mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-07-10 00:14:38 +00:00
Clarify Proxmox LXC Docker install path
This commit is contained in:
rcourtman
parent
fa62d7f986
commit
841100caa7
16 changed files with 133 additions and 23 deletions
|
|
@ -681,7 +681,7 @@ type Config struct {
|
|||
DockerRuntime string // Force Docker / Podman runtime: docker, podman, or auto
|
||||
|
||||
// Security
|
||||
EnableCommands bool // Enable command execution for Patrol remediation (disabled by default)
|
||||
EnableCommands bool // Enable Pulse command execution for Patrol actions and Proxmox LXC Docker inventory (disabled by default)
|
||||
|
||||
// Enrollment
|
||||
Enroll bool // Exchange bootstrap token for runtime token on startup
|
||||
|
|
@ -813,7 +813,7 @@ func loadConfig(args []string, getenv func(string) string) (Config, error) {
|
|||
disableAutoUpdateFlag := fs.Bool("disable-auto-update", utils.ParseBool(envDisableAutoUpdate), "Disable automatic updates")
|
||||
disableDockerUpdateChecksFlag := fs.Bool("disable-docker-update-checks", utils.ParseBool(envDisableDockerUpdateChecks), "Disable Docker image update detection (avoids Docker Hub rate limits)")
|
||||
dockerRuntimeFlag := fs.String("docker-runtime", envDockerRuntime, "Docker / Podman runtime: auto, docker, or podman (default: auto)")
|
||||
enableCommandsFlag := fs.Bool("enable-commands", utils.ParseBool(envEnableCommands), "Enable command execution for Patrol remediation (disabled by default)")
|
||||
enableCommandsFlag := fs.Bool("enable-commands", utils.ParseBool(envEnableCommands), "Enable Pulse command execution for Patrol actions and Proxmox LXC Docker inventory (disabled by default)")
|
||||
disableCommandsFlag := fs.Bool("disable-commands", false, "[DEPRECATED] Commands are now disabled by default; use --enable-commands to enable")
|
||||
enrollFlag := fs.Bool("enroll", false, "Exchange bootstrap token for runtime token (used by deploy wizard)")
|
||||
healthAddrFlag := fs.String("health-addr", defaultHealthAddr, "Health/metrics server address (empty to disable)")
|
||||
|
|
|
|||
|
|
@ -30,8 +30,8 @@ func TestEnableCommandsHelpUsesPatrolRemediationCopy(t *testing.T) {
|
|||
}
|
||||
text := string(source)
|
||||
|
||||
if !strings.Contains(text, "Enable command execution for Patrol remediation (disabled by default)") {
|
||||
t.Fatal("expected enable-commands help to describe Patrol remediation")
|
||||
if !strings.Contains(text, "Enable Pulse command execution for Patrol actions and Proxmox LXC Docker inventory (disabled by default)") {
|
||||
t.Fatal("expected enable-commands help to describe Patrol actions and Proxmox LXC Docker inventory")
|
||||
}
|
||||
if strings.Contains(text, "Enable command execution for AI auto-fix") {
|
||||
t.Fatal("enable-commands help must not revive AI auto-fix wording")
|
||||
|
|
|
|||
|
|
@ -779,7 +779,7 @@ profile and assignment columns, but embedded table framing must route through
|
|||
7. Add or change the unified agent CLI entrypoint, version/help exit semantics, or startup argument/error routing through `cmd/pulse-agent/main.go`.
|
||||
The CLI entrypoint owns propagation of persistence context into runtime-owned helpers. When installer-selected state roots differ from the default, `cmd/pulse-agent/main.go` must pass that exact `StateDir` through both the host-agent runtime and updater startup paths instead of letting one path silently fall back to `/var/lib/pulse-agent`.
|
||||
The same runtime-owned boundary also owns Pulse control-plane URL validation for agent startup, remote config, updater continuity, and command transport. Non-loopback control-plane URLs remain HTTPS/WSS by default, but explicitly insecure agent/dev-runtime flows may use plain HTTP/WS for LAN development control planes; installer-persisted dev URLs must not be accepted by one runtime path and rejected by another.
|
||||
The unified agent CLI copy follows the same Patrol remediation vocabulary as the install surface. `cmd/pulse-agent/main.go` may keep the `--enable-commands` flag name for compatibility, but the help text and inline comments must describe command execution as Patrol remediation rather than reviving AI auto-fix language.
