feat: podman-compose stack units and root/user execution scopes

- syncup: podman first, docker only as fallback (podman wins on name clash; existing docker units found in podman switch to podman) - syncup: group podman-compose containers into one `kind: stack` unit per project (project, working_dir, compose_files, compose_bin from labels); disable existing member units ("part of stack <project>") - generator: compose mode (podman-compose up/stop, WorkingDirectory) with pod start/stop fallback when compose binary/dir/files are missing - reconcile: stacks disabled with "stack not found" when neither compose files nor pod exist - root: scan root + rootless users listed in `users:` (podman only) - non-root: config ~/.config/unitdore/units.yaml, own user units only - sysuser package: runuser with XDG_RUNTIME_DIR/DBUS env, home/linger lookup - install: warn when linger is not enabled for user units - testdata/stack: podman-compose test stack and captured podman ps fixture - docs: README, generated-units, man page, AGENTS, PLAN
2026-10-12 19:05:51 +02:00
parent cc4829046d
commit f0827fcdd7
26 changed files with 1397 additions and 122 deletions
@@ -2,11 +2,15 @@ package cmd

 import (
 	"fmt"
+	"io"
 	"os"
+	"strings"

 	"github.com/spf13/cobra"
 	"github.com/warkanum/unitdore/config"
 	"github.com/warkanum/unitdore/runtime"
+	"github.com/warkanum/unitdore/systemd"
+	"github.com/warkanum/unitdore/sysuser"
 )

 var syncupCmd = &cobra.Command{
@@ -15,8 +19,17 @@ var syncupCmd = &cobra.Command{
 	Long: `Syncup queries all available runtimes for running containers and adds
 any new ones to the config file. Existing entries are never removed.

-It also reconciles: if a configured unit's container no longer exists,
-it is marked disabled with a reason.`,
+Podman is queried first. Docker is only a fallback: a container name found
+in podman is never registered as docker.
+
+Containers created by podman-compose are grouped into one stack unit per
+project. Existing per-container units of stack members are disabled.
+
+Scopes: as root, root's containers plus rootless containers of each user in
+'users:' (podman only). As a normal user, the user's own podman containers.
+
+It also reconciles: if a configured unit's container or stack no longer
+exists, it is marked disabled with a reason.`,
 	RunE: runSyncup,
 }

@@ -24,71 +37,235 @@ func init() {
 	rootCmd.AddCommand(syncupCmd)
 }

+const (
+	reasonNotFound      = "container not found"
+	reasonStackNotFound = "stack not found"
+	reasonMemberPrefix  = "part of stack "
+)
+
+type syncStats struct {
+	added, unchanged, disabled, reenabled int
+}
+
 func runSyncup(cmd *cobra.Command, args []string) error {
 	cfg, err := config.LoadOrEmpty(configPath)
 	if err != nil {
 		return err
 	}

-	added := 0
-	unchanged := 0
-	discovered := map[string]bool{}
+	containers := discover(syncScopes(cfg))

-	// Discover running containers across all runtimes
-	for _, rt := range runtime.Available() {
-		containers, err := rt.ListRunning()
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "warning: %s discovery failed: %v\n", rt.Name(), err)
-			continue
-		}
-		for _, c := range containers {
-			discovered[c.Name] = true
-			unit := config.Unit{
-				Name:    c.Name,
-				Runtime: c.Runtime,
-				Order:   len(cfg.Units) + 1,
-				Enabled: true,
-			}
-			if cfg.AddUnit(unit) {
-				fmt.Printf("  + added: %s (%s)\n", c.Name, c.Runtime)
-				added++
-			} else {
-				unchanged++
-			}
-		}
-	}
-
-	// Reconcile: check if existing units' containers still exist
-	disabled := 0
-	reenabled := 0
-	for i := range cfg.Units {
-		u := &cfg.Units[i]
-		rt := runtime.Get(u.Runtime)
-		if rt == nil {
-			continue
-		}
-		exists, err := rt.Exists(u.Name)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "warning: checking %s: %v\n", u.Name, err)
-			continue
-		}
-		if !exists && u.Enabled {
-			u.Enabled = false
-			u.DisabledReason = "container not found"
-			fmt.Printf("  ! disabled: %s (container not found)\n", u.Name)
-			disabled++
-		} else if exists && !u.Enabled && u.DisabledReason == "container not found" {
-			u.Enabled = true
-			u.DisabledReason = ""
-			fmt.Printf("  ✓ re-enabled: %s (container found)\n", u.Name)
-			reenabled++
-		}
-	}
+	var st syncStats
+	running := mergeDiscovered(cfg, containers, composeBinFor, os.Stdout, &st)
+	reconcile(cfg, running, unitExists, os.Stdout, &st)

