docker: logs follow a held connection, and networks can be removed

Two gaps the Docker tab had against Dockhand and against its own Services tab next door. Logs: one `docker logs -f` per viewer over a WebSocket, the shape the Services tab's journal tail already uses, instead of asking again every two seconds. stdout and stderr both, with stderr marked so the page can colour what went wrong. Docker replays the backlog down two pipes in no particular order, so the opening 300 ms is held and sorted by the stamp Docker wrote; after that the log is live and in order. A reconnect resumes from the last line rather than from the top — `--since` is inclusive and two lines can share a nanosecond, so the client drops what it has already shown by line, not by "later than". A container that has stopped ends the stream at once, so reconnects back off to 15 s. Networks: remove and prune, which images and volumes have had all along. The overview now says which containers are attached to each network, so the ✕ appears only on one nothing uses, and never on bridge, host or none. `network rm` prints the real reason and then an aggregate "exit status 1", so the message shown is the first line, not the last. Prune is not exercised against `core`: several networks here belong to stacks that are merely down, and pruning would give them new subnets on their next deploy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-25 21:17:37 -07:00
parent b8c654b61b
commit 09dc846730
6 changed files with 386 additions and 39 deletions
@@ -3,8 +3,8 @@ package api
 // The Docker tab: what is running, grouped the way it was deployed (compose stacks), with
 // start / stop / restart, logs and inspect — plus images, volumes and networks to look at.
 // It drives the docker CLI (or podman), as the user first and as root if that is refused.
-// Creating, removing and pruning are deliberately absent: whatever deployed the stacks
-// (Dockhand, compose) stays the one place that changes what exists.
+// What can be removed here is what nothing uses: an untagged image, a volume no container
+// holds, a network nothing is attached to. Compose stays the one place a stack is defined.

 import (
 	"context"
@@ -76,6 +76,18 @@ func dockerRun(ctx context.Context, args ...string) ([]byte, error) {
 	return out, nil
 }

+// dockerWhy picks the line worth showing out of a failed command. Some subcommands —
+// `network rm` among them — print the real reason first and then an aggregated "exit
+// status 1", which is what dockerRun's last-line rule would otherwise hand back.
+func dockerWhy(out []byte, err error) string {
+	for _, l := range strings.Split(string(out), "\n") {
+		if l = strings.TrimSpace(l); strings.HasPrefix(l, "Error") || strings.Contains(l, "daemon") {
+			return l
+		}
+	}
+	return err.Error()
+}
+
 func jsonLines(out []byte, each func(map[string]any)) {
 	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
 		var m map[string]any
@@ -139,23 +151,30 @@ func (s *Server) dockerOverview(w http.ResponseWriter, r *http.Request) {
 		}
 		return rows
 	}
-	// Who uses what, from one inspect of every container: an image or a volume nothing uses is
-	// the only kind this page offers to remove.
-	imageUsed, volumeUsers := map[string]bool{}, map[string][]string{}
+	// Who uses what, from one inspect of every container: an image, a volume or a network
+	// nothing uses is the only kind this page offers to remove.