|
||||
The unified agent CLI copy follows the same command-execution vocabulary as the install surface. `cmd/pulse-agent/main.go` may keep the `--enable-commands` flag name for compatibility, but the help text and inline comments must describe command execution as Pulse command execution for Patrol actions and governed Proxmox LXC Docker inventory rather than reviving AI auto-fix language.
|
||||
The unified agent CLI copy also owns operator-facing Docker / Podman runtime
|
||||
labels. `cmd/pulse-agent/main.go` may keep the historical
|
||||
`--enable-docker` and `--docker-runtime` flag names for compatibility, but
|
||||
|
|
@ -3061,6 +3061,12 @@ install copy may recommend installing the agent on every machine that needs
|
|||
temperatures, SMART disk data, services, Docker, or Kubernetes telemetry, but
|
||||
they may not imply that API-backed cluster visibility or best-effort peer
|
||||
augmentation is equivalent to a local agent install on that machine.
|
||||
Docker onboarding copy must also distinguish the standalone Docker / Podman
|
||||
install path from Docker inside Proxmox LXCs: standalone runtimes use the
|
||||
Docker runtime profile on that host, while Proxmox LXC Docker inventory uses a
|
||||
Proxmox VE node agent with command execution plus explicit server-side
|
||||
`PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true`, and the copy may not imply
|
||||
that installing an agent inside every LXC is required.
|
||||
That same connected-systems summary must preserve canonical local operator
|
||||
identity for newly connected infrastructure. When governed resources such as
|
||||
PBS or PMG appear in the setup-completion poll, the surface must show their
|
||||
|
|
|
|||
|
|
@ -378,6 +378,11 @@ payload shape change when the portal presents compact client rows.
|
|||
`frontend-modern/src/utils/sourcePlatforms.ts` rather than page-local
|
||||
wording, because those install choices set API-token and install-command
|
||||
expectations for the operator.
|
||||
That same install-profile model must keep the standalone Docker / Podman
|
||||
runtime profile distinct from Proxmox LXC Docker inventory. The Docker
|
||||
profile may force local runtime monitoring, while Docker inside LXCs must
|
||||
point operators to the Proxmox VE node profile plus command execution and
|
||||
explicit server-side guest Docker inventory opt-in.
|
||||
That same browser/API boundary must not retain customer-side commercial or
|
||||
onboarding telemetry wrappers around infrastructure operations. Pulse
|
||||
Account and the server-owned commercial reporting routes own commercial
|
||||
|
|
@ -1178,6 +1183,11 @@ the canonical monitored-system blocked payload.
|
|||
rewritten into source credential, liveness, or setup failure facts.
|
||||
That same governed infrastructure-operations API boundary also owns discovery polling activation: the shared discovery runtime may only poll `/api/discover` while the settings shell has the `infrastructure-connections` route active, so route-level IA changes cannot silently keep discovery traffic alive on unrelated systems or install screens.
|
||||
That same governed setup/install boundary also owns uninstall convergence: when a script-managed Proxmox node removes its local Pulse credentials, the canonical `/api/auto-unregister` API must remove the matching stored node immediately and emit the same discovery/node-deleted refresh semantics as manual deletion, so the infrastructure sources table does not keep a stale active row until the next failed poll.
|
||||
That same governed install-presentation boundary must preserve the
|
||||
Docker-versus-Proxmox LXC distinction from the shared model: generated
|
||||
install surfaces may not imply that Docker inside Proxmox LXCs requires a
|
||||
guest-local agent when the intended path is a Proxmox node agent with
|
||||
command execution and server-side guest Docker inventory opt-in.
|
||||
That same governed setup/install boundary also owns Proxmox
|
||||
`authorized_keys` symlink preservation in the rendered PVE setup script:
|
||||
temperature-key install and uninstall edits must resolve the real
|
||||
|
|
|
|||
|
|
@ -271,6 +271,12 @@ TLS floor in the dynamic config.
|
|||
settings, insecure flag, and persisted agent id from the local installed
|
||||
agent state, must fail closed when no existing installation or connection
|
||||
state is present, and must refuse to silently become a new install command.
|
||||
The shell installer must disclose `--enable-commands` as Pulse command
|
||||
execution, disabled by default, and must name both Patrol actions and
|
||||
Proxmox LXC Docker inventory as the operator-visible reasons to enable it.