 	if err := cfg.Save(configPath); err != nil {
 		return err
 	}

-	fmt.Printf("\nDone. Added: %d  Unchanged: %d  Disabled: %d  Re-enabled: %d\n", added, unchanged, disabled, reenabled)
+	fmt.Printf("\nDone. Added: %d  Unchanged: %d  Disabled: %d  Re-enabled: %d\n", st.added, st.unchanged, st.disabled, st.reenabled)
 	return nil
 }
+
+// syncScopes returns the user scopes to scan ("" = root/system).
+func syncScopes(cfg *config.Config) []string {
+	if sysuser.IsRoot() {
+		return append([]string{""}, cfg.Users...)
+	}
+	return []string{sysuser.Current()}
+}
+
+// discover lists running containers in every scope, podman first.
+func discover(scopes []string) []runtime.Container {
+	var all []runtime.Container
+	for _, user := range scopes {
+		for _, rt := range runtime.Available() {
+			// Docker is a system daemon; user scopes only see rootless podman
+			if user != "" && rt.Name() == "docker" {
+				continue
+			}
+			containers, err := rt.ListRunning(user)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "warning: %s discovery failed (%s): %v\n", rt.Name(), scopeName(user), err)
+				continue
+			}
+			all = append(all, containers...)
+		}
+	}
+	return all
+}
+
+func composeBinFor(user string) string {
+	return sysuser.LookPath(user, "podman-compose")
+}
+
+func scopeName(user string) string {
+	if user == "" {
+		return "root"
+	}
+	return user
+}
+
+func scopeKey(user, name string) string { return user + "/" + name }
+
+// mergeDiscovered adds discovered containers and stacks to cfg. Returns the
+// set of running scopeKey(user, name) for containers and stack projects.
+func mergeDiscovered(cfg *config.Config, containers []runtime.Container, composeBin func(user string) string, w io.Writer, st *syncStats) map[string]bool {
+	running := map[string]bool{}
+	podmanNames := map[string]bool{}
+	members := map[string]string{} // scopeKey(user, container) -> project
+
+	for _, c := range containers {
+		if c.Runtime == "podman" {
+			podmanNames[scopeKey(c.User, c.Name)] = true
+		}
+	}
+
+	// Group podman-compose containers into one stack unit per (user, project)
+	for _, c := range containers {
+		project := c.Project()
+		if c.Runtime != "podman" || project == "" {
+			continue
+		}
+		members[scopeKey(c.User, c.Name)] = project
+		key := scopeKey(c.User, project)
+		if running[key] {
+			continue
+		}
+		running[key] = true
+
+		stack := config.Unit{
+			Name:         project,
+			Runtime:      "podman",
+			User:         c.User,
+			Kind:         config.KindStack,
+			Project:      project,
+			WorkingDir:   c.WorkingDir(),
+			ComposeFiles: c.ComposeFiles(),
+			ComposeBin:   composeBin(c.User),
+			Order:        len(cfg.Units) + 1,
+			Enabled:      true,
+		}
+		existing := cfg.FindUnit(project)
+		switch {
+		case existing == nil:
+			cfg.AddUnit(stack)
+			fmt.Fprintf(w, "  + added stack: %s (%s, %s)\n", project, scopeName(c.User), strings.Join(stack.ComposeFiles, ","))
+			st.added++
+		case existing.IsStack() && existing.Project == project && existing.User == c.User:
+			// Labels are the source of truth for where the stack lives
+			existing.WorkingDir = stack.WorkingDir
+			existing.ComposeFiles = stack.ComposeFiles
