mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-08-01 19:06:01 +00:00
aacb99cfd2
* feat(lark): sidecar credential broker for sandbox lark-cli (Pattern B) Removes the plaintext Lark credential mounts (appSecret + OAuth tokens) from the sandbox container. A long-running broker sidecar owns lark-cli and the per-user config/data dirs and serves the command surface over Pod loopback; the sandbox gets only a forwarding shim on PATH, so the raw credential files never exist in the sandbox filesystem. - lark_broker.py: stdlib-only loopback broker (argv passthrough with shell=False, server-injected credential env, bounded I/O) + shim script constant + install-shim mode. - docker/lark-cli-broker: init(install-shim) + serve image. - provisioner: LARK_CLI_BROKER_IMAGE + provision_lark_cli_broker → shim init container + lark-cli-broker sidecar (config/data mounted sidecar-only); credentials dropped from the sandbox container; /api/capabilities reports lark_cli_broker_image. Broker supersedes the Pattern A init-container binary when both are configured. - gateway: lark_cli_env_overlay(broker=True) omits config/data env; sandbox_lark_broker_active() TTL-cached mode resolver; broker added to sandbox_runtime_mode / readiness and the settings UI. Opt-in and off by default (empty LARK_CLI_BROKER_IMAGE ⇒ no change). Closes #4338 * fix(lark): address Pattern B broker review findings (#4501) Follow-up to the sidecar credential broker addressing the PR #4501 review: - shim: split the on-PATH lark-cli into a /bin/sh launcher + Python shim body so broker mode fails loudly (exit 127, actionable message) instead of ENOEXEC when the sandbox image ships no python3; interpreter pinnable via DEERFLOW_LARK_BROKER_PYTHON. Launcher bakes in the shim's absolute path since $0 is the bare command name when run off PATH. - broker: drop the dead cwd payload field (broker can't see the sandbox FS) and document the command-surface-only / no-file-IO limitation. - broker: return a structured 500 JSON on unexpected exec errors so the shim gets a meaningful message, not an opaque transport failure; set a handler socket timeout to bound slow/stuck connections. - broker: add an opt-in DEERFLOW_LARK_BROKER_DENY_SUBCOMMANDS denylist that refuses secret-dumping subcommands before spawning the binary, forwarded from the provisioner sidecar. - gateway: tighten the per-bash-call broker probe timeout (1.5s) and cache negatives longer (300s) so non-broker remote-provisioner users don't pay a latency hit; guard the mode cache with a lock; drop the dead _probe_provisioner_lark_cli_init_image wrapper. - docs: remove the broken design-doc link from the broker README. Adds tests for launcher python resolution, cwd omission, denylist enforcement, 500-on-error, hot-path probe timeout + negative caching, and provisioner denylist-env wiring.
80 lines
3.5 KiB
Docker
80 lines
3.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# DeerFlow "lark-cli broker" image (Pattern B, issue #4338).
|
|
#
|
|
# Purpose: hold `lark-cli` + the per-user Lark credentials in a long-running
|
|
# sidecar and expose only the command surface over loopback, so the plaintext
|
|
# app secret / OAuth tokens never get mounted into the sandbox container.
|
|
#
|
|
# The one image runs in two modes (dispatched by the first CLI arg):
|
|
#
|
|
# install-shim <dest> init-container mode: write the Python shim +
|
|
# runtime marker into the shared emptyDir at <dest>
|
|
# (default /mnt/integrations/lark-cli/runtime), so the
|
|
# sandbox finds `bin/lark-cli` on PATH — same layout the
|
|
# Pattern A init image produces, marked kind=shim.
|
|
#
|
|
# serve (default CMD) sidecar mode: run the broker HTTP server on loopback
|
|
# with the real `lark-cli` and credential env pointing at
|
|
# the sidecar-only /var/lark/{config,data} mounts.
|
|
#
|
|
# At BUILD time (network available) this image downloads and SHA-256-verifies the
|
|
# official `larksuite/cli` Linux release binaries (via the shared build-runtime.sh
|
|
# from docker/lark-cli-init) into /opt/lark-cli, so the sidecar has a real binary.
|
|
#
|
|
# The shim itself is written from the in-process constant
|
|
# LARK_CLI_BROKER_SHIM_SCRIPT (deerflow.integrations.lark_broker), so the image's
|
|
# shim can never drift from the Gateway's copy.
|
|
#
|
|
# Build (defaults to the pinned version below):
|
|
# docker build -t deer-flow/lark-cli-broker:v1.0.65 \
|
|
# --build-arg LARK_CLI_VERSION=v1.0.65 \
|
|
# -f docker/lark-cli-broker/Dockerfile .
|
|
#
|
|
# NOTE: build context is the repo root (the module lives under backend/).
|
|
|
|
FROM debian:bookworm-slim AS builder
|
|
|
|
ARG APT_MIRROR
|
|
ARG LARK_CLI_VERSION=v1.0.65
|
|
|
|
RUN if [ -n "${APT_MIRROR}" ]; then \
|
|
sed -i "s|deb.debian.org|${APT_MIRROR}|g" /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; \
|
|
sed -i "s|deb.debian.org|${APT_MIRROR}|g" /etc/apt/sources.list 2>/dev/null || true; \
|
|
fi
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Reuse the Pattern A build script so the real sidecar binary is staged with the
|
|
# identical download + SHA-256 verification path.
|
|
COPY docker/lark-cli-init/build-runtime.sh /usr/local/bin/build-runtime.sh
|
|
RUN chmod +x /usr/local/bin/build-runtime.sh \
|
|
&& LARK_CLI_VERSION="${LARK_CLI_VERSION}" /usr/local/bin/build-runtime.sh /opt/lark-cli
|
|
|
|
# ── Final image: python3 + the staged real binary + the broker module ────────
|
|
FROM python:3.12-slim
|
|
|
|
ARG LARK_CLI_VERSION=v1.0.65
|
|
ENV LARK_CLI_VERSION=${LARK_CLI_VERSION}
|
|
|
|
COPY --from=builder /opt/lark-cli /opt/lark-cli
|
|
# Single stdlib-only module drives both install-shim and serve.
|
|
COPY backend/packages/harness/deerflow/integrations/lark_broker.py /opt/broker/lark_broker.py
|
|
COPY docker/lark-cli-broker/entrypoint.sh /usr/local/bin/lark-cli-broker
|
|
RUN chmod +x /usr/local/bin/lark-cli-broker
|
|
|
|
# serve mode: the sidecar runs the real arch-dispatch launcher and reads the
|
|
# credential dirs the provisioner mounts into the sidecar only.
|
|
ENV DEERFLOW_LARK_BROKER_CLI=/opt/lark-cli/bin/lark-cli \
|
|
LARKSUITE_CLI_CONFIG_DIR=/var/lark/config \
|
|
LARKSUITE_CLI_DATA_DIR=/var/lark/data \
|
|
DEERFLOW_LARK_BROKER_HOST=127.0.0.1 \
|
|
DEERFLOW_LARK_BROKER_PORT=8788 \
|
|
LARK_CLI_RUNTIME_DEST=/mnt/integrations/lark-cli/runtime
|
|
|
|
ENTRYPOINT ["/usr/local/bin/lark-cli-broker"]
|
|
CMD ["serve"]
|