39 lines
1.5 KiB
Docker
39 lines
1.5 KiB
Docker
# broker-control — internal control sidecar (spec §29)
|
|
#
|
|
# Runs in the mosquitto container's PID namespace (compose `pid: "service:mosquitto"`)
|
|
# so it can signal the broker process (PID 1) without docker.sock access.
|
|
# The backend calls its HTTP API over the backend-net network.
|
|
#
|
|
# Responsibilities (deliberately minimal, spec §29):
|
|
# - validate staged configuration (mosquitto -c <staged> --test-config)
|
|
# - activate a configuration revision (atomic rename into place)
|
|
# - signal config reload (mosquitto_signal -p 1 config-reload == SIGHUP)
|
|
# - check broker process state
|
|
#
|
|
# Release 1 ships validate/activate/reload/status only; restarts are a
|
|
# Release 2 concern (reload-vs-restart classification, spec §28).
|
|
|
|
FROM eclipse-mosquitto:2.1.2-alpine
|
|
|
|
# Same image as the broker → --test-config validates with the exact
|
|
# broker binary that will load the config.
|
|
|
|
# The base image ships NO Python. control.py is stdlib-only, so the
|
|
# distro package is sufficient (no pip, no venv needed).
|
|
RUN apk add --no-cache python3
|
|
|
|
COPY control.py /app/control.py
|
|
|
|
# The base image has no USER directive, so this sidecar runs as root.
|
|
# Deliberate: it writes /mosquitto/config (owned by uid 1883 in the fresh
|
|
# volume) and signals the broker via the shared PID namespace. The API
|
|
# is token-guarded, internal-network-only, and no docker.sock is mounted
|
|
# (spec §29).
|
|
|
|
# Clear the CMD inherited from the base image — its default CMD
|
|
# (`mosquitto -c ...`) would otherwise be appended to our entrypoint.
|
|
CMD []
|
|
|
|
EXPOSE 8090
|
|
|
|
ENTRYPOINT ["python3", "/app/control.py"] |