WIP: feat: Add DockerDriver for deploying chatmail relays via Docker Compose inside LXC - #37
Draft
j4n wants to merge 17 commits into
Draft
WIP: feat: Add DockerDriver for deploying chatmail relays via Docker Compose inside LXC#37j4n wants to merge 17 commits into
j4n wants to merge 17 commits into
Conversation
j4n
marked this pull request as draft
August 3, 2026 15:12
j4n
marked this pull request as ready for review
August 3, 2026 15:22
j4n
changed the title
j4n
marked this pull request as draft
August 3, 2026 15:29
j4n
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 5, 2026 10:32
e706ea1 to
68f7425
Compare
j4n
force-pushed
the
j4n/docker-driver
branch
2 times, most recently
from
August 5, 2026 11:44
c976c53 to
7cd8076
Compare
j4n
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 5, 2026 11:57
68f7425 to
c652452
Compare
j4n
force-pushed
the
j4n/docker-driver
branch
2 times, most recently
from
August 5, 2026 12:18
e4d54c6 to
3e8fb06
Compare
j4n
marked this pull request as ready for review
August 5, 2026 12:38
j4n
changed the title
j4n
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 6, 2026 06:07
c652452 to
05c62e8
Compare
j4n
force-pushed
the
j4n/docker-driver
branch
2 times, most recently
from
August 6, 2026 07:43
ef304d6 to
966b5be
Compare
j4n
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 6, 2026 11:23
05c62e8 to
628634a
Compare
j4n
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 6, 2026 11:35
628634a to
eaf84ed
Compare
j4n
force-pushed
the
j4n/docker-driver
branch
2 times, most recently
from
August 11, 2026 10:39
97d7e54 to
904a895
Compare
j4n
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 11, 2026 10:39
eaf84ed to
0836f27
Compare
hpk42
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 11, 2026 12:36
0836f27 to
553a878
Compare
hpk42
force-pushed
the
j4n/docker-driver
branch
from
August 11, 2026 12:36
904a895 to
faa68f4
Compare
hpk42
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 11, 2026 12:53
553a878 to
d972f27
Compare
hpk42
force-pushed
the
j4n/docker-driver
branch
from
August 11, 2026 12:53
faa68f4 to
18a0dad
Compare
j4n
force-pushed
the
j4n/docker-driver-prereqs
branch
from
August 12, 2026 07:04
d972f27 to
73fb9df
Compare
.github/workflows/nightly.yml: - Scheduled at 02:17 UTC daily (also workflow_dispatch for manual runs). - based on reusable workflow
The option was introduced in c0aba9d as one of dns/ipv4/ipv6 enum, but nothing on the relay side ever supported it; drop it for now to prevent users dropping into an unsupported path. Right now, we only support v4-no-DNS and dualstack-DNS as relay deploy options.
Relays are dual-stack by default but DNS registrations published only an A record, so relay's zone generation never emitted AAAA and dual-stack was untested. Build the records once in address_records(), and settle ct.ipv6 beforehand; add two tests.
j4n
changed the base branch from
j4n/docker-driver-prereqs
to
j4n/incus-container-hardening
August 13, 2026 16:03
j4n
changed the base branch from
j4n/incus-container-hardening
to
j4n/nightly-matrix
August 13, 2026 16:04
j4n
changed the base branch from
j4n/nightly-matrix
to
j4n/incus-container-hardening
August 13, 2026 16:04
j4n
marked this pull request as draft
August 13, 2026 16:04
This was referenced Aug 13, 2026
Containers with Docker or other networking can expose IPs on multiple interfaces. Extend _extract_ip() to accepts an optional subnet filter and add bridge_subnet() to get the bridge subnet so wait_ready() and list_managed() only pick addresses on incusbr0.
Move the initialization check (DNS container running + base image present) from cli._check_init() into Incus.check_init() so drivers can call it without depending on the CLI module.
…ure() Allows drivers to pass additional Incus config keys (e.g. security.nesting=true for Docker-in-LXC) when launching containers. Passed through Container and RelayContainer.
When the source ref is a full 40-char SHA, e.g., from CI dispatch, the shallow git-main clone won't have it. Detect this case and fetch just that commit with --depth 1 before checkout.
The `git reset --hard origin/{ref}` is only useful for branch refs,
for SHA refs it always fails silently since there's no remote tracking branch.
Only run it for branch refs.
…nit_relay Extract the cmdeploy test logic into a standalone run_test_cmdeploy() so any cmdeploy-based driver can call it, not just CmdeployDriver.
…ript Both the cmdeploy and docker drivers need to generate chatmail.ini with relaxed rate limits for testing. Extract the overrides dict and the Python snippet builder into shared helpers.
Two wrappers for Container.bash() with and without failure checking.
…oy by driver Both are driver-agnostic and were mixed into the Docker driver PR. driver_base.py: on_init_relay defaults to scripts/initenv.sh instead of pass, so CmdeployDriver's identical override goes away and any future cmdeploy-based driver inherits it. MadmailDriver keeps its own override. cli.py: test_cmdeploy_cmd hardcoded CmdeployDriver, so a relay deployed by another driver silently got the wrong one. Look it up in DRIVER_BY_NAME as _resolve_relay_addr already does, warning and falling back if unknown.
Add DockerDriver for deploying chatmail relays via Docker Compose inside LXC containers (Docker-in-LXC with security.nesting). Features: - Pull pre-built images from GHCR (--source ghcr:TAG) - Inject local builds - Healthcheck polling / log streaming - SSH forwarding into Docker containers (for test compatibility) - DNS zone extraction and PowerDNS loading - security.privileged fenced behind CI=true CLI subcommands: deploy, pull, logs, ps, shell
- Register DockerDriver in DRIVER_BY_NAME - test-cmdeploy: dispatch to driver class from container metadata - Fix _print_builder_repos to use driver REPO_NAME (avoids dupes)
Cache a localchat-docker image (Docker images stripped before export) and dump per-service Docker diagnostics when a run fails. AppArmor is not touched here: callers that need Docker-in-LXC systemd disable it from their own cmlxc_commands, so the shared workflow stays neutral for every other consumer.
j4n
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #6 as a combined PR.
Add DockerDriver for deploying chatmail relays via Docker Compose inside LXC containers (Docker-in-LXC with security.nesting).
Features:
CLI subcommands:
deploy, pull, logs, ps, shell