jasonwitty
5637dea10b
- CI now builds the image locally on the (arm64) runner and runs scripts/verify-image-socktop-flags.sh before pushing: every --flag the restricted/session shells pass must be documented by the socktop binary actually installed in the image. Catches the 0.3.9 failure class (cached apt layer shipping a pre-flag socktop) at build time. - Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID: with ALL dropped, uid 0 has no implicit file privilege and prepare_demo_home crash-looped on the demo-owned 700 home dir. Sessions still run with zero capabilities via setpriv. - Agent liveness probe uses /proc instead of kill -0: without CAP_KILL even root gets EPERM signalling the socktop-user agent, so the old check false-alarmed in the pod logs. - 0.3.11 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
55 lines
1.9 KiB
Bash
Executable File
55 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Verify that the socktop binary baked into a built image understands every
|
|
# --flag the restricted/session shells pass to it.
|
|
#
|
|
# Why this exists: image 0.3.9 shipped with a cached apt layer holding socktop
|
|
# 1.60.1, while restricted-shell.sh had started passing --no-kill (added in
|
|
# 1.60.2). 1.60.1 parsed the unknown flag as the positional websocket URL,
|
|
# prompted to overwrite the 'local' profile with url "--no-kill", and broke the
|
|
# demo. This check fails the build whenever the shells and the installed
|
|
# binary disagree about the CLI.
|
|
#
|
|
# Usage: verify-image-socktop-flags.sh IMAGE
|
|
set -euo pipefail
|
|
|
|
IMAGE="${1:?usage: verify-image-socktop-flags.sh IMAGE}"
|
|
cd "$(dirname "$0")/.."
|
|
|
|
# Every --flag appearing on a socktop invocation line in the shells.
|
|
FLAGS=$(grep -hE '/usr/bin/socktop' docker/restricted-shell.sh docker/session-shell.sh 2>/dev/null |
|
|
grep -oE -- '--[a-z][a-z-]*' | sort -u)
|
|
if [ -z "$FLAGS" ]; then
|
|
echo "ERROR: found no socktop flags to verify — did the shells move?" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# The image is arm64-only; pin the platform so the check behaves the same on
|
|
# the arm64 CI runner and on an amd64 box with qemu binfmt.
|
|
run_socktop() {
|
|
docker run --rm --platform linux/arm64 --entrypoint /usr/bin/socktop "$IMAGE" "$@" 2>&1
|
|
}
|
|
|
|
if ! VERSION=$(run_socktop --version); then
|
|
echo "ERROR: could not run socktop from ${IMAGE}:" >&2
|
|
echo "$VERSION" >&2
|
|
exit 1
|
|
fi
|
|
HELP=$(run_socktop --help || true)
|
|
echo "image socktop: ${VERSION}"
|
|
|
|
rc=0
|
|
for flag in $FLAGS; do
|
|
if printf '%s' "$HELP" | grep -q -- "$flag"; then
|
|
echo " ok: $flag"
|
|
else
|
|
echo " MISSING: installed socktop does not document $flag" >&2
|
|
rc=1
|
|
fi
|
|
done
|
|
|
|
if [ "$rc" -ne 0 ]; then
|
|
echo "FAIL: the image's socktop predates flags the shells pass." >&2
|
|
echo "Bump SOCKTOP_VERSION in the Dockerfile to a release that has them." >&2
|
|
fi
|
|
exit $rc
|