+	imageUsed := map[string]bool{}
+	volumeUsers, networkUsers := map[string][]string{}, map[string][]string{}
 	if ids, err := dockerRun(ctx, "ps", "-aq"); err == nil && len(strings.Fields(string(ids))) > 0 {
-		const f = `{{.Name}}|{{.Image}}|{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}},{{end}}{{end}}`
+		const f = `{{.Name}}|{{.Image}}|{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}},{{end}}{{end}}|{{range $k, $v := .NetworkSettings.Networks}}{{$k}},{{end}}`
 		if out, err := dockerRun(ctx, append([]string{"inspect", "-f", f}, strings.Fields(string(ids))...)...); err == nil {
 			for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
-				p := strings.SplitN(line, "|", 3)
-				if len(p) < 3 {
+				p := strings.SplitN(line, "|", 4)
+				if len(p) < 4 {
 					continue
 				}
+				name := strings.TrimPrefix(p[0], "/")
 				if id := strings.TrimPrefix(p[1], "sha256:"); len(id) >= 12 {
 					imageUsed[id[:12]] = true
 				}
 				for _, v := range strings.Split(p[2], ",") {
 					if v != "" {
-						volumeUsers[v] = append(volumeUsers[v], strings.TrimPrefix(p[0], "/"))
+						volumeUsers[v] = append(volumeUsers[v], name)
+					}
+				}
+				for _, n := range strings.Split(p[3], ",") {
+					if n != "" {
+						networkUsers[n] = append(networkUsers[n], name)
 					}
 				}
 			}
@@ -175,8 +194,18 @@ func (s *Server) dockerOverview(w http.ResponseWriter, r *http.Request) {
 		v["used_by"] = users
 		v["anonymous"] = strings.Contains(dstr(v, "Labels"), "com.docker.volume.anonymous")
 	}
+	networks := list("network", "ls", "--format", "{{json .}}")
+	for _, n := range networks {
+		users := networkUsers[dstr(n, "Name")]
+		if users == nil {
+			users = []string{}
+		}
+		sort.Strings(users)
+		n["used_by"] = users
+		n["predefined"] = predefinedNetwork[dstr(n, "Name")]
+	}
 	jsonOK(w, 200, map[string]any{"available": true, "tool": dockerTool(), "containers": containers,
-		"images": images, "volumes": volumes, "networks": list("network", "ls", "--format", "{{json .}}")})
+		"images": images, "volumes": volumes, "networks": networks})
 }

 var dockerRef = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$`)
@@ -399,6 +428,50 @@ func (s *Server) volumePrune(w http.ResponseWriter, r *http.Request) {
 	jsonOK(w, 200, map[string]string{"result": lines[len(lines)-1]})
 }

+// The three networks Docker makes itself. They hold nothing, cannot be removed, and
+// their absence would break every container that asks for one by name.
+var predefinedNetwork = map[string]bool{"bridge": true, "host": true, "none": true}
+
+// networkRemove deletes one network. Unlike a volume there is no data in it, and unlike an
+// image nothing has to be downloaded again — a stack that wants it back gets it recreated
+// on the next deploy. Docker refuses one a container is still attached to, which is the
+// check that matters, so this asks for no second confirmation.
+func (s *Server) networkRemove(w http.ResponseWriter, r *http.Request) {
+	var body struct{ Name string }
+	if err := json.NewDecoder(io.LimitReader(r.Body, 4096)).Decode(&body); err != nil || !volumeRef.MatchString(body.Name) {
+		jsonErr(w, 400, "which network?")
+		return
+	}
+	if predefinedNetwork[body.Name] {
+		jsonErr(w, 400, body.Name+" is one of Docker's own networks and can't be removed")
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 90*time.Second)
+	defer cancel()
+	if out, err := dockerRun(ctx, "network", "rm", body.Name); err != nil {
+		jsonErr(w, 409, dockerWhy(out, err))
+		return
+	}
+	log.Printf("docker: network rm %s (from %s)", body.Name, clientIP(r))
+	w.WriteHeader(204)
+}
+
+// networkPrune removes every network no container is attached to. A stack that is merely
+// down counts as unattached, so its network goes too — and comes back on the next deploy,
+// with a new subnet. That is the whole cost, and the caller is told it.
+func (s *Server) networkPrune(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Minute)
+	defer cancel()
+	out, err := dockerRun(ctx, "network", "prune", "-f")
+	if err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+	log.Printf("docker: network prune (from %s)", clientIP(r))
+	jsonOK(w, 200, map[string]string{"result": lines[len(lines)-1]})
+}
+
 // ---- a container's health, its recent life, its console, and its limits ----

 // dockerHealth is the health check's verdict and the last few probe results. Docker keeps
@@ -0,0 +1,206 @@
+package api
+
+// Following a container's log over a held connection, the way the Services tab follows a
+// journal. The polled `?since=` endpoint next door still exists — it is what a reconnect
+// hands back to pick up from — but the live view holds one `docker logs -f` per viewer
+// instead of asking again every two seconds.