|
||||
When enabled, the terminal summary must also state that Proxmox LXC Docker
|
||||
inventory still requires explicit server-side
|
||||
`PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true`.
|
||||
|
||||
## Extension Points
|
||||
|
||||
|
|
@ -314,6 +320,10 @@ TLS floor in the dynamic config.
|
|||
installer in that slot silently breaks every one of those flows because the
|
||||
agent installer rejects `--version` as an unknown argument; this drift
|
||||
shipped across v6 rc.1 → rc.5 (April 12 → May 11, 2026) before being caught.
|
||||
Installer-facing command-execution copy must remain aligned with the served
|
||||
agent installer: Proxmox LXC Docker inventory may be described only as an
|
||||
opt-in host-side path that requires both agent command execution and server
|
||||
guest-Docker inventory opt-in.
|
||||
`scripts/validate-release.sh` must therefore fail the release if the
|
||||
published `install.sh` does not carry the server-installer banner, does not
|
||||
handle `--version)` in its argument parser, contains the agent installer
|
||||
|
|
|
|||
|
|
@ -269,6 +269,11 @@ bounds, current/desired replicas, and metric source columns.
|
|||
Kubernetes events inventory follows that same primitive boundary while the
|
||||
unified-resource owner supplies Event type, reason, involved-object, count,
|
||||
observed-time, and message columns.
|
||||
Docker empty-state guidance on platform pages follows the same shared platform
|
||||
primitive boundary: it may use the route-specific Docker / Podman vocabulary,
|
||||
but it must distinguish standalone Docker host installation from the Proxmox
|
||||
LXC Docker host-side inventory path without adding page-local installer command
|
||||
assembly or token handling.
|
||||
Docker / Podman inventory follows that same primitive boundary while the
|
||||
unified-resource owner supplies API-object-specific container, image, volume,
|
||||
network, Swarm node, task, secret, and config columns through dedicated native
|
||||
|
|
|
|||
|
|
@ -157,7 +157,7 @@ controls as normal product settings.
|
|||
auth-env reloads, hosted entitlement refresh origins, and
|
||||
pinned-fingerprint TLS clients keep one fail-closed security floor.
|
||||
9. Change operator-facing Resource Privacy/Data Handling posture through `frontend-modern/src/components/Settings/DataHandlingPanel.tsx` and `frontend-modern/src/components/Settings/dataHandlingPanelModel.ts` together so resource classification, handling-boundary, redaction copy, and the route-backed/hidden-sidebar presentation stay governed as a trust surface.
|
||||
10. Change inside-guest runtime collection boundaries through `docs/AGENT_SECURITY.md`, `docs/UNIFIED_AGENT.md`, `cmd/pulse-agent/main.go`, `internal/api/router.go`, and `internal/config/config.go` together. Docker / Podman inventory inside a VM or LXC may come from a guest-local `pulse-agent` module or explicitly reported guest data; LXC Docker inventory may also be collected by a Proxmox host agent only through explicit server opt-in, with optional VMID allowlisting and a minimal summary command set that avoids `docker inspect`, environment, mount, file, command, and process collection. Local Unified Agent Docker / Podman disables must not be reversed by remote profile configuration, and self-test/update preflight that needs the live runtime token must pass it through a short-lived token file rather than argv. The `--enable-docker` help line is part of that operator privacy control, so it must remain "Enable Docker / Podman Agent module" instead of exposing internal collection-module wording.
|
||||
10. Change inside-guest runtime collection boundaries through `docs/AGENT_SECURITY.md`, `docs/UNIFIED_AGENT.md`, `cmd/pulse-agent/main.go`, `internal/api/router.go`, and `internal/config/config.go` together. Docker / Podman inventory inside a VM or LXC may come from a guest-local `pulse-agent` module or explicitly reported guest data; LXC Docker inventory may also be collected by a Proxmox host agent only through explicit server opt-in, with optional VMID allowlisting and a minimal summary command set that avoids `docker inspect`, environment, mount, file, command, and process collection. Local Unified Agent Docker / Podman disables must not be reversed by remote profile configuration, and self-test/update preflight that needs the live runtime token must pass it through a short-lived token file rather than argv. The `--enable-docker` help line is part of that operator privacy control, so it must remain "Enable Docker / Podman Agent module" instead of exposing internal collection-module wording. The `--enable-commands` help line and installer disclosure must identify Pulse command execution as disabled by default and required for Patrol actions or the explicit Proxmox LXC Docker inventory path, not as implicit guest access.
