feat(ql3): distribute copilot console via signed admin image

deploy/console/ql3-cluster-copilot/docker-loopback.sh

@@ -0,0 +1,88 @@
+#!/bin/sh
+
+set -eu
+
+usage() {
+  printf '%s\n' 'Usage: docker-loopback.sh check|serve' >&2
+  exit 64
+}
+
+fail() {
+  printf '%s\n' '{"schemaVersion":1,"component":"qinglong3-cluster-copilot-console-launcher","event":"launch_failed"}' >&2
+  exit 78
+}
+
+[ "$#" -eq 1 ] || usage
+mode=$1
+case "$mode" in
+  check|serve) ;;
+  *) usage ;;
+esac
+
+image=${QL3_COPILOT_CONSOLE_IMAGE-}
+private_root=${QL3_COPILOT_CONSOLE_PRIVATE_ROOT-}
+network=${QL3_COPILOT_CONSOLE_NETWORK-}
+port=${QL3_COPILOT_CONSOLE_PORT-}
+resource_class=${QL3_COPILOT_CONSOLE_RESOURCE_CLASS-compact}
+
+printf '%s' "$image" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._/-]{0,191}@sha256:[0-9a-f]{64}$' || fail
+printf '%s' "$network" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' || fail
+case "$network" in
+  bridge|default|host|none) fail ;;
+esac
+printf '%s' "$port" | grep -Eq '^[1-9][0-9]{3,4}$' || fail
+[ "$port" -ge 1024 ] 2>/dev/null || fail
+[ "$port" -le 65535 ] 2>/dev/null || fail
+case "$private_root" in
+  /*) ;;
+  *) fail ;;
+esac
+case "$private_root" in
+  *','*|*':'*) fail ;;
+esac
+[ -d "$private_root" ] || fail
+canonical_root=$(CDPATH= cd -- "$private_root" 2>/dev/null && pwd -P) || fail
+[ "$canonical_root" = "$private_root" ] || fail
+
+case "$resource_class" in
+  compact)
+    memory=192m
+    cpus=0.25
+    pids=32
+    ;;
+  standard)
+    memory=512m
+    cpus=1
+    pids=64
+    ;;
+  *) fail ;;
+esac
+
+set -- docker run --rm --pull never --init --read-only \
+  --network "$network" \
+  --cap-drop ALL \
+  --security-opt no-new-privileges \
+  --user 10001:10001 \
+  --pids-limit "$pids" \
+  --memory "$memory" \
+  --cpus "$cpus" \
+  --stop-timeout 3 \
+  --tmpfs /tmp:rw,noexec,nosuid,nodev,size=8m,mode=700,uid=10001,gid=10001 \
+  --mount "type=bind,src=$private_root,dst=/var/run/secrets/qinglong3/copilot-console,readonly"
+
+if [ "$mode" = serve ]; then
+  set -- "$@" --publish "127.0.0.1:$port:$port/tcp"
+fi
+
+set -- "$@" "$image" copilot-console \
+  --container-published-loopback \
+  "--port=$port" \
+  --config /var/run/secrets/qinglong3/copilot-console/client.json \
+  --credential /var/run/secrets/qinglong3/copilot-console/credential \
+  --session /var/run/secrets/qinglong3/copilot-console/session
+
+if [ "$mode" = check ]; then
+  set -- "$@" --check
+fi
+
+exec "$@"