Added compatibility of docker-socket-proxy example in docker-compose to bypass docker access problems and add ACLs

backend/app_sdk/app_base.py

@@ -1909,10 +1909,10 @@ class AppBase:
                 basejson = json.loads(baseresult)
             except json.decoder.JSONDecodeError as e:
                 try:
-                    #baseresult = baseresult.replace("\'", "\"")
+                    baseresult = baseresult.replace("\'", "\"")
                     basejson = json.loads(baseresult)
                 except json.decoder.JSONDecodeError as e:
-                    print("Parser issue with JSON: %s" % e)
+                    print(f"[ERROR] Parser issue with JSON for {baseresult}: {e}")
                     return str(baseresult)+str(appendresult), False
 
             print("[INFO] After fourth parser return as JSON")

docker-compose.yml

@@ -61,7 +61,10 @@ services:
       - SHUFFLE_SWARM_NETWORK_NAME=shuffle_swarm_executions
       - SHUFFLE_SCALE_REPLICAS=1
       - SHUFFLE_SWARM_CONFIG=runn
+      #- DOCKER_HOST=tcp://docker-socket-proxy:2375
     restart: unless-stopped
+    security_opt:
+      - seccomp:unconfined
   opensearch:
     image: opensearchproject/opensearch:1.2.4
     hostname: shuffle-opensearch
@@ -89,6 +92,30 @@ services:
     networks:
       - shuffle
     restart: unless-stopped
+  #docker-socket-proxy:
+  #  image: tecnativa/docker-socket-proxy
+  #  privileged: true
+  #  environment:
+  #    - SERVICES=1
+  #    - TASKS=1
+  #    - NETWORKS=1
+  #    - NODES=1
+  #    - BUILD=1
+  #    - IMAGES=1
+  #    - GRPC=1
+  #    - CONTAINERS=1
+  #    - PLUGINS=1
+  #    - SYSTEM=1
+  #    - VOLUMES=1
+  #    - INFO=1
+  #    - DISTRIBUTION=1
+  #    - POST=1
+  #    - AUTH=1
+  #    - SECRETS=1
+  #  volumes:
+  #    - /var/run/docker.sock:/var/run/docker.sock
+  #  networks:
+  #    - shuffle
 networks:
   shuffle:
     driver: bridge

functions/onprem/orborus/build.sh

@@ -1,5 +1,5 @@
 NAME=shuffle-orborus
-VERSION=0.9.61
+VERSION=0.9.62
 
 echo "Running docker build with $NAME:$VERSION"
 #docker rmi frikky/shuffle:$NAME --force

functions/onprem/orborus/orborus.go

@@ -361,13 +361,6 @@ func deployServiceWorkers(image string) {
 						fmt.Sprintf("SHUFFLE_APP_REPLICAS=%d", cnt),
 						fmt.Sprintf("TZ=%s", timezone),
 					},
-					Mounts: []mount.Mount{
-						mount.Mount{
-							Source: "/var/run/docker.sock",
-							Target: "/var/run/docker.sock",
-							Type:   mount.TypeBind,
-						},
-					},
 					Hosts: []string{
 						innerContainerName,
 					},
@@ -398,6 +391,18 @@ func deployServiceWorkers(image string) {
 			serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("SHUFFLE_SCALE_REPLICAS=%s", os.Getenv("SHUFFLE_SCALE_REPLICAS")))
 		}
 
+		if len(os.Getenv("DOCKER_HOST")) > 0 {
+			serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("DOCKER_HOST=%s", os.Getenv("DOCKER_HOST")))
+		} else {
+			serviceSpec.TaskTemplate.ContainerSpec.Mounts = []mount.Mount{
+				mount.Mount{
+					Source: "/var/run/docker.sock",
+					Target: "/var/run/docker.sock",
+					Type:   mount.TypeBind,
+				},
+			}
+		}
+
 		serviceOptions := types.ServiceCreateOptions{}
 		_, err = dockercli.ServiceCreate(
 			ctx,
@@ -805,6 +810,12 @@ func main() {
 		}
 	}
 
+	if len(os.Getenv("DOCKER_HOST")) > 0 {
+		log.Printf("[DEBUG] Running docker with socket proxy %s instead of default", os.Getenv("DOCKER_HOST"))
+	} else {
+		log.Printf("[DEBUG] Running docker with default socket /var/run/docker.sock")
+	}
+
 	ctx := context.Background()
 	// Run by default from now
 	zombiecheck(ctx, workerTimeout)