feat(containers): add support docker attach (#2842)

* #592 feat(container-details): split websocket backend code into more files and add attach handler * #592 feat(container-details): rename console to exec and add attach console * Revert "#592 feat(container-details): rename console to exec and add attach console" This reverts commit f2deaee1 * #592 feat(container-details): add attach to containerconsole * #592 feat(container-details): catch more errors * #592 feat(container-details): use less vars * #592 feat(container-details): error message is more verbose * #592 feat(container-details): go fmt * #592 feat(container-details): unpack netdial * #592 feat(container-details): reformat service * #592 feat(container-details): fix go compiler bugs * #592 feat(container-details): refactor services * #592 feat(container-details): fix windows dial * #592 feat(container-details): gofmt dial_windows.go * #592 feat(container-details): split console into two views and fix breadcrumbs * #592 feat(container-details): swap exec and attach action * #592 feat(container-details): add some warnings * #592 feat(container-details): refresh view more * #592 feat(container-details): use less functions for connecting/disconnecting * #592 feat(container-details): move link replacements into initTerm * #592 feat(container-details): disable attach/exec button if container is not running * #592 feat(container-details): fix typo * #592 feat(container-details): autoconnect attach view * #592 feat(container-details): fix first draw after attach + reformat code * #592 feat(container-details): remove init-helper-div * #592 feat(container-details): console resize code and remove padding * #592 feat(container-details): swap height and width arguments in container tty resize restcall * #592 feat(container-details): swap height and width arguments in exec tty resize restcall * #592 feat(container-details): remove css unit * #592 feat(container-details): remove loaded state from states object * #592 feat(container-details): reword Disattach to Detach * #592 feat(container-details): remove unloaded state from states object * #592 feat(container-details): remove useless code * #592 feat(container-details): clearer state-check * #592 feat(container-details): fixed resize bugs by using xterms col attribute
2025-07-19 13:29:41 +02:00 · 2019-05-09 04:04:40 +02:00 · 2019-05-09 04:04:40 +02:00 · 1af9fb4490
commit 1af9fb4490
parent dc9a3de88f
20 changed files with 647 additions and 305 deletions
--- a/api/http/handler/websocket/exec.go
+++ b/api/http/handler/websocket/exec.go
@ -0,0 +1,138 @@
+package websocket
+
+import (
+	"bytes"
+	"encoding/json"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"time"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/websocket"
+	httperror "github.com/portainer/libhttp/error"
+	"github.com/portainer/libhttp/request"
+	"github.com/portainer/portainer/api"
+)
+
+type execStartOperationPayload struct {
+	Tty    bool
+	Detach bool
+}
+
+// websocketExec handles GET requests on /websocket/exec?id=<execID>&endpointId=<endpointID>&nodeName=<nodeName>&token=<token>
+// If the nodeName query parameter is present, the request will be proxied to the underlying agent endpoint.
+// If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+// an ExecStart operation HTTP request will be created and hijacked.
+// Authentication and access is controled via the mandatory token query parameter.
+func (handler *Handler) websocketExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	execID, err := request.RetrieveQueryParameter(r, "id", false)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id", err}
+	}
+	if !govalidator.IsHexadecimal(execID) {
+		return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id (must be hexadecimal identifier)", err}
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: endpointId", err}
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrObjectNotFound {
+		return &httperror.HandlerError{http.StatusNotFound, "Unable to find the endpoint associated to the stack inside the database", err}
+	} else if err != nil {
+		return &httperror.HandlerError{http.StatusInternalServerError, "Unable to find the endpoint associated to the stack inside the database", err}
+	}
+
+	err = handler.requestBouncer.EndpointAccess(r, endpoint)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusForbidden, "Permission denied to access endpoint", portainer.ErrEndpointAccessDenied}
+	}
+
+	params := &webSocketRequestParams{
+		endpoint: endpoint,
+		ID:       execID,
+		nodeName: r.FormValue("nodeName"),
+	}
+
+	err = handler.handleExecRequest(w, r, params)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusInternalServerError, "An error occured during websocket exec operation", err}
+	}
+
+	return nil
+}
+
+func (handler *Handler) handleExecRequest(w http.ResponseWriter, r *http.Request, params *webSocketRequestParams) error {
+	r.Header.Del("Origin")
+
+	if params.nodeName != "" || params.endpoint.Type == portainer.AgentOnDockerEnvironment {
+		return handler.proxyWebsocketRequest(w, r, params)
+	}
+
+	websocketConn, err := handler.connectionUpgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return err
+	}
+	defer websocketConn.Close()
+
+	return hijackExecStartOperation(websocketConn, params.endpoint, params.ID)
+}
+
+func hijackExecStartOperation(websocketConn *websocket.Conn, endpoint *portainer.Endpoint, execID string) error {
+	dial, err := initDial(endpoint)
+	if err != nil {
+		return err
+	}
+
+	// When we set up a TCP connection for hijack, there could be long periods
+	// of inactivity (a long running command with no output) that in certain
+	// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
+	// state. Setting TCP KeepAlive on the socket connection will prohibit
+	// ECONNTIMEOUT unless the socket connection truly is broken
+	if tcpConn, ok := dial.(*net.TCPConn); ok {
+		tcpConn.SetKeepAlive(true)
+		tcpConn.SetKeepAlivePeriod(30 * time.Second)
+	}
+
+	httpConn := httputil.NewClientConn(dial, nil)
+	defer httpConn.Close()
+
+	execStartRequest, err := createExecStartRequest(execID)
+	if err != nil {
+		return err
+	}
+
+	err = hijackRequest(websocketConn, httpConn, execStartRequest)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func createExecStartRequest(execID string) (*http.Request, error) {
+	execStartOperationPayload := &execStartOperationPayload{
+		Tty:    true,
+		Detach: false,
+	}
+
+	encodedBody := bytes.NewBuffer(nil)
+	err := json.NewEncoder(encodedBody).Encode(execStartOperationPayload)
+	if err != nil {
+		return nil, err
+	}
+
+	request, err := http.NewRequest("POST", "/exec/"+execID+"/start", encodedBody)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Connection", "Upgrade")
+	request.Header.Set("Upgrade", "tcp")
+
+	return request, nil
+}