stack/dev/scripts/test_network_isolation.sh

#!/usr/bin/env bash
# test_network_isolation.sh — Verify Docker builds succeed without internet.
#
# Builds each Dockerfile with --network=none to prove all packages
# come from local mirrors. Requires mirrors to be running first.
#
# Usage:
#   bash dev/scripts/test_network_isolation.sh           # test all
#   bash dev/scripts/test_network_isolation.sh api docs  # test specific images

set -euo pipefail

ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
MANIFEST="${ROOT}/data/pkg-manifest.json"

if [ ! -f "$MANIFEST" ]; then
    echo "ERROR: ${MANIFEST} not found. Run: uv run python dev/scripts/pkg_inventory.py"
    exit 2
fi

# Image definitions — matches stack.toml [images]
declare -A DOCKERFILES=(
    [api]="infra/images/api.Dockerfile"
    [notebooks]="infra/images/notebooks.Dockerfile"
    [docs]="infra/images/docs.Dockerfile"
    [zotero]="infra/images/zotero.Dockerfile"
    [mc]="infra/images/mc.Dockerfile"
)

declare -A CONTEXTS=(
    [api]="."
    [notebooks]="notebooks/"
    [docs]="."
    [zotero]="zotero/"
    [mc]="infra/rustfs/"
)

# Select images to test
if [ $# -gt 0 ]; then
    IMAGES=("$@")
else
    IMAGES=("${!DOCKERFILES[@]}")
fi

PASS=0
FAIL=0
SKIP=0

echo "=== Network Isolation Test ==="
echo "Testing ${#IMAGES[@]} image(s) with --network=none"
echo ""

for img in "${IMAGES[@]}"; do
    dockerfile="${DOCKERFILES[$img]:-}"
    context="${CONTEXTS[$img]:-}"

    if [ -z "$dockerfile" ]; then
        echo "SKIP  $img (unknown image)"
        ((SKIP++))
        continue
    fi

    echo -n "TEST  $img ... "

    # Build with no network — will fail if any RUN step needs internet
    if docker build \
        --network=none \
        -f "${ROOT}/${dockerfile}" \
        -t "isolation-test/${img}:test" \
        "${ROOT}/${context}" \
        > "/tmp/isolation-${img}.log" 2>&1; then
        echo "PASS"
        ((PASS++))
        # Clean up test image
        docker rmi "isolation-test/${img}:test" > /dev/null 2>&1 || true
    else
        echo "FAIL"
        echo "  Build log: /tmp/isolation-${img}.log"
        echo "  Last 5 lines:"
        tail -5 "/tmp/isolation-${img}.log" | sed 's/^/    /'
        ((FAIL++))
    fi
done

echo ""
echo "=== Results ==="
echo "  Pass: ${PASS}  Fail: ${FAIL}  Skip: ${SKIP}"

if [ "$FAIL" -gt 0 ]; then
    echo ""
    echo "FAILED — ${FAIL} image(s) require external network access."
    echo "Ensure mirrors are running: docker compose up -d apt-cache devpi"
    exit 1
fi

echo "All images build without external network access."
exit 0