|
||||
Global resource timeline reads through `/api/resources/timeline` are
|
||||
adjacent monitoring-read surfaces, not a privacy bypass. Provider activity
|
||||
filters may expose backend-authored task/event metadata, but the endpoint
|
||||
|
|
|
|||
|
|
@ -170,6 +170,11 @@ evidence, and inactive standalone Swarm metadata must not be interpreted as
|
|||
host-role or service-surface proof. The unified-resource adapter is the backend
|
||||
fail-closed layer for that rule, so persisted or older-agent inactive Swarm
|
||||
payloads cannot reintroduce false Swarm capability surfaces.
|
||||
The empty state for this route must preserve that runtime-lens contract:
|
||||
standalone Docker / Podman hosts use a local runtime agent, while Docker inside
|
||||
Proxmox LXCs is represented as the explicitly opted-in Proxmox host-side guest
|
||||
Docker inventory path rather than a requirement to install an agent in every
|
||||
guest.
|
||||
|
||||
Platform Overview tabs are rollup boundaries, not duplicate inventory dumps.
|
||||
Docker / Podman Overview owns runtime host rows and primary container workload
|
||||
|
|
|
|||
|
|
@ -79,12 +79,12 @@ const INSTALLER_FOCUS_PRESENTATION: Record<
|
|||
platforms: ['linux'],
|
||||
},
|
||||
docker: {
|
||||
title: 'Install on the Docker host',
|
||||
title: 'Install for Docker / Podman',
|
||||
description:
|
||||
'Run the installer on the machine that runs Docker or Podman so Pulse can discover containers from that host.',
|
||||
'Run on the machine that runs Docker or Podman. For Docker inside Proxmox LXCs, use the Proxmox node path below instead of installing inside every guest.',
|
||||
recommendationTitle: 'Docker install path',
|
||||
recommendationDetail:
|
||||
'Install Pulse Agent on the Docker or Podman host. The Docker profile is selected for this flow so copied commands force container monitoring when automatic detection is restricted.',
|
||||
'For a standalone Docker or Podman host, install Pulse Agent on that host. The Docker profile is selected for this flow so copied commands force runtime monitoring when automatic detection is restricted. For Docker inside Proxmox LXCs, install on the Proxmox node, select the Proxmox VE node profile, and enable command execution so the server-opted-in LXC inventory path can run.',
|
||||
preferredProfile: 'docker',
|
||||
platforms: ['linux'],
|
||||
},
|
||||
|
|
@ -106,7 +106,7 @@ const getCommandSectionTitle = (
|
|||
): string => {
|
||||
if (section.platform !== 'linux') return section.title;
|
||||
if (focus === 'unraid') return 'Run on Unraid';
|
||||
if (focus === 'docker') return 'Run on the Docker host';
|
||||
if (focus === 'docker') return 'Run on the Docker host or Proxmox node';
|
||||
if (focus === 'kubernetes') return 'Run on a Kubernetes node';
|
||||
return section.title;
|
||||
};
|
||||
|
|
@ -120,7 +120,7 @@ const getCommandSectionDescription = (
|
|||
return 'Use the Linux installer from Unraid terminal or SSH. The agent stores its local uninstall helper under the Unraid plugin path.';
|
||||
}
|
||||
if (focus === 'docker') {
|
||||
return 'Use the Linux installer on the Docker or Podman host. Commands in this flow include the Docker profile.';
|
||||
return 'Use the Linux installer on a standalone Docker or Podman host. For Docker inside Proxmox LXCs, switch Target profile to Proxmox VE node and enable command execution.';
|
||||
}
|
||||
if (focus === 'kubernetes') {
|
||||
return 'Use the Linux installer on a Kubernetes node. Commands in this flow include the Kubernetes profile.';
|
||||
|
|
@ -254,6 +254,22 @@ export const InfrastructureInstallerSection: Component<InfrastructureInstallerSe
|
|||
</p>
|
||||
</div>
|
||||
|
||||
<Show when={focus() === 'docker'}>
|
||||
<div class="rounded-md border border-blue-200 bg-blue-50 px-4 py-3 text-sm text-blue-950 dark:border-blue-700 dark:bg-blue-900 dark:text-blue-50">
|
||||
<p class="font-semibold">Docker inside Proxmox LXCs</p>
|
||||
<p class="mt-1 text-xs text-blue-800 dark:text-blue-200">
|
||||
Install the agent on the Proxmox node, not inside every LXC. In advanced options,
|
||||
select <span class="font-medium">Proxmox VE node</span> and enable{' '}
|
||||
<span class="font-medium">Pulse command execution</span>. Then start Pulse with{' '}
|
||||
<code>PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true</code>; optionally restrict it
|
||||
with <code>PULSE_PROXMOX_GUEST_DOCKER_INVENTORY_VMIDS=101,102</code>. Pulse uses
|
||||
bounded <code>pct exec</code> inventory for <code>docker ps</code> and{' '}
|
||||
<code>docker stats</code>, skips guests that already have their own agent, and does
|
||||
not collect inspect, environment, mount, command, or process details.
