fix: isolate Alpine Node runtime and bound URL probes (#3104)

Pin Alpine amd64 to the verified upstream Node runtime without retaining temporary binaries in image layers. Bound fresh-process URL probes and verify serialized amd64/ARMv6 layers in CI. Keep existing Sequelize, SQLite and Debian runtime behavior unchanged.

scripts/verify-image-node-layers.py

@@ -0,0 +1,44 @@
+"""Check serialized Docker layers, including files hidden by later deletions."""
+
+import hashlib
+import json
+import sys
+import tarfile
+
+archive, architecture = sys.argv[1:]
+assert architecture in {"amd64", "arm"}
+nodes = []
+with tarfile.open(archive) as image:
+    manifests = json.load(image.extractfile("manifest.json"))
+    assert len(manifests) == 1, "Expected one platform image"
+    manifest = manifests[0]
+    config = json.load(image.extractfile(manifest["Config"]))
+    assert config["architecture"] == architecture
+    for name in manifest["Layers"]:
+        with tarfile.open(fileobj=image.extractfile(name), mode="r|*") as layer:
+            for member in layer:
+                filename = member.name.removeprefix("./")
+                assert not (
+                    filename == "tmp/node-runtime-amd64" and member.size > 0
+                ), "Temporary amd64 Node remains in an immutable layer"
+                if filename not in {"usr/local/bin/node", "usr/bin/node"}:
+                    continue
+                if not member.isfile():
+                    continue
+                with layer.extractfile(member) as binary:
+                    header = binary.read(20)
+                    assert header[:4] == b"\x7fELF", "Expected a native Node binary"
+                    digest = hashlib.sha256(header)
+                    while chunk := binary.read(1024 * 1024):
+                        digest.update(chunk)
+                endian = "little" if header[5] == 1 else "big"
+                machine = int.from_bytes(header[18:20], endian)
+                assert machine == {"amd64": 62, "arm": 40}[architecture], (
+                    "Wrong Node architecture in an image layer"
+                )
+                nodes.append({"path": filename, "size": member.size, "sha256": digest.hexdigest()})
+assert len(nodes) == 1, "Expected exactly one retained Node binary across all layers"
+assert nodes[0]["path"] == (
+    "usr/local/bin/node" if architecture == "amd64" else "usr/bin/node"
+)
+print(json.dumps({"pass": True, "architecture": architecture, "layers": len(manifest["Layers"]), "nodes": nodes}))

scripts/verify-panel-package.cjs

@@ -23,7 +23,7 @@ const run = (program, args, options = {}) => execute(program, args, {
 const requiredFiles = [
   '.env.example', 'back/protos/api.proto', 'ecosystem.config.js', 'version.yaml',
   'shell/upgrade.cjs', 'shell/install-bundle.cjs', 'shell/install-package.cjs',
-  'shell/upgrade-lock.yaml', 'shell/start.sh', 'shell/start-simplify.sh',
+  'shell/upgrade-lock.yaml', 'shell/node-runtime-probe.cjs', 'shell/start.sh', 'shell/start-simplify.sh',
   'shell/task.sh', 'shell/preload/client.js', 'shell/preload/client.py',
   'shell/preload/sitecustomize.js', 'shell/preload/sitecustomize.py',
   'shell/preload/esm-loader.mjs', 'shell/preload/notificationAudit.js',
@@ -191,6 +191,12 @@ async function verifyPanel(input, output) {
     const globalRoot = (await run('npm', ['root', '--global', '--prefix', prefix], { cwd: temp, env })).stdout.trim();
     root = path.join(globalRoot, '@whyour/qinglong');
     env.QL_DIR = root;
+    const runtimeProbes = [];
+    const checkRuntime = async () => {
+      const result = await run(process.execPath, [path.join(root, 'shell/node-runtime-probe.cjs')], { cwd: temp, env, timeout: 540000 });
+      runtimeProbes.push(JSON.parse(result.stdout.trim()));
+    };
+    await checkRuntime();
     // Use a subprocess: cached candidate modules must not mask missing files
     // after old-package installation and the real npm overwrite below.
     await run(process.execPath, ['-e', `const root=process.argv[1],p=require('node:path');const m=require(root+'/package.json');for(const target of Object.values(m.bin))require('node:fs').accessSync(p.join(root,target));for(const name of ['platformBundle','upgradePrestart','panelUpgrade'])require(root+'/cli/src/internal/maintenance/'+name+'.cjs');require(root+'/shell/upgrade.cjs').verifyUpgrade(root,p.join(root,'static')).catch(e=>{console.error(e);process.exitCode=1});`, root], { env, cwd: temp });
@@ -287,6 +293,7 @@ async function verifyPanel(input, output) {
     const applying = await api('update/system', 'PUT');
     await job(applying.id, 'completed');
     const afterOnline = await healthy();
+    await checkRuntime();
     assert.notEqual(afterOnline.build.instanceId, original.build.instanceId);
     assert.equal(afterOnline.build.sourceCommit, fixture.sourceCommit);
     await fs.access(path.join(root, 'node_modules/.pnpm'));
@@ -302,6 +309,7 @@ async function verifyPanel(input, output) {
     assert.equal((await healthy()).build.instanceId, afterOnline.build.instanceId);
     await run(path.join(prefix, 'bin/ql'), ['reload', 'system'], { cwd: temp, env, timeout: 240000 });
     const afterOffline = await healthy();
+    await checkRuntime();
     assert.notEqual(afterOffline.build.instanceId, afterOnline.build.instanceId);
     assert.equal(afterOffline.build.sourceCommit, fixture.sourceCommit);
     await fs.access(path.join(root, 'node_modules/.pnpm'));
@@ -325,7 +333,7 @@ async function verifyPanel(input, output) {
       customRootEnvironmentPreservedAutomatically: true,
       officialPlatformBundle: { baseImage: fixture.baseImage, sourceCommit: fixture.sourceCommit, sha256: fixture.sha256 },
       migratedFromNpmToOfficialPnpmLayout: true,
-      existingNodePreserved: true,
+      existingNodePreserved: true, nativeUrlRuntimeProbes: runtimeProbes,
       frontendAndBackendStarted: true, checksumFailureKeptOldService: true,
       prestartBeforeReady: true, onlineActualRestart: true,
       offlinePreparationDidNotContactIndex: true, offlineBashActualRestart: true,