Method ensure_proxy_container

src/docker/proxy_manager.rs:557–647

Ensures the proxy container for the given config is running. Uses the fingerprinted container and network names from the proxy config. When `proxy_config.squid_conf` is set, writes the content to a host file and bind-mounts it into the container.

(&self, proxy_config: &ResolvedProxyConfig)

    /// When `proxy_config.squid_conf` is set, writes the content to a host file
    /// and bind-mounts it into the container.
    async fn ensure_proxy_container(&self, proxy_config: &ResolvedProxyConfig) -> Result<()> {
        let container_name = proxy_config.proxy_container_name();
        let network_name = proxy_config.external_network_name();
        let host_ports_env = format!("TSK_HOST_PORTS={}", proxy_config.host_ports_env());

        // Prepare optional squid.conf bind mount
        let binds = if let Some(ref squid_conf_content) = proxy_config.squid_conf {
            let fingerprint = proxy_config.fingerprint();
            let proxy_conf_dir = self.tsk_env.proxy_config_dir(&fingerprint);
            std::fs::create_dir_all(&proxy_conf_dir)
                .context("Failed to create proxy config directory")?;

            let squid_conf_path = proxy_conf_dir.join("squid.conf");
            std::fs::write(&squid_conf_path, squid_conf_content)
                .context("Failed to write squid.conf")?;

            Some(vec![format!(
                "{}:/etc/squid/squid.conf:ro",
                squid_conf_path.display()
            )])
        } else {
            None
        };

        let container_config = ContainerCreateBody {
            image: Some(PROXY_IMAGE.to_string()),
            exposed_ports: Some(vec![PROXY_PORT.to_string()]),
            env: Some(vec![host_ports_env]),
            host_config: Some(HostConfig {
                network_mode: Some(network_name),
                extra_hosts: Some(vec!["host.docker.internal:host-gateway".to_string()]),
                restart_policy: Some(bollard::models::RestartPolicy {
                    name: Some(bollard::models::RestartPolicyNameEnum::UNLESS_STOPPED),
                    maximum_retry_count: None,
                }),
                binds,
                // Security hardening options
                readonly_rootfs: Some(true),
                cap_drop: Some(vec!["ALL".to_string()]),
                cap_add: Some(vec![
                    "NET_ADMIN".to_string(), // For iptables firewall rules
                    "SETUID".to_string(),    // For su-exec to drop privileges
                    "SETGID".to_string(),    // For su-exec to drop privileges
                    "CHOWN".to_string(),     // For fixing tmpfs ownership at startup
                ]),
                security_opt: Some(vec!["no-new-privileges:true".to_string()]),
                tmpfs: Some(HashMap::from([
                    ("/var/cache/squid".to_string(), "size=10m".to_string()),
                    ("/var/log/squid".to_string(), "size=50m".to_string()),
                    ("/var/run/squid".to_string(), "size=1m".to_string()),
                ])),
                ..Default::default()
            }),
            ..Default::default()
        };

        let create_options = bollard::query_parameters::CreateContainerOptionsBuilder::default()
            .name(&container_name)