|
||||
</p>
|
||||
</div>
|
||||
</Show>
|
||||
|
||||
<div class="space-y-3">
|
||||
<div class="space-y-1">
|
||||
<p class="text-sm font-semibold text-base-content">
|
||||
|
|
@ -545,7 +561,7 @@ export const InfrastructureInstallerSection: Component<InfrastructureInstallerSe
|
|||
|
||||
<label
|
||||
class="inline-flex cursor-pointer items-center gap-2 text-sm text-base-content"
|
||||
title="Allow Pulse Patrol to execute diagnostic and fix commands on this agent"
|
||||
title="Allow Pulse-scoped command requests on this agent for Patrol actions and opted-in Proxmox LXC Docker inventory"
|
||||
>
|
||||
<input
|
||||
type="checkbox"
|
||||
|
|
@ -553,13 +569,15 @@ export const InfrastructureInstallerSection: Component<InfrastructureInstallerSe
|
|||
onChange={(event) => state.setEnableCommands(event.currentTarget.checked)}
|
||||
class="rounded text-blue-600 focus:ring-blue-500"
|
||||
/>
|
||||
Enable Pulse command execution (for Patrol remediation)
|
||||
Enable Pulse command execution (Patrol actions and Proxmox LXC Docker inventory)
|
||||
</label>
|
||||
|
||||
<Show when={state.enableCommands()}>
|
||||
<div class="rounded-md border border-blue-200 bg-blue-50 px-4 py-2 text-sm text-blue-800 dark:border-blue-700 dark:bg-blue-900 dark:text-blue-200">
|
||||
<span class="font-medium">Pulse commands enabled</span> — The agent will
|
||||
accept diagnostic and fix commands from Pulse Patrol features.
|
||||
<span class="font-medium">Pulse commands enabled</span>: The agent will accept
|
||||
Pulse-scoped command requests. On Proxmox nodes, this is required for opted-in
|
||||
Docker-in-LXC inventory because Pulse runs bounded <code>pct exec</code>{' '}
|
||||
Docker summary checks.
|
||||
</div>
|
||||
</Show>
|
||||
|
||||
|
|
|
|||
|
|
@ -230,7 +230,12 @@ describe('infrastructure operations model', () => {
|
|||
);
|
||||
expect(infrastructureInstallerSectionSource).toContain('Install on Unraid');
|
||||
expect(infrastructureInstallerSectionSource).toContain('Run on Unraid');
|
||||
expect(infrastructureInstallerSectionSource).toContain('Install on the Docker host');
|
||||
expect(infrastructureInstallerSectionSource).toContain('Install for Docker / Podman');
|
||||
expect(infrastructureInstallerSectionSource).toContain('Docker inside Proxmox LXCs');
|
||||
expect(infrastructureInstallerSectionSource).toContain(
|
||||
'PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true',
|
||||
);
|
||||
expect(infrastructureInstallerSectionSource).toContain('bounded <code>pct exec</code>');
|
||||
expect(infrastructureInstallerSectionSource).toContain('Install on a Kubernetes node');
|
||||
expect(infrastructureInstallerSectionSource).toContain(
|
||||
'state.handleInstallProfileChange(presentation().preferredProfile)',
|
||||
|
|
@ -263,10 +268,10 @@ describe('infrastructure operations model', () => {
|
|||
'Generate an install token first. Pulse will then build copy-ready commands',
|
||||
);
|
||||
expect(infrastructureInstallerSectionSource).toContain(
|
||||
'Allow Pulse Patrol to execute diagnostic and fix commands on this agent',
|
||||
'Allow Pulse-scoped command requests on this agent for Patrol actions and opted-in Proxmox LXC Docker inventory',
|
||||
);
|
||||
expect(infrastructureInstallerSectionSource).toContain(
|
||||
'Enable Pulse command execution (for Patrol remediation)',
|
||||
'Enable Pulse command execution (Patrol actions and Proxmox LXC Docker inventory)',
|
||||
);
|
||||
expect(infrastructureInstallerSectionSource).not.toContain('Patrol auto-fix');
