specHash function

String specHash(
  1. ContainerSpec spec, {
  2. int maxMountBytes = defaultMaxMountBytes,
})

The key rig uses to decide whether a container it already runs can serve this spec.

Mounted paths are folded in by content, not by path. A spec that mounts a certificate must stop matching the running container the moment that certificate is replaced — otherwise the old one keeps serving and the failure has no visible cause.

The canonical lines carry a mount's container path and access mode but not its host path, so nothing here needs to filter them: the two halves of a mount's identity are declared in one place each.

Implementation

String specHash(
  ContainerSpec spec, {
  int maxMountBytes = defaultMaxMountBytes,
}) {
  final lines = [
    ...normalizeSpec(spec).canonicalLines,
    ..._mountContentLines(spec, maxMountBytes),
    ..._fileLines(spec.files),
    ..._buildContextLines(spec.build, maxMountBytes),
  ];
  final digest = sha256.convert(utf8.encode(_unambiguous(lines)));
  return digest.toString().substring(0, 16);
}