build '$IMAGE': $DOCKERFILE not found." |
| 335 | 14 | log "Building the '$IMAGE' image from Dockerfile.dev with $rt ..." |
| 336 | 14 | log "(the first build can take a few minutes; re-runs reuse cached layers and just refresh what changed)" |
| 337 | ||
| 338 | 14 | local attempt=1 |
| 339 | 24 | while true; do |
| 340 | 24 | if "$rt" build -f "$DOCKERFILE" -t "$IMAGE" "$REPO_ROOT"; then |
| 341 | 8 | break |
| 342 | fi | |
| 343 | 16 | if [ "$attempt" -ge "$BUILD_ATTEMPTS" ]; then |
| 344 | 6 | die "$rt failed to build '$IMAGE' from $DOCKERFILE." |
| 345 | fi | |
| 346 | 10 | log "build attempt $attempt/$BUILD_ATTEMPTS failed; retrying in ${BUILD_RETRY_DELAY}s ..." |
| 347 | 10 | log "(usually a transient registry/network error pulling the base image)" |
| 348 | 10 | sleep "$BUILD_RETRY_DELAY" |
| 349 | 10 | attempt=$((attempt + 1)) |
| 350 | done | |
| 351 | ||
| 352 | 8 | log "Image '$IMAGE' is ready." |
| 353 | 8 | log "" |
| 354 | } | |
| 355 | ||
| 356 | install_block() { | |
| 357 | 24 | local rc="$1" block="$2" tmp |
| 358 | 48 | tmp="$(mktemp)" |
| 359 | 24 | if [ -f "$rc" ]; then |
| 360 | 5 | awk -v b="$MARKER_BEGIN" -v e="$MARKER_END" ' |
| 361 | $0 == b { skip = 1 } | |
| 362 | skip != 1 { print } | |
| 363 | $0 == e { skip = 0 } | |
| 364 | ' "$rc" > "$tmp" | |
| 365 | 8 | if [ -s "$tmp" ]; then printf '\n' >> "$tmp"; fi |
| 366 | fi | |
| 367 | 24 | printf '%s\n' "$block" >> "$tmp" |
| 368 | 24 | mv "$tmp" "$rc" |
| 369 | } | |
| 370 | ||
| 371 | # Uninstall is pure rc-file surgery: it must work on a machine whose container | |
| 372 | # runtime is gone or broken, so it runs before any runtime detection or build. | |
| 373 | 77 | if [ "$UNINSTALL" -eq 1 ]; then |
| 374 | 6 | remove_block "$(choose_rc_file)" |
| 375 | 3 | exit 0 |
| 376 | fi | |
| 377 | ||
| 378 | 150 | runtime="$(resolve_runtime || true)" |
| 379 | 76 | [ -n "$runtime" ] || die "no container runtime found. Install Docker, Finch, or Podman and start it, then re-run (or force one with --runtime NAME)." |
| 380 | 72 | require_single_line "container runtime" "$runtime" |
| 381 | 72 | if [ "$runtime" = "podman" ]; then |
| 382 | 9 | require_single_line "XDG_RUNTIME_DIR" "${XDG_RUNTIME_DIR:-/run/user/$(id -u)}" |
| 383 | fi | |
| 384 | ||
| 385 | 144 | socket="$(socket_args_for "$runtime")" |
| 386 | ||
| 387 | # Podman does not resolve a bare, locally-built image name: an image built with | |
| 388 | # `podman build -t gco-dev` is stored as `localhost/gco-dev`, but `podman run | |
| 389 | # gco-dev` treats the unqualified name as remote and searches the configured | |
| 390 | # registries (docker.io, quay.io, ...) instead of local storage. Prefix | |
| 391 | # `localhost/` so the emitted `podman run` finds the image you built locally. | |
| 392 | # Names that already carry a registry/namespace (contain a `/`) are untouched, | |
| 393 | # and docker/finch — which do resolve bare local names — keep the plain name. | |
| 394 | 72 | image_ref="$IMAGE" |
| 395 | 72 | if [ "$runtime" = "podman" ]; then |
| 396 | 9 | case "$IMAGE" in |
| 397 | 1 | */*) : ;; |
| 398 | 8 | *) image_ref="localhost/$IMAGE" ;; |
| 399 | esac | |
| 400 | fi | |
| 401 | 72 | require_single_line "image name" "$image_ref" |
| 402 | ||
| 403 | 140 | mount_suffix="$(mount_suffix_for_host)" |
| 404 | 70 | if [ "$AWS_WRITABLE" -eq 1 ]; then |
| 405 | # Writable ~/.aws lets `aws sso login` / `aws configure` run INSIDE the | |
| 406 | # container and cache their tokens where the host can reuse them. Opt-in: | |
| 407 | # the read-only default keeps a container that runs third-party tooling | |
| 408 | # from rewriting the operator's credential files. | |