|
||||
expect(infrastructureInstallerSectionSource).not.toContain('auto-fix requires Pulse Pro');
|
||||
|
|
|
|||
|
|
@ -317,7 +317,7 @@ export const INSTALL_PROFILE_OPTIONS: InstallProfileOption[] = [
|
|||
value: 'proxmox-pve',
|
||||
label: 'Proxmox VE node',
|
||||
description:
|
||||
'Force Proxmox integration and register as a PVE node. Install on each cluster member when you want full node-local telemetry such as temperatures and SMART data.',
|
||||
'Force Proxmox integration and register as a PVE node. Install on each cluster member for node-local telemetry such as temperatures and SMART data; use this profile plus command execution when Docker inside LXCs should be inventoried from the Proxmox host path.',
|
||||
flags: ['--enable-proxmox', '--proxmox-type pve'],
|
||||
},
|
||||
{
|
||||
|
|
|
|||
|
|
@ -110,7 +110,7 @@ export function DockerPageSurface() {
|
|||
<PlatformTableEmptyState
|
||||
icon={dockerIcon()}
|
||||
title="No Docker or Podman hosts"
|
||||
description="Install the Pulse agent on a Docker or Podman host to populate this runtime lens."
|
||||
description="Install the Pulse agent on a Docker or Podman host. For Docker inside Proxmox LXCs, install the agent on the Proxmox node with command execution enabled, then enable Proxmox guest Docker inventory on the Pulse server."
|
||||
/>
|
||||
}
|
||||
>
|
||||
|
|
|
|||
|
|
@ -227,6 +227,24 @@ afterEach(() => {
|
|||
});
|
||||
|
||||
describe('DockerPageSurface', () => {
|
||||
it('explains the direct host and Proxmox LXC Docker install paths when empty', () => {
|
||||
mocks.useUnifiedResources.mockReturnValue({
|
||||
error: () => null,
|
||||
loading: () => false,
|
||||
refetch: vi.fn(),
|
||||
resources: () => [],
|
||||
});
|
||||
|
||||
render(() => <DockerPageSurface />);
|
||||
|
||||
const emptyState = screen.getByTestId('platform-table-empty-state');
|
||||
expect(emptyState).toHaveAttribute('data-title', 'No Docker or Podman hosts');
|
||||
expect(emptyState).toHaveTextContent('Install the Pulse agent on a Docker or Podman host');
|
||||
expect(emptyState).toHaveTextContent('Docker inside Proxmox LXCs');
|
||||
expect(emptyState).toHaveTextContent('command execution enabled');
|
||||
expect(emptyState).toHaveTextContent('Proxmox guest Docker inventory');
|
||||
});
|
||||
|
||||
it('keeps overview focused on runtime hosts plus primary container workloads', () => {
|
||||
render(() => <DockerPageSurface />);
|
||||
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@
|
|||
# --agent-id <id> Custom agent identifier (default: auto-generated)
|
||||
# --disk-exclude <pattern> Exclude mount points matching pattern (repeatable)
|
||||
# --insecure Skip TLS certificate verification
|
||||
# --enable-commands Enable AI command execution on agent (disabled by default)
|
||||
# --enable-commands Enable Pulse command execution on agent (disabled by default; required for Patrol actions and Proxmox LXC Docker inventory)
|
||||
# --health-addr <addr> Health/metrics listener address (default: 127.0.0.1:9191, use "" to disable)
|
||||
# --update Update an existing agent using saved connection state
|
||||
# --uninstall Remove the agent
|
||||
|
|
@ -299,7 +299,7 @@ Options:
|
|||
--disk-exclude <path> Exclude mount point (repeatable)
|
||||
--insecure Skip TLS verification (auto-enabled for http:// URLs)
|
||||
--cacert <path> Custom CA certificate for TLS (used by curl and agent)
|
||||
--enable-commands Enable AI command execution
|
||||
