Use Unix socket for Supervisor to Core communication

.github/workflows/builder.yml

@@ -284,9 +284,10 @@ jobs:
             --privileged \
             --security-opt seccomp=unconfined \
             --security-opt apparmor=unconfined \
-            -v /run/docker.sock:/run/docker.sock \
-            -v /run/dbus:/run/dbus \
-            -v /tmp/supervisor/data:/data \
+            -v /run/docker.sock:/run/docker.sock:rw \
+            -v /run/dbus:/run/dbus:ro \
+            -v /run/supervisor:/run/os:rw \
+            -v /tmp/supervisor/data:/data:rw,slave \
             -v /etc/machine-id:/etc/machine-id:ro \
             -e SUPERVISOR_SHARE="/tmp/supervisor/data" \
             -e SUPERVISOR_NAME=hassio_supervisor \

supervisor/api/proxy.py

@@ -7,7 +7,6 @@
 
 import aiohttp
 from aiohttp import WSCloseCode, WSMessageTypeError, web
-from aiohttp.client_exceptions import ClientConnectorError
 from aiohttp.client_ws import ClientWebSocketResponse
 from aiohttp.hdrs import AUTHORIZATION, CONTENT_TYPE
 from aiohttp.http_websocket import WSMsgType
@@ -179,57 +178,16 @@ async def api(self, request: web.Request):
 
     async def _websocket_client(self) -> ClientWebSocketResponse:
         """Initialize a WebSocket API connection."""
-        url = f"{self.sys_homeassistant.api_url}/api/websocket"
-
         try:
-            client = await self.sys_websession.ws_connect(
-                url, heartbeat=30, ssl=False, max_msg_size=MAX_MESSAGE_SIZE_FROM_CORE
-            )
-
-            # Handle authentication
-            data = await client.receive_json()
-
-            if data.get("type") == "auth_ok":
-                return client
-
-            if data.get("type") != "auth_required":
-                # Invalid protocol
-                raise APIError(
-                    f"Got unexpected response from Home Assistant WebSocket: {data}",
-                    _LOGGER.error,
-                )
-
-            # Auth session
-            await self.sys_homeassistant.api.ensure_access_token()
-            await client.send_json(
-                {
-                    "type": "auth",
-                    "access_token": self.sys_homeassistant.api.access_token,
-                },
-                dumps=json_dumps,
+            ws_client = await self.sys_homeassistant.api.connect_websocket(
+                max_msg_size=MAX_MESSAGE_SIZE_FROM_CORE
             )
-
-            data = await client.receive_json()
-
-            if data.get("type") == "auth_ok":
-                return client
-
-            # Renew the Token is invalid
-            if (
-                data.get("type") == "invalid_auth"
-                and self.sys_homeassistant.refresh_token
-            ):
-                self.sys_homeassistant.api.access_token = None
-                return await self._websocket_client()
-
-            raise HomeAssistantAuthError()
-
-        except (RuntimeError, ValueError, TypeError, ClientConnectorError) as err:
-            _LOGGER.error("Client error on WebSocket API %s.", err)
-        except HomeAssistantAuthError:
-            _LOGGER.error("Failed authentication to Home Assistant WebSocket")
-
-        raise APIError()
+            return ws_client.client
+        except HomeAssistantAPIError as err:
+            raise APIError(
+                f"Error connecting to Home Assistant WebSocket: {err}",
+                _LOGGER.error,
+            ) from err
 
     async def _proxy_message(
         self,

supervisor/const.py

@@ -39,9 +39,10 @@
 FILE_SUFFIX_CONFIGURATION = [".yaml", ".yml", ".json"]
 
 MACHINE_ID = Path("/etc/machine-id")
+RUN_SUPERVISOR_STATE = Path("/run/supervisor")
+SOCKET_CORE = Path("/run/os/core.sock")
 SOCKET_DBUS = Path("/run/dbus/system_bus_socket")
 SOCKET_DOCKER = Path("/run/docker.sock")
-RUN_SUPERVISOR_STATE = Path("/run/supervisor")
 SYSTEMD_JOURNAL_PERSISTENT = Path("/var/log/journal")
 SYSTEMD_JOURNAL_VOLATILE = Path("/run/log/journal")
 

supervisor/core.py

@@ -338,6 +338,7 @@ async def stop(self) -> None:
                         self.sys_create_task(coro)
                         for coro in (
                             self.sys_websession.close(),
+                            self.sys_homeassistant.api.close(),
                             self.sys_ingress.unload(),
                             self.sys_hardware.unload(),
                             self.sys_dbus.unload(),

supervisor/docker/const.py

@@ -140,6 +140,7 @@ def to_dict(self) -> dict[str, str | int]:
         }
 
 
+ENV_CORE_API_SOCKET = "SUPERVISOR_CORE_API_SOCKET"
 ENV_DUPLICATE_LOG_FILE = "HA_DUPLICATE_LOG_FILE"
 ENV_TIME = "TZ"
 ENV_TOKEN = "SUPERVISOR_TOKEN"
@@ -169,6 +170,12 @@ def to_dict(self) -> dict[str, str | int]:
     target=MACHINE_ID.as_posix(),
     read_only=True,
 )
+MOUNT_CORE_RUN = DockerMount(
+    type=MountType.BIND,
+    source="/run/supervisor",
+    target="/run/supervisor",
+    read_only=False,
+)
 MOUNT_UDEV = DockerMount(
     type=MountType.BIND, source="/run/udev", target="/run/udev", read_only=True
 )

supervisor/docker/homeassistant.py

@@ -13,10 +13,12 @@
 from ..jobs.const import JobConcurrency
 from ..jobs.decorator import Job
 from .const import (
+    ENV_CORE_API_SOCKET,
     ENV_DUPLICATE_LOG_FILE,
     ENV_TIME,
     ENV_TOKEN,
     ENV_TOKEN_OLD,
+    MOUNT_CORE_RUN,
     MOUNT_DBUS,
     MOUNT_DEV,
     MOUNT_MACHINE_ID,
@@ -162,6 +164,9 @@ def mounts(self) -> list[DockerMount]:
         if self.sys_machine_id:
             mounts.append(MOUNT_MACHINE_ID)
 
+        if self.sys_homeassistant.api.supports_unix_socket:
+            mounts.append(MOUNT_CORE_RUN)
+
         return mounts
 
     @Job(
@@ -180,6 +185,8 @@ async def run(self, *, restore_job_id: str | None = None) -> None:
         }
         if restore_job_id:
             environment[ENV_RESTORE_JOB_ID] = restore_job_id
+        if self.sys_homeassistant.api.supports_unix_socket:
+            environment[ENV_CORE_API_SOCKET] = "/run/supervisor/core.sock"
         if self.sys_homeassistant.duplicate_log_file:
             environment[ENV_DUPLICATE_LOG_FILE] = "1"
         await self._run(

supervisor/docker/interface.py

@@ -115,6 +115,11 @@ def timeout(self) -> int:
     def name(self) -> str:
         """Return name of Docker container."""
 
+    @property
+    def attached(self) -> bool:
+        """Return True if container/image metadata has been loaded."""
+        return self._meta is not None
+
     @property
     def meta_config(self) -> dict[str, Any]:
         """Return meta data of configuration for container/image."""