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"os/exec"
+	"sort"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/coder/websocket"
+
+	"hamlab/internal/priv"
+)
+
+// logLine is one line of a container's output: the time Docker stamped it with, the text,
+// and which of the two streams it came out of — stderr is where a container says what went
+// wrong, and the page colours it accordingly.
+type logLine struct {
+	T   string `json:"t"`
+	M   string `json:"m"`
+	Err bool   `json:"err,omitempty"`
+	at  string // when to sort it by: its own stamp, or the last one its stream carried
+}
+
+// splitStamp pulls Docker's RFC 3339 prefix off a line. A line without one (a container
+// that writes bare bytes, or a continuation) keeps the whole text and no time — but is
+// still sorted where its stream put it, behind the last line that did have one.
+func splitStamp(l string, carry *string) logLine {
+	t, m, ok := strings.Cut(l, " ")
+	if _, err := time.Parse(time.RFC3339Nano, t); !ok || err != nil {
+		return logLine{M: l, at: *carry}
+	}
+	*carry = t
+	return logLine{T: t, M: m, at: t}
+}
+
+// dockerTail streams a container's output as JSON text frames until the client goes away.
+// `?since=<RFC3339>` resumes where a dropped connection left off; otherwise it starts with
+// the last `?n=` lines.
+func (s *Server) dockerTail(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if !dockerRef.MatchString(id) {
+		jsonErr(w, 400, "bad container")
+		return
+	}
+	tool := dockerTool()
+	if tool == "" {
+		jsonErr(w, 500, "neither docker nor podman is installed here")
+		return
+	}
+	args := []string{tool, "logs", "--timestamps", "--follow"}
+	if since := r.URL.Query().Get("since"); since != "" {
+		if _, err := time.Parse(time.RFC3339Nano, since); err != nil {
+			jsonErr(w, 400, "since is an RFC 3339 time")
+			return
+		}
+		args = append(args, "--since", since)
+	} else {
+		args = append(args, "--tail", strconv.Itoa(logCount(r)))
+	}
+	args = append(args, id)
+	if priv.Available() && !dockerReachable() {
+		args = priv.Wrap(args...)
+	}
+
+	conn, err := websocket.Accept(w, r, &websocket.AcceptOptions{CompressionMode: websocket.CompressionDisabled})
+	if err != nil {
+		return
+	}
+	defer conn.Close(websocket.StatusNormalClosure, "")
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, args[0], args[1:]...)
+	// Own process group, so the kill reaches the docker client itself and not just a sudo
+	// wrapper — the same reason the journal tail does it.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error {
+		pg := "-" + strconv.Itoa(cmd.Process.Pid)
+		if args[0] != tool { // running under sudo: only sudo can signal root's children
+			k := priv.Wrap("kill", "-9", "--", pg)
+			return exec.Command(k[0], k[1:]...).Run()
+		}
+		return syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return
+	}
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return
+	}
+	if err := cmd.Start(); err != nil {
+		_ = conn.Write(ctx, websocket.MessageText, mustJSON(logLine{M: err.Error(), Err: true}))
+		return
+	}
+
+	// Both pipes funnel into one writer: a websocket takes one writer at a time.
