diff --git a/container/container_cmd_linux.go b/container/container_cmd_linux.go index be7b0f1..aac8700 100644 --- a/container/container_cmd_linux.go +++ b/container/container_cmd_linux.go @@ -1,8 +1,12 @@ package container import ( + "bufio" + "errors" + "fmt" "os" "path/filepath" + "strings" "github.com/criyle/go-sandbox/pkg/unixsocket" ) @@ -23,6 +27,11 @@ func (c *containerServer) handleConf(conf *confCmd) error { if c.ContainerGID == 0 { c.ContainerGID = containerGID } + env, err := readDotEnv() + if err != nil { + return err + } + c.defaultEnv = env } return c.sendReply(reply{}, unixsocket.Msg{}) } @@ -68,3 +77,28 @@ func (c *containerServer) handleReset() error { } return c.sendReply(reply{}, unixsocket.Msg{}) } + +// readDotEnv attempts to read /.env file and save as default environment variables +func readDotEnv() ([]string, error) { + f, err := os.Open("/.env") + if err != nil { + if errors.Is(err, os.ErrNotExist) { + return nil, nil + } + } + defer f.Close() + + var ret []string + scanner := bufio.NewScanner(f) + for scanner.Scan() { + line := strings.TrimSpace(scanner.Text()) + if len(line) == 0 || strings.HasPrefix(line, "#") { + continue + } + if !strings.Contains(line, "=") { + return nil, fmt.Errorf("dotenv: invalid line %s", line) + } + ret = append(ret, line) + } + return ret, nil +} diff --git a/container/container_exec_linux.go b/container/container_exec_linux.go index 810a380..caedd63 100644 --- a/container/container_exec_linux.go +++ b/container/container_exec_linux.go @@ -36,8 +36,12 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error { files = files[1:] } + var env []string + env = append(env, c.defaultEnv...) + env = append(env, cmd.Env...) + if len(cmd.Argv) > 0 { - exePath, err := lookPath(cmd.Argv[0], cmd.Env) + exePath, err := lookPath(cmd.Argv[0], env) if err != nil { return c.sendErrorReply("handle: %s: %v", cmd.Argv[0], err) } @@ -80,7 +84,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error { r := forkexec.Runner{ Args: cmd.Argv, - Env: cmd.Env, + Env: env, ExecFile: execFile, RLimits: cmd.RLimits, Files: files, diff --git a/container/container_init_linux.go b/container/container_init_linux.go index b493e2d..8b4b6cd 100644 --- a/container/container_init_linux.go +++ b/container/container_init_linux.go @@ -17,6 +17,7 @@ import ( type containerServer struct { socket *socket containerConfig + defaultEnv []string done chan struct{} err error diff --git a/container/lookup_linux.go b/container/lookup_linux.go index 0d5e611..555d19e 100644 --- a/container/lookup_linux.go +++ b/container/lookup_linux.go @@ -54,7 +54,8 @@ func lookPath(name string, env []string) (string, error) { func findPath(env []string) ([]string, error) { // find PATH= const pathPrefix = "PATH=" - for _, s := range env { + for i := len(env) - 1; i >= 0; i-- { + s := env[i] if strings.HasPrefix(s, pathPrefix) { return filepath.SplitList(s[len(pathPrefix):]), nil } diff --git a/go.mod b/go.mod index fdec8ff..39c2d4d 100644 --- a/go.mod +++ b/go.mod @@ -4,8 +4,8 @@ go 1.18 require ( github.com/elastic/go-seccomp-bpf v1.2.0 - golang.org/x/net v0.0.0-20220812174116-3211cb980234 - golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab + golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c + golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64 ) require github.com/pkg/errors v0.9.1 // indirect diff --git a/go.sum b/go.sum index e9cb2f3..39f410e 100644 --- a/go.sum +++ b/go.sum @@ -13,12 +13,12 @@ github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20220812174116-3211cb980234 h1:RDqmgfe7SvlMWoqC3xwQ2blLO3fcWcxMa3eBLRdRW7E= -golang.org/x/net v0.0.0-20220812174116-3211cb980234/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk= +golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c h1:JVAXQ10yGGVbSyoer5VILysz6YKjdNT2bsvlayjqhes= +golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab h1:2QkjZIsXupsJbJIdSjjUOgWK3aEtzyuh2mPt3l/CkeU= -golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64 h1:UiNENfZ8gDvpiWw7IpOMQ27spWmThO1RwwdQVbJahJM= +golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=