refactor(backup)!: run argv lists, never a shell
The backup built command strings and handed them to shell=True, so four interpolated values per dump - user, password, container, database - were each a way out of the command. validate_database covered one of them since the previous commit; now there is nothing to cover: every command is an argv list, and a value can only ever be an argument. execute_to_file absorbs the atomic dump write. The shell redirect into <file>.tmp and the separate mv process become a Python file handle and os.replace, and a failing dump deletes its partial file instead of leaving it. PGPASSWORD moves out of the command string into the child's environment, where a process listing does not show it. docker exec is built in one place, docker_exec_argv; db.py's three hand-built copies and the probe use it. The dead docker_volume_exists goes - never called, and the restore side owns the living twin. The rsync quoting in --link-dest falls away: inside an argv it would have become part of the path. The snapshot module's injected runner changes type with it, which the three e2e drivers implement - the first conversion missed them, btrfs ran with no arguments, and the e2e caught it. Marked breaking for that contract: any external runner injected into volume_snapshot must now accept a list. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kevin Veen-BirkenbachandClaude Opus 5 committed
1 parent
03013b6c76
commit
1d86277a94
13 files changed
+244
-154
No files matched your search
+48
-48
@@ -7,7 +7,10 @@ import re
|
||||
|
||||
import pandas
|
||||
|
||||
from .shell import BackupException, execute_shell_command
|
||||
from baudolo.databases import CLUSTER_ROW, validate_database
|
||||
|
||||
from .docker import docker_exec_argv
|
||||
from .shell import BackupException, execute_to_file
|
||||
|
||||
log = logging.getLogger(__name__)
|
||||
|
||||
@@ -21,47 +24,21 @@ def get_instance(container: str, database_containers: list[str]) -> str:
|
||||
return re.split(r"(_|-)(database|db|postgres)", container)[0]
|
||||
|
||||
|
||||
def _validate_database_value(value: str | None, *, instance: str) -> str:
|
||||
"""
|
||||
Enforce explicit database semantics:
|
||||
|
||||
- "*" => dump ALL databases (cluster dump for Postgres)
|
||||
- "<name>" => dump exactly this database
|
||||
- "" => invalid configuration (would previously result in NaN / nan.backup.sql)
|
||||
"""
|
||||
v = (value or "").strip()
|
||||
if v == "":
|
||||
raise ValueError(
|
||||
f"Invalid databases.csv entry for instance '{instance}': "
|
||||
"column 'database' must be '*' or a concrete database name (not empty)."
|
||||
)
|
||||
return v
|
||||
|
||||
|
||||
def _atomic_write_cmd(cmd: str, out_file: str) -> None:
|
||||
"""
|
||||
Write dump output atomically:
|
||||
- write to <file>.tmp
|
||||
- rename to <file> only on success
|
||||
|
||||
This prevents empty or partial dump files from being treated as valid backups.
|
||||
"""
|
||||
tmp = f"{out_file}.tmp"
|
||||
execute_shell_command(f"{cmd} > {tmp}")
|
||||
execute_shell_command(f"mv {tmp} {out_file}")
|
||||
|
||||
|
||||
def fallback_pg_dumpall(
|
||||
container: str, username: str, password: str, out_file: str
|
||||
) -> None:
|
||||
"""
|
||||
Perform a full Postgres cluster dump using pg_dumpall.
|
||||
"""
|
||||
cmd = (
|
||||
f"PGPASSWORD={password} docker exec -i {container} "
|
||||
f"pg_dumpall -U {username} -h localhost"
|
||||
execute_to_file(
|
||||
docker_exec_argv(
|
||||
container,
|
||||
["pg_dumpall", "-U", username, "-h", "localhost"],
|
||||
interactive=True,
|
||||
),
|
||||
out_file,
|
||||
env={"PGPASSWORD": password},
|
||||
)
|
||||
_atomic_write_cmd(cmd, out_file)
|
||||
|
||||
|
||||
def backup_database(
|
||||
@@ -99,13 +76,13 @@ def backup_database(
|
||||
user = (getattr(row, "username", "") or "").strip()
|
||||
password = (getattr(row, "password", "") or "").strip()
|
||||
|
||||
db_value = _validate_database_value(raw_db, instance=instance_name)
|
||||
db_value = validate_database(raw_db, instance=instance_name)
|
||||
|
||||
if db_value == "*":
|
||||
if db_value == CLUSTER_ROW:
|
||||
if db_type != "postgres":
|
||||
raise ValueError(
|
||||
f"databases.csv entry for instance '{instance_name}': "
|
||||
"'*' is currently only supported for Postgres."
|
||||
f"'{CLUSTER_ROW}' is currently only supported for Postgres."
|
||||
)
|
||||
|
||||
cluster_file = os.path.join(out_dir, f"{instance_name}.cluster.backup.sql")
|
||||
@@ -118,23 +95,46 @@ def backup_database(
|
||||
|
||||
if db_type == "mariadb":
|
||||
# Force TCP so auth matches '<user>'@'%' instead of socket -> 'localhost'.
|
||||
cmd = (
|
||||
f"docker exec {container} {dump_tool} "
|
||||
f"-h 127.0.0.1 --protocol=tcp "
|
||||
f"-u {user} -p{password} {db_name}"
|
||||
execute_to_file(
|
||||
docker_exec_argv(
|
||||
container,
|
||||
[
|
||||
dump_tool,
|
||||
"-h",
|
||||
"127.0.0.1",
|
||||
"--protocol=tcp",
|
||||
"-u",
|
||||
user,
|
||||
f"-p{password}",
|
||||
db_name,
|
||||
],
|
||||
),
|
||||
dump_file,
|
||||
)
|
||||
_atomic_write_cmd(cmd, dump_file)
|
||||
produced = True
|
||||
continue
|
||||
|
||||
if db_type == "postgres":
|
||||
try:
|
||||
cmd = (
|
||||
f"PGPASSWORD={password} docker exec -i {container} "
|
||||
f"pg_dump -U {user} -d {db_name} -h localhost "
|
||||
f"--no-owner --no-privileges"
|
||||
execute_to_file(
|
||||
docker_exec_argv(
|
||||
container,
|
||||
[
|
||||
"pg_dump",
|
||||
"-U",
|
||||
user,
|
||||
"-d",
|
||||
db_name,
|
||||
"-h",
|
||||
"localhost",
|
||||
"--no-owner",
|
||||
"--no-privileges",
|
||||
],
|
||||
interactive=True,
|
||||
),
|
||||
dump_file,
|
||||
env={"PGPASSWORD": password},
|
||||
)
|
||||
_atomic_write_cmd(cmd, dump_file)
|
||||
produced = True
|
||||
except BackupException as e:
|
||||
raise BackupException(
|
||||
|
||||
Reference in new issue
Block a user