docker.go

package executor

import (
	"context"
	"fmt"

	"github.com/docker/docker/api/types"
	"github.com/docker/docker/api/types/container"
	"github.com/docker/docker/api/types/mount"
	"github.com/docker/docker/client"
)

func StartExecutionSession(ctx context.Context, containerId string) (*types.HijackedResponse, error) {

	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
	if err != nil {
		return nil, err
	}

	containerInfo, err := cli.ContainerInspect(ctx, containerId)
	if err != nil {
		return nil, fmt.Errorf("failed to inspect container: %w", err)
	}

	if !containerInfo.State.Running {
		return nil, fmt.Errorf("container is not running")
	}

	exec, err := cli.ContainerExecCreate(ctx, containerId, container.ExecOptions{
		Cmd:          []string{"sh", "-l"},
		AttachStderr: true,
		AttachStdout: true,
		AttachStdin:  true,
		Tty:          true,
		Env:          []string{"TERM=xterm"},
	})
	if err != nil {
		return nil, fmt.Errorf("error startign the exec %v", err)
	}

	attach, err := cli.ContainerExecAttach(ctx, exec.ID, container.ExecAttachOptions{})
	if err != nil {
		return nil, err
	}
	return &attach, nil
}

func GetSecureContainerConfig(image, source, target, projectID string) (*container.Config, *container.HostConfig) {
	config := &container.Config{
		Image:      image,
		WorkingDir: "/home/developer/workspace",
		Cmd:        []string{"tail", "-f", "/dev/null"},
		Tty:        true,
		OpenStdin:  true,
	}

	hostConfig := &container.HostConfig{
		ReadonlyRootfs: true,
		Binds:          []string{},
		Mounts: []mount.Mount{
			{
				Type:     mount.TypeVolume,
				Source:   "collab-ide_persistence",    // The full volume name
				Target:   "/home/developer/workspace", // Destination inside the terminal container
				ReadOnly: false,                       // Ensure it's read-write (rw)
				VolumeOptions: &mount.VolumeOptions{
					Subpath: projectID, // 🚀 THE FIX: Targets ONLY this project's subfolder!
				},
			},
		},
		Tmpfs: map[string]string{
			"/tmp":  "rw,exec,size=64m,uid=1000,gid=1000",
			"/root": "rw,exec,size=256m",
		},

		CapDrop: []string{
			"ALL",
		},

		SecurityOpt: []string{"no-new-privileges:true"},
	}

	return config, hostConfig
}

func CreateAndStartContainer(ctx context.Context, image, source, target, projectID string) (string, error) {
	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
	if err != nil {
		return "", err
	}

	config, hostConfig := GetSecureContainerConfig(image, source, target, projectID)

	resp, err := cli.ContainerCreate(ctx, config, hostConfig, nil, nil, "")
	if err != nil {
		return "", err
	}

	if err := cli.ContainerStart(ctx, resp.ID, container.StartOptions{}); err != nil {
		return "", err
	}

	return resp.ID, nil
}

func RemoveContainer(containerId string) error {

	ctx := context.Background()
	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
	if err != nil {
		return err
	}
	return cli.ContainerRemove(ctx, containerId, container.RemoveOptions{
		Force: true,
	})
}