Merge pull request #431 from docker/runtime

joe0BAB · web-flow · commit e37307b7808e · 2026-01-21T11:52:40.000+01:00
feat: re-architecturing
diff --git a/.github/workflows/runtime.yml b/.github/workflows/runtime.yml
@@ -1,4 +1,4 @@
-name: Engine (cross platform)
+name: Runtime (cross platform)
 on:
   push:
     branches:
@@ -7,33 +7,33 @@ on:
       - 'v*'
   pull_request:
     paths:
-      - 'engine/**'
+      - 'runtime/**'
 jobs:
   tests-windows:
     permissions:
       id-token: write
       contents: read
-    name: WindowsEngineTests
+    name: WindowsRuntimeTests
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/go
         with:
           app_id: ${{ vars.DOCKER_READ_APP_ID }}
           app_private_key: ${{ secrets.DOCKER_READ_APP_PRIVATE_KEY }}
-      - name: Test engine
-        run: make engine-unit-tests
+      - name: Test runtime
+        run: make runtime-unit-tests
   tests-macos:
     permissions:
       id-token: write
       contents: read
-    name: MacOSEngineTests
+    name: MacOSRuntimeTests
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/go
         with:
           app_id: ${{ vars.DOCKER_READ_APP_ID }}
           app_private_key: ${{ secrets.DOCKER_READ_APP_PRIVATE_KEY }}
-      - name: Test engine
-        run: CGO_ENABLED=1 make engine-unit-tests
+      - name: Test runtime
+        run: CGO_ENABLED=1 make runtime-unit-tests
diff --git a/Makefile b/Makefile
@@ -81,8 +81,8 @@ keychain-linux-unit-tests:
 keychain-unit-tests:
 	CGO_ENABLED=1 go test -trimpath -race -v $$(go list ./store/keychain/...)
 
-engine-unit-tests:
-	go test -trimpath -race -v $$(go list ./engine/...)
+runtime-unit-tests:
+	go test -trimpath -race -v $$(go list ./runtime/...)
 
 proto-generate:
 	@docker buildx build $(DOCKER_BUILD_ARGS) -o . --target=proto-generate .
diff --git a/client/.gomodguard.yaml b/client/.gomodguard.yaml
@@ -1,7 +1,7 @@
 ---
 blocked:
   modules:
-    - github.com/docker/secrets-engine/engine:
+    - github.com/docker/secrets-engine/runtime:
         reason: "Forbidden dependency"
     - github.com/docker/secrets-engine/injector:
         reason: "Forbidden dependency"
diff --git a/client/client.go b/client/client.go
@@ -102,7 +102,7 @@ func New(options ...Option) (Client, error) {
 	}
 	c := &http.Client{
 		Transport: &http.Transport{
-			// re-use the same connection to the engine, this speeds up subsequent
+			// re-use the same connection to the runtime, this speeds up subsequent
 			// calls.
 			MaxConnsPerHost:     api.DefaultClientMaxConnsPerHost,
 			MaxIdleConnsPerHost: api.DefaultClientMaxIdleConnsPerHost,
diff --git a/go.work b/go.work
@@ -2,10 +2,10 @@ go 1.25.0
 
 use (
 	./client
-	./engine
 	./plugin
 	./plugins/credentialhelper
 	./plugins/pass
+	./runtime
 	./store
 	./x
 )
diff --git a/go.work.sum b/go.work.sum
@@ -46,6 +46,7 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw=
 github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
+github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
 github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
diff --git a/plugin/.gomodguard.yaml b/plugin/.gomodguard.yaml
@@ -3,7 +3,7 @@ blocked:
   modules:
     - github.com/docker/secrets-engine/client:
         reason: "Forbidden dependency"
-    - github.com/docker/secrets-engine/engine:
+    - github.com/docker/secrets-engine/runtime:
         reason: "Forbidden dependency"
     - github.com/docker/secrets-engine/injector:
         reason: "Forbidden dependency"
diff --git a/plugin/config.go b/plugin/config.go
@@ -16,7 +16,7 @@ import (
 const hijackTimeout = 2 * time.Second
 
 // ManualLaunchOption to apply to a plugin during its creation
-// when it's manually launched (not by the secrets engine).
+// when it's manually launched (not by the secrets runtime).
 type ManualLaunchOption func(c *cfg) error
 
 // WithPluginName sets the name to use in plugin registration.
@@ -38,7 +38,7 @@ func WithRegistrationTimeout(timeout time.Duration) ManualLaunchOption {
 	}
 }
 
