feat: sanitize docker inspect output with ps:inspect

Often-times, we will want to have the container inspect output for debugging purposes, but this process is:

- error prone, as the user needs to know what their containers are
- potentially insecure, as the output must be sanitized of sensitive data

Instead of making users wade through this process, we provide a helper `ps:inspect` command, that can be used to diagnose problems associated with containers that may or may not exist for an application.

plugins/ps/commands

@@ -8,6 +8,7 @@ case "$1" in
       declare desc="return ps plugin help content"
       cat<<help_content
     ps <app>, List processes running in app container(s)
+    ps:inspect <app>, Displays a sanitized version of docker inspect for an app
     ps:scale <app> <proc>=<count> [<proc>=<count>...], Get/Set how many instances of a given process to run
     ps:start <app>, Start app container(s)
     ps:startall, Starts all apps via command line

plugins/ps/internal-functions

@@ -4,6 +4,16 @@ source "$PLUGIN_AVAILABLE_PATH/docker-options/functions"
 source "$PLUGIN_AVAILABLE_PATH/ps/functions"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 
+cmd-ps-inspect() {
+  declare desc="displays a sanitized version of docker inspect for an app"
+  local cmd="ps:inspect"
+  local APP="$2"
+
+  verify_app_name "$APP"
+  local DOKKU_SCHEDULER=$(get_app_scheduler "$APP")
+  plugn trigger scheduler-inspect "$DOKKU_SCHEDULER" "$APP"
+}
+
 cmd-ps-report() {
   declare desc="displays a ps report for one or more apps"
   local cmd="ps:report"

plugins/ps/subcommands/inspect

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+source "$PLUGIN_AVAILABLE_PATH/ps/internal-functions"
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+
+cmd-ps-inspect "$@"

plugins/scheduler-docker-local/scheduler-inspect

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/config/functions"
+
+scheduler-docker-local-scheduler-inspect() {
+  declare desc="scheduler-docker-local scheduler-inspect plugin trigger"
+  declare trigger="scheduler-docker-local scheduler-inspect"
+  declare DOKKU_SCHEDULER="$1" APP="$2"
+
+  if [[ "$DOKKU_SCHEDULER" != "docker-local" ]]; then
+    return
+  fi
+
+  local TMP_INSPECT_CMD=$(mktemp "/tmp/${FUNCNAME[0]}.XXXX")
+  trap 'rm -rf "$TMP_INSPECT_CMD" > /dev/null' RETURN INT TERM EXIT
+  cat > "$TMP_INSPECT_CMD" <<EOF
+import json
+import sys
+
+output = []
+data = json.load(sys.stdin)
+for container in data:
+    env = []
+    whitelist = ['CACHE_PATH=', 'DOCKER_', 'DOKKU_', 'DYNO=', 'PATH=', 'PORT=', 'USER=']
+    for e in container['Config']['Env']:
+        append = False
+        for w in whitelist:
+            if e.startswith(w):
+                append = True
+                break
+        if append:
+            env.append(e)
+            continue
+
+        k, v = e.split('=', 2)
+        env.append('{0}=XXXXXX'.format(k))
+
+    container['Config']['Env'] = env
+    output.append(container)
+
+print json.dumps(data, sort_keys=True, indent=4)
+EOF
+
+  local CONTAINER_FILES="$(find "$DOKKU_ROOT/$APP" -maxdepth 1 -name "CONTAINER.*" -printf "%f\n" 2>/dev/null | sort -t . -k 2 -n | xargs)"
+  local CIDS=()
+  for CONTAINER_FILE in $CONTAINER_FILES; do
+    CIDS+="$(< "$DOKKU_ROOT/$APP/$CONTAINER_FILE")"
+  done
+  docker inspect "${CIDS[@]}" | python2.7 "$TMP_INSPECT_CMD"
+
+}
+
+scheduler-docker-local-scheduler-inspect "$@"