refactor: unify backup restic execution via container

Author: zhaojing1987

apphub/src/services/back_manager.py

@@ -1,7 +1,6 @@
 import json
 import os
 import re
-import subprocess
 import time
 import docker
 import requests
@@ -69,7 +68,7 @@ def _container_state(container: Dict[str, Any]) -> str:
 
 
 class BackupManager:
-    """Volume Backup Manager using Restic — hybrid local binary + Docker runner"""
+    """Volume Backup Manager using Restic container runner"""
 
     RESTIC_LOCAL_ARGS = ["--insecure-no-password", "--json"]
 
@@ -81,10 +80,6 @@ def __init__(self):
             self.repository_path = config_manager.get_value("volume_backup", "repopath")
             self.restic_image = config_manager.get_value("volume_backup", "image") or "restic/restic"
 
-            # Verify local restic binary for read-only operations
-            if not os.path.isfile("/usr/local/bin/restic") or not os.access("/usr/local/bin/restic", os.X_OK):
-                raise CustomException(500, "Restic binary not found at /usr/local/bin/restic", "Restic Unavailable")
-
             # Ensure cache dir exists
             os.makedirs(RESTIC_CACHE_PATH, exist_ok=True)
 
@@ -96,27 +91,7 @@ def __init__(self):
             raise CustomException()
 
     # ------------------------------------------------------------------
-    #  Local Restic execution — for list / delete / repo ops (fast, no Docker)
-    # ------------------------------------------------------------------
-    def _run_restic_local(self, command: List[str]) -> str:
-        full_cmd = ["/usr/local/bin/restic", "-r", self.repository_path] + command + self.RESTIC_LOCAL_ARGS
-        try:
-            result = subprocess.run(full_cmd, capture_output=True, text=True, timeout=3600)
-            if result.returncode != 0:
-                err = result.stderr.strip() or f"exit code {result.returncode}"
-                raise CustomException(500, err, "Restic Error")
-            return result.stdout
-        except CustomException:
-            raise
-        except subprocess.TimeoutExpired:
-            raise CustomException(500, "Restic operation timed out after 3600s", "Restic Timeout")
-        except FileNotFoundError:
-            raise CustomException(500, "Restic binary not found", "Restic Unavailable")
-        except Exception as e:
-            raise CustomException(500, f"Restic command failed: {e}", "Restic Error")
-
-    # ------------------------------------------------------------------
-    #  Docker Restic execution — for backup / restore (needs volume mounts)
+    #  Docker Restic execution — all Restic operations use the same runtime
     # ------------------------------------------------------------------
     def _resolve_host_path(self, container_path: str) -> str:
         """Resolve a container-internal path to its host-level equivalent
@@ -245,12 +220,15 @@ def _build_restic_volume_mounts(self, volumes_info: List[Dict[str, Any]]) -> tup
 
         return extra_volumes, container_paths
 
+    def _run_restic_repo_command(self, command: List[str]) -> str:
+        return self._run_restic_container(command, {})
+
     # ------------------------------------------------------------------
-    #  Repository management (local — only touches repo path)
+    #  Repository management
     # ------------------------------------------------------------------
     def _check_repository(self) -> bool:
         try:
-            cfg = json.loads(self._run_restic_local(["cat", "config"]))
+            cfg = json.loads(self._run_restic_repo_command(["cat", "config"]))
             return bool(cfg.get("id") and cfg.get("version"))
         except CustomException:
             return False
@@ -261,7 +239,7 @@ def _init_repository(self):
         if self._check_repository():
             return
         try:
-            output = self._run_restic_local(["init"])
+            output = self._run_restic_repo_command(["init"])
             result = json.loads(output)
             if result.get("message_type") != "initialized":
                 logger.error(f"Unexpected init response: {result}")
@@ -270,7 +248,7 @@ def _init_repository(self):
             raise
 