-// WithConnection sets an existing secrets engine connection to use.
+// WithConnection sets an existing secrets runtime connection to use.
 func WithConnection(conn net.Conn) ManualLaunchOption {
 	return func(s *cfg) error {
 		if s.conn != nil {
diff --git a/plugin/config_test.go b/plugin/config_test.go
@@ -113,14 +113,14 @@ func Test_restoreConfig(t *testing.T) {
 		test func(t *testing.T)
 	}{
 		{
-			name: "no config from the engine",
+			name: "no config from the runtime",
 			test: func(t *testing.T) {
 				_, err := restoreConfig(&mockPlugin{})
 				assert.ErrorIs(t, err, errPluginNotLaunchedByEngine)
 			},
 		},
 		{
-			name: "invalid config from the engine",
+			name: "invalid config from the runtime",
 			test: func(t *testing.T) {
 				t.Setenv(api.PluginLaunchedByEngineVar, "test-plugin")
 				_, err := restoreConfig(&mockPlugin{})
diff --git a/plugin/setup.go b/plugin/setup.go
@@ -48,7 +48,7 @@ func setup(ctx context.Context, config cfg, onClose func(err error)) (io.Closer,
 		<-closed
 		ipc.Close()
 	}()
-	config.Logger.Printf("Started plugin (engine: %s@%s) %s...", runtimeCfg.Engine, runtimeCfg.Version, config.name)
+	config.Logger.Printf("Started plugin (runtime: %s@%s) %s...", runtimeCfg.Engine, runtimeCfg.Version, config.name)
 	close(setupCompleted)
 	return ipc, nil
 }
diff --git a/plugin/stub.go b/plugin/stub.go
@@ -46,7 +46,7 @@ func (c *Config) Valid() error {
 
 // New creates a stub with the given plugin and options.
 // ManualLaunchOption only apply when the plugin is launched manually.
-// If launched by the secrets engine, they are ignored.
+// If launched by the secrets runtime, they are ignored.
 // If logger is nil, a default logger will be created and used.
 func New(p ExternalPlugin, config Config, opts ...ManualLaunchOption) (Stub, error) {
 	if err := config.Valid(); err != nil {
diff --git a/store/.gomodguard.yaml b/store/.gomodguard.yaml
@@ -3,7 +3,7 @@ blocked:
   modules:
     - github.com/docker/secrets-engine/client:
         reason: "Forbidden dependency"
-    - github.com/docker/secrets-engine/engine:
+    - github.com/docker/secrets-engine/runtime:
         reason: "Forbidden dependency"
     - github.com/docker/secrets-engine/injector:
         reason: "Forbidden dependency"
diff --git a/x/api/resolver/v1/api.pb.go b/x/api/resolver/v1/api.pb.go
diff --git a/x/api/resolver/v1/api.proto b/x/api/resolver/v1/api.proto
@@ -22,7 +22,7 @@ message RegisterPluginRequest {
 }
 
 message RegisterPluginResponse {
-  // Name of the runtime engine is running in.
+  // Name of the secrets engine is running in.
   string engine_name = 1;
   // Version of the runtime engine is running in.
   string engine_version = 2;
diff --git a/x/ipc/env.go b/x/ipc/env.go
@@ -26,7 +26,7 @@ func (c *PluginConfigFromEngine) ToString() (string, error) {
 func NewPluginConfigFromEngineEnv(in string) (*PluginConfigFromEngine, error) {
 	var result PluginConfigFromEngine
 	if err := json.Unmarshal([]byte(in), &result); err != nil {
-		return nil, fmt.Errorf("failed to decode plugin config from engine %q: %w", api.PluginLaunchedByEngineVar, err)
+		return nil, fmt.Errorf("failed to decode plugin config from runtime %q: %w", api.PluginLaunchedByEngineVar, err)
 	}
 	if result.Name == "" {
 		return nil, errors.New("plugin name is required")
diff --git a/x/release/helper/release_test.go b/x/release/helper/release_test.go
@@ -18,14 +18,14 @@ func Test_bumpIterative(t *testing.T) {
 			"x/v1.0.0-do.not.use",
 			"plugin/v0.1.1",
 			"client/v1.0.3",
-			"engine/v0.2.4",
+			"runtime/v0.2.4",
 		})
 		pluginIdx := getIndex(t, "plugin", m.tagsCreated)
 		clientIdx := getIndex(t, "client", m.tagsCreated)
 		assert.ElementsMatch(t, m.bumps, []bump{
-			{"engine/go.mod", "x", "v1.0.0-do.not.use"},
-			{"engine/go.mod", "plugin", "v0.1.1"},
-			{"engine/go.mod", "client", "v1.0.3"},
+			{"runtime/go.mod", "x", "v1.0.0-do.not.use"},
+			{"runtime/go.mod", "plugin", "v0.1.1"},
+			{"runtime/go.mod", "client", "v1.0.3"},
 			{"client/go.mod", "x", "v1.0.0-do.not.use"},
 			{"plugin/go.mod", "x", "v1.0.0-do.not.use"},
 		})
@@ -40,20 +40,20 @@ func Test_bumpIterative(t *testing.T) {
 		assert.NoError(t, BumpIterative("plugin", Patch, repo, m))
 		assert.ElementsMatch(t, m.tagsCreated, []string{
 			"plugin/v0.1.1",
-			"engine/v0.2.4",
+			"runtime/v0.2.4",
 		})
 		assert.ElementsMatch(t, m.bumps, []bump{
-			{"engine/go.mod", "plugin", "v0.1.1"},
+			{"runtime/go.mod", "plugin", "v0.1.1"},
 		})
 		require.Equal(t, 1, len(m.commits))
 		assert.Equal(t, "chore: bump plugin/v0.1.1", m.commits[0])
 	})
 	t.Run("bump module without dependencies", func(t *testing.T) {
 		repo := newMockRepoData()
 		m := &mockFS{}
-		assert.NoError(t, BumpIterative("engine", Patch, repo, m))
+		assert.NoError(t, BumpIterative("runtime", Patch, repo, m))
 		assert.ElementsMatch(t, m.tagsCreated, []string{
-			"engine/v0.2.4",
+			"runtime/v0.2.4",
 		})
 		assert.Empty(t, m.bumps)
 		assert.Empty(t, m.commits)
@@ -78,7 +78,7 @@ func Test_bumpModule(t *testing.T) {
 		assert.NoError(t, BumpModule("x", Patch, repo["x"], m))
 		assert.ElementsMatch(t, m.tagsCreated, []string{"x/v0.0.4-do.not.use"})
 		assert.ElementsMatch(t, m.bumps, []bump{
-			{"engine/go.mod", "x", "v0.0.4-do.not.use"},
+			{"runtime/go.mod", "x", "v0.0.4-do.not.use"},
 			{"client/go.mod", "x", "v0.0.4-do.not.use"},
 			{"plugin/go.mod", "x", "v0.0.4-do.not.use"},
 		})
@@ -89,8 +89,8 @@ func Test_bumpModule(t *testing.T) {
 	t.Run("bump module without version metadata and no dependencies", func(t *testing.T) {
 		repo := newMockRepoData()
 		m := &mockFS{}
-		assert.NoError(t, BumpModule("engine", Patch, repo["engine"], m))
-		assert.ElementsMatch(t, m.tagsCreated, []string{"engine/v0.2.4"})
+		assert.NoError(t, BumpModule("runtime", Patch, repo["runtime"], m))
+		assert.ElementsMatch(t, m.tagsCreated, []string{"runtime/v0.2.4"})
 		assert.ElementsMatch(t, m.bumps, []bump{})
 	})
 }
@@ -100,7 +100,7 @@ func newMockRepoData() RepoData {
 	modules.AddMod("x", Version{Current: "v0.0.3-do.not.use", KeepExtra: true}, []string{})
 	modules.AddMod("plugin", Version{Current: "v0.1.0"}, []string{"x"})
 	modules.AddMod("client", Version{Current: "v1.0.2"}, []string{"x"})
-	modules.AddMod("engine", Version{Current: "v0.2.3"}, []string{"client", "plugin", "x"})
+	modules.AddMod("runtime", Version{Current: "v0.2.3"}, []string{"client", "plugin", "x"})
 	return modules
 }
 