+	lines := make(chan logLine, 256)
+	read := func(p io.Reader, isErr bool) {
+		sc := bufio.NewScanner(p)
+		sc.Buffer(make([]byte, 0, 64<<10), 4<<20)
+		carry := ""
+		for sc.Scan() {
+			l := splitStamp(sc.Text(), &carry)
+			l.Err = isErr
+			select {
+			case lines <- l:
+			case <-ctx.Done():
+				return
+			}
+		}
+	}
+	done := make(chan struct{}, 2)
+	go func() { read(stdout, false); done <- struct{}{} }()
+	go func() { read(stderr, true); done <- struct{}{} }()
+	go func() { // the command ends when the container does; closing says so, having said why
+		<-done
+		<-done
+		_ = cmd.Wait()
+		close(lines)
+	}()
+
+	go func() { // reader: only to notice the close
+		defer cancel()
+		for {
+			if _, _, err := conn.Read(ctx); err != nil {
+				return
+			}
+		}
+	}()
+
+	ping := time.NewTicker(25 * time.Second)
+	defer ping.Stop()
+	// stdout and stderr are two pipes, and what Docker replays down them arrives in no
+	// particular order. So the opening burst is held for a moment and sorted by the time
+	// Docker stamped each line with; after that the log is live and arrives in order anyway.
+	const burstFor = 300 * time.Millisecond
+	warm := time.NewTimer(burstFor)
+	defer warm.Stop()
+	warmC := warm.C // nil once the burst has been flushed: a nil channel never fires
+	var burst []logLine
+	write := func(l logLine) bool {
+		return conn.Write(ctx, websocket.MessageText, mustJSON(l)) == nil
+	}
+	flush := func() bool {
+		sort.SliceStable(burst, func(i, j int) bool { return burst[i].at < burst[j].at })
+		for _, l := range burst {
+			if !write(l) {
+				return false
+			}
+		}
+		burst = nil
+		return true
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case l, ok := <-lines:
+			if !ok { // the container stopped, or never existed: say the last of it and go
+				flush()
+				return
+			}
+			if warmC != nil {
+				burst = append(burst, l)
+				if len(burst) < 10000 { // a container that never stops talking still gets read
+					continue
+				}
+				if !flush() {
+					return
+				}
+				continue
+			}
+			if !write(l) {
+				return
+			}
+		case <-warmC:
+			warmC = nil
+			if !flush() {
+				return
+			}
+		case <-ping.C:
+			pctx, pc := context.WithTimeout(ctx, 10*time.Second)
+			err := conn.Ping(pctx)
+			pc()
+			if err != nil {
+				return
+			}
+		}
+	}
+}
+
+func mustJSON(v any) []byte { b, _ := json.Marshal(v); return b }
@@ -187,6 +187,8 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 	m.HandleFunc("POST /api/docker/images/prune", s.auth(s.imagePrune))
 	m.HandleFunc("POST /api/docker/volumes/remove", s.auth(s.volumeRemove))
 	m.HandleFunc("POST /api/docker/volumes/prune", s.auth(s.volumePrune))
+	m.HandleFunc("POST /api/docker/networks/remove", s.auth(s.networkRemove))
+	m.HandleFunc("POST /api/docker/networks/prune", s.auth(s.networkPrune))
 	m.HandleFunc("GET /api/docker/stacks/{name}", s.auth(s.stackFile))
 	m.HandleFunc("PUT /api/docker/stacks/{name}", s.auth(s.stackSave))
 	m.HandleFunc("POST /api/docker/stacks/{name}/{action}", s.auth(s.stackAction))
@@ -213,6 +215,7 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 	m.HandleFunc("GET /api/nodes/{node}/tasks/{id}/stream", s.auth(s.taskOnHub(s.streamTask)))
 	m.HandleFunc("POST /api/docker/containers/{id}/{action}", s.auth(s.dockerAction))
 	m.HandleFunc("GET /api/docker/containers/{id}/logs", s.auth(s.dockerLogs))
+	m.HandleFunc("GET /api/docker/containers/{id}/logs/tail", s.auth(s.dockerTail))
 	m.HandleFunc("GET /api/docker/containers/{id}/inspect", s.auth(s.dockerInspect))
 	m.HandleFunc("GET /api/docker/containers/{id}/health", s.auth(s.dockerHealth))
 	m.HandleFunc("GET /api/docker/containers/{id}/events", s.auth(s.dockerEvents))