| 409 | 1 | aws_mount_opts="rw${mount_suffix}" |
| 410 | else | |
| 411 | 69 | aws_mount_opts="ro${mount_suffix}" |
| 412 | fi | |
| 413 | ||
| 414 | 210 | block="$(emit_block "$runtime" "$socket" "$image_ref" "$(forwarded_env_args)" "$aws_mount_opts")" |
| 415 | ||
| 416 | 70 | if [ "$PRINT_ONLY" -eq 1 ]; then |
| 417 | 39 | printf '%s\n' "$block" |
| 418 | 39 | exit 0 |
| 419 | fi | |
| 420 | ||
| 421 | # Build (or refresh) the dev image before wiring up the function, so a single | |
| 422 | # run takes a fresh clone all the way to a working `gco`. Always rebuilding also | |
| 423 | # means a stale local image is transparently replaced. Skipped with --no-build. | |
| 424 | 31 | if [ "$NO_BUILD" -eq 1 ]; then |
| 425 | 17 | log "Skipping the image build (--no-build); assuming '$image_ref' already exists." |
| 426 | 17 | log "" |
| 427 | else | |
| 428 | 14 | build_image "$runtime" |
| 429 | fi | |
| 430 | ||
| 431 | 50 | rc="$(choose_rc_file)" |
| 432 | 24 | install_block "$rc" "$block" |
| 433 | ||
| 434 | 24 | log "Installed the 'gco' dev-container function." |
| 435 | 24 | log "" |
| 436 | 24 | log " Container runtime : $runtime" |
| 437 | 48 | log " Socket mount : $(socket_desc_for "$runtime")" |
| 438 | 24 | log " Dev image : $image_ref" |
| 439 | 24 | log " Shell profile : $rc" |
| 440 | 72 | log " AWS credentials : ~/.aws mounted $([ "$AWS_WRITABLE" -eq 1 ] && printf 'read-write' || printf 'read-only') + AWS_PROFILE/AWS_REGION/keys/session" |
| 441 | 24 | log " forwarded from your shell when set" |
| 442 | 24 | log " Autopilot env : engine/model/config controls forwarded when set" |
| 443 | 24 | if [ -n "$mount_suffix" ]; then |
| 444 | 1 | log " SELinux : enforcing host detected; bind mounts carry the ',z' shared label" |
| 445 | fi | |
| 446 | 24 | log "" |
| 447 | 24 | if [ "$AWS_WRITABLE" -eq 0 ]; then |
| 448 | 24 | log "Note: ~/.aws is mounted read-only, so an SSO/session token that expires must be" |
| 449 | 24 | log "refreshed on the host ('aws sso login'); re-run with --aws-writable to allow the" |
| 450 | 24 | log "container to refresh and cache it instead." |
| 451 | fi | |
| 452 | 24 | if [ -n "${AWS_CONFIG_FILE:-}${AWS_SHARED_CREDENTIALS_FILE:-}${AWS_WEB_IDENTITY_TOKEN_FILE:-}" ]; then |
| 453 | 1 | log "" |
| 454 | 1 | log "Note: you have an AWS file-path variable set. It is forwarded, but the file is" |
| 455 | 1 | log "only readable in the container when it lives under ~/.aws (the mounted path)." |
| 456 | 1 | log "Copy or symlink it under ~/.aws, or add your own -v mount to the function." |
| 457 | fi | |
| 458 | 24 | log "" |
| 459 | 24 | log "Activate it in this shell: source \"$rc\"" |
| 460 | 24 | log "Then try: gco --help" |
| 461 | 24 | if [ -z "$socket" ]; then |
| 462 | 1 | log "" |
| 463 | 1 | log "Note: $runtime runs containers inside a VM and exposes no host daemon socket the" |
| 464 | 1 | log "container can reach (a bind-mounted socket connects to nothing across the VM" |
| 465 | 1 | log "boundary), so the function omits the socket mount. Everyday commands — jobs," |
| 466 | 1 | log "status, costs, inference, and non-build stacks operations — work as-is." |
| 467 | 1 | log "" |
| 468 | 1 | log "Build-heavy commands ('gco stacks deploy-all', image builds) need a container" |
| 469 | 1 | log "daemon at CDK synth time, so run them on the host with $runtime as the builder:" |
| 470 | 1 | log "" |
| 471 | 1 | log " CDK_DOCKER=$runtime gco stacks deploy-all -y" |
| 472 | 1 | log "" |
| 473 | 1 | log "Run that against a host install of the GCO CLI whose deps match the lockfile" |
| 474 | 1 | log "(e.g. a project virtualenv), so the pinned aws-cdk-lib / cdk-nag are used." |
| 475 | fi |