Original file line number	Diff line number	Diff line change
`@@ -102,7 +102,7 @@ func New(options ...Option) (Client, error) {`
`102`	`102`	`}`
`103`	`103`	`c := &http.Client{`
`104`	`104`	`Transport: &http.Transport{`
`105`		`- // re-use the same connection to the engine, this speeds up subsequent`
	`105`	`+ // re-use the same connection to the runtime, this speeds up subsequent`
`106`	`106`	`// calls.`
`107`	`107`	`MaxConnsPerHost: api.DefaultClientMaxConnsPerHost,`
`108`	`108`	`MaxIdleConnsPerHost: api.DefaultClientMaxIdleConnsPerHost,`
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ import (`
`16`	`16`	`const hijackTimeout = 2 * time.Second`
`17`	`17`
`18`	`18`	`// ManualLaunchOption to apply to a plugin during its creation`
`19`		`-// when it's manually launched (not by the secrets engine).`
	`19`	`+// when it's manually launched (not by the secrets runtime).`
`20`	`20`	`type ManualLaunchOption func(c *cfg) error`
`21`	`21`
`22`	`22`	`// WithPluginName sets the name to use in plugin registration.`
`@@ -38,7 +38,7 @@ func WithRegistrationTimeout(timeout time.Duration) ManualLaunchOption {`
`38`	`38`	`}`
`39`	`39`	`}`
`40`	`40`
`41`		`-// WithConnection sets an existing secrets engine connection to use.`
	`41`	`+// WithConnection sets an existing secrets runtime connection to use.`
`42`	`42`	`func WithConnection(conn net.Conn) ManualLaunchOption {`
`43`	`43`	`return func(s *cfg) error {`
`44`	`44`	`if s.conn != nil {`
Original file line number	Diff line number	Diff line change
`@@ -48,7 +48,7 @@ func setup(ctx context.Context, config cfg, onClose func(err error)) (io.Closer,`
`48`	`48`	`<-closed`
`49`	`49`	`ipc.Close()`
`50`	`50`	`}()`
`51`		`- config.Logger.Printf("Started plugin (engine: %s@%s) %s...", runtimeCfg.Engine, runtimeCfg.Version, config.name)`
	`51`	`+ config.Logger.Printf("Started plugin (runtime: %s@%s) %s...", runtimeCfg.Engine, runtimeCfg.Version, config.name)`
`52`	`52`	`close(setupCompleted)`
`53`	`53`	`return ipc, nil`
`54`	`54`	`}`