+			if stack.ComposeBin != "" {
+				existing.ComposeBin = stack.ComposeBin
+			}
+			st.unchanged++
+		default:
+			fmt.Fprintf(os.Stderr, "warning: stack %s (%s) skipped: unit name already used\n", project, scopeName(c.User))
+		}
+	}
+
+	for _, c := range containers {
+		key := scopeKey(c.User, c.Name)
+		// Podman is queried first and wins on name clash (e.g. podman-docker shim)
+		if c.Runtime != "podman" && podmanNames[key] {
+			continue
+		}
+		running[key] = true
+		if _, ok := members[key]; ok {
+			continue
+		}
+		unit := config.Unit{
+			Name:    c.Name,
+			Runtime: c.Runtime,
+			User:    c.User,
+			Order:   len(cfg.Units) + 1,
+			Enabled: true,
+		}
+		if cfg.AddUnit(unit) {
+			fmt.Fprintf(w, "  + added: %s (%s, %s)\n", c.Name, c.Runtime, scopeName(c.User))
+			st.added++
+			continue
+		}
+		if existing := cfg.FindUnit(c.Name); existing.User != c.User {
+			fmt.Fprintf(os.Stderr, "warning: %s (%s) skipped: unit name already used by %s\n", c.Name, scopeName(c.User), scopeName(existing.User))
+			continue
+		}
+		st.unchanged++
+	}
+
+	for i := range cfg.Units {
+		u := &cfg.Units[i]
+		if u.IsStack() {
+			continue
+		}
+		key := scopeKey(u.User, u.Name)
+		if u.Runtime == "docker" && podmanNames[key] {
+			u.Runtime = "podman"
+			fmt.Fprintf(w, "  ~ runtime: %s docker -> podman\n", u.Name)
+		}
+		if project, ok := members[key]; ok && u.DisabledReason != reasonMemberPrefix+project {
+			wasEnabled := u.Enabled
+			u.Enabled = false
+			u.DisabledReason = reasonMemberPrefix + project
+			if wasEnabled {
+				fmt.Fprintf(w, "  ! disabled: %s (%s)\n", u.Name, u.DisabledReason)
+				st.disabled++
+			}
+		}
+	}
+
+	return running
+}
+
+// unitExists checks whether a unit's container or stack still exists.
+func unitExists(u config.Unit) (bool, error) {
+	if u.IsStack() {
+		if systemd.ComposeAvailable(u) {
+			return true, nil
+		}
+		return (&runtime.Podman{}).PodExists(u.User, runtime.PodName(u.Project))
+	}
+	rt := runtime.Get(u.Runtime)
+	if rt == nil {
+		return true, nil // unknown runtime — leave alone
+	}
+	return rt.Exists(u.User, u.Name)
+}
+
+// reconcile disables units whose container/stack is gone and re-enables
+// units that were auto-disabled once it is back.
+func reconcile(cfg *config.Config, running map[string]bool, exists func(config.Unit) (bool, error), w io.Writer, st *syncStats) {
+	for i := range cfg.Units {
+		u := &cfg.Units[i]
+		if strings.HasPrefix(u.DisabledReason, reasonMemberPrefix) {
+			continue
+		}
+		reason := reasonNotFound
+		if u.IsStack() {
+			reason = reasonStackNotFound
+		}
+
+		found := running[scopeKey(u.User, u.Name)]
+		if !found {
+			var err error
+			found, err = exists(*u)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "warning: checking %s: %v\n", u.Name, err)
+				continue
+			}
+		}
+
+		if !found && u.Enabled {
+			u.Enabled = false
+			u.DisabledReason = reason
+			fmt.Fprintf(w, "  ! disabled: %s (%s)\n", u.Name, reason)
+			st.disabled++
+		} else if found && !u.Enabled && u.DisabledReason == reason {
+			u.Enabled = true
+			u.DisabledReason = ""
+			fmt.Fprintf(w, "  ✓ re-enabled: %s (found)\n", u.Name)
+			st.reenabled++
+		}
+	}
+}