     # ------------------------------------------------------------------
-    #  Read-only operations — local binary (fast, no Docker)
+    #  Repository operations — container Restic
     # ------------------------------------------------------------------
     def list_snapshots(self, app_id: Optional[str] = None) -> List[Dict[str, Any]]:
         try:
@@ -281,7 +259,7 @@ def list_snapshots(self, app_id: Optional[str] = None) -> List[Dict[str, Any]]:
             if app_id:
                 command.extend(["--tag", app_id])
 
-            output = self._run_restic_local(command)
+            output = self._run_restic_repo_command(command)
             return json.loads(output) if output.strip() else []
         except (json.JSONDecodeError, KeyError):
             raise CustomException(500, "Failed to parse snapshot list", "Parse Error")
@@ -295,7 +273,7 @@ def delete_snapshot(self, snapshot_id: str) -> None:
             if not self._check_repository():
                 raise CustomException(400, "Repository not initialized", "Repository Error")
 
-            output = self._run_restic_local(["forget", snapshot_id])
+            output = self._run_restic_repo_command(["forget", snapshot_id])
             if output.strip():
                 raise CustomException(400, f"Delete failed: {output}", f"Snapshot: {snapshot_id}")
         except CustomException:

apphub/tests/test_backup_restore.py

@@ -165,4 +165,34 @@ def test_build_restic_volume_mounts_resolves_host_mountpoints(monkeypatch):
     assert extra_volumes == {
         '/host-volumes/wordpress_demo/_data': {'bind': '/wordpress_demo', 'mode': 'rw'},
         '/host-volumes/wordpress_demo_db/_data': {'bind': '/wordpress_demo_db', 'mode': 'rw'},
-    }
+    }
+
+
+def test_repo_operations_use_restic_container_runner(monkeypatch):
+    manager = _build_manager()
+    commands = []
+
+    def fake_run_restic_container(command, extra_volumes):
+        commands.append((command, extra_volumes))
+        if command == ['cat', 'config']:
+            return '{"id":"repo-id","version":2}'
+        if command == ['snapshots', '--tag', 'wordpress_demo']:
+            return '[{"id":"snap-1","short_id":"snap-1"}]'
+        if command == ['forget', 'snap-1']:
+            return ''
+        raise AssertionError(f'unexpected command: {command}')
+
+    monkeypatch.setattr(manager, '_run_restic_container', fake_run_restic_container)
+
+    assert manager._check_repository() is True
+    snapshots = manager.list_snapshots('wordpress_demo')
+    manager.delete_snapshot('snap-1')
+
+    assert snapshots == [{"id": "snap-1", "short_id": "snap-1"}]
+    assert commands == [
+        (['cat', 'config'], {}),
+        (['cat', 'config'], {}),
+        (['snapshots', '--tag', 'wordpress_demo'], {}),
+        (['cat', 'config'], {}),
+        (['forget', 'snap-1'], {}),
+    ]

docker/Dockerfile

@@ -89,17 +89,6 @@ RUN sed -i 's|http://deb.debian.org/debian|http://mirrors.aliyun.com/debian|g; s
 ARG WEBSOFT9_PRODUCT_VERSION=
 ARG WEBSOFT9_APPSTORE_CHANNEL=release
 
-# Restic backup binary — single static build, no runtime deps
-RUN RESTIC_URL="https://github.com/restic/restic/releases/download/v0.17.3/restic_0.17.3_linux_amd64.bz2" \
-    && echo "Downloading restic from: $RESTIC_URL" \
-    && curl -fsSL --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -o /tmp/restic.bz2 "$RESTIC_URL" \
-    && bzip2 -t /tmp/restic.bz2 \
-    && bzip2 -d -c /tmp/restic.bz2 > /usr/local/bin/restic \
-    && chmod +x /usr/local/bin/restic \
-    && restic version \
-    && rm -f /tmp/restic.bz2 \
-    && echo "Restic installed successfully"
-
 COPY --from=npm-runtime /app /app
 COPY --from=npm-runtime /etc/letsencrypt.ini /etc/letsencrypt.ini
 COPY --from=npm-runtime /etc/nginx /etc/nginx