--enable-commands Enable Pulse command execution (disabled by default; required for Patrol actions and Proxmox LXC Docker inventory)
|
||||
--health-addr <addr> Health/metrics listener address (default: 127.0.0.1:9191; use "" to disable)
|
||||
--enroll Exchange bootstrap token for runtime token (deploy wizard)
|
||||
--update Update an existing agent using saved connection state
|
||||
|
|
@ -1797,6 +1797,7 @@ log_info " Agent metrics: $ENABLE_HOST"
|
|||
log_info " Docker/Podman: $ENABLE_DOCKER"
|
||||
log_info " Kubernetes: $ENABLE_KUBERNETES"
|
||||
log_info " Proxmox: $ENABLE_PROXMOX"
|
||||
log_info " Pulse command execution: $ENABLE_COMMANDS"
|
||||
if [[ "$ENABLE_PROXMOX" == "true" ]]; then
|
||||
if [[ -n "$PROXMOX_TYPE" ]]; then
|
||||
log_info " Proxmox type: $PROXMOX_TYPE"
|
||||
|
|
@ -1804,6 +1805,13 @@ if [[ "$ENABLE_PROXMOX" == "true" ]]; then
|
|||
log_info " Proxmox type: auto-detect all installed services"
|
||||
fi
|
||||
fi
|
||||
if [[ "$ENABLE_COMMANDS" == "true" ]]; then
|
||||
log_info " Accepts Pulse-scoped command requests on this agent."
|
||||
log_info " On Proxmox nodes this is required for opted-in LXC Docker inventory via pct exec."
|
||||
log_info " The Pulse server must also be started with PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true."
|
||||
else
|
||||
log_info " Command execution is off; enable only when Patrol actions or Proxmox LXC Docker inventory are needed."
|
||||
fi
|
||||
|
||||
if [[ "$ENABLE_DOCKER" == "true" ]] && discover_rootless_container_runtime; then
|
||||
if [[ "$ROOTLESS_RUNTIME_KIND" == "docker" ]]; then
|
||||
|
|
|
|||
|
|
@ -71,6 +71,31 @@ func TestInstallSHAutoDetectProxmoxKeepsRuntimeTypeUnpinned(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestInstallSHExplainsCommandExecutionForProxmoxLXCDockerInventory(t *testing.T) {
|
||||
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
|
||||
if err != nil {
|
||||
t.Fatalf("read install.sh: %v", err)
|
||||
}
|
||||
|
||||
script := string(content)
|
||||
required := []string{
|
||||
`--enable-commands Enable Pulse command execution (disabled by default; required for Patrol actions and Proxmox LXC Docker inventory)`,
|
||||
`log_info " Pulse command execution: $ENABLE_COMMANDS"`,
|
||||
`log_info " Accepts Pulse-scoped command requests on this agent."`,
|
||||
`log_info " On Proxmox nodes this is required for opted-in LXC Docker inventory via pct exec."`,
|
||||
`log_info " The Pulse server must also be started with PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true."`,
|
||||
`log_info " Command execution is off; enable only when Patrol actions or Proxmox LXC Docker inventory are needed."`,
|
||||
}
|
||||
for _, needle := range required {
|
||||
if !strings.Contains(script, needle) {
|
||||
t.Fatalf("install.sh missing command-execution disclosure: %s", needle)
|
||||
}
|
||||
}
|
||||
if strings.Contains(script, "Enable AI command execution") {
|
||||
t.Fatal("install.sh must not describe --enable-commands as AI command execution")
|
||||
}
|
||||
}
|
||||
|
||||
func TestInstallSHAcceptsLegacyBooleanFlagValues(t *testing.T) {
|
||||
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
|
||||
if err != nil {
|
||||
|
|
|
|||
|
|
@ -2860,7 +2860,7 @@ class SubsystemLookupTest(unittest.TestCase):
|
|||
{
|
||||
"heading": "## Shared Boundaries",
|
||||
"path": "internal/api/access_control_handlers.go",
|
||||
"line": 452,
|
||||
"line": 457,
|
||||
"heading_line": 119,
|
||||
}
|
||||
],
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue