Simplify entrypoint script as per feedback.

No argument parsing is done in the Python script anymore;
instead, a few environment variables do the trick.

Dockerfile

@@ -75,10 +75,8 @@ COPY conversion /opt/dangerzone/dangerzone/conversion
 # Add the unprivileged user.
 # NOTE: A tmpfs will be mounted over /home/dangerzone directory,
 # so nothing within it from the image will be persisted.
-ARG DANGERZONE_UID=65042
-ARG DANGERZONE_GID=65042
-RUN addgroup -g "$DANGERZONE_GID" dangerzone && \
- adduser -u "$DANGERZONE_UID" -s /bin/true -G dangerzone -h /home/dangerzone -D dangerzone
+RUN addgroup dangerzone && \
+ adduser -s /bin/true -G dangerzone -h /home/dangerzone -D dangerzone
 
 ###########################################
 # gVisor wrapper image

dangerzone/gvisor_wrapper/entrypoint.py

@@ -1,6 +1,5 @@
 #!/usr/bin/python3
 
-import argparse
 import json
 import os
 import shlex
@@ -10,76 +9,23 @@
 
 # This script wraps the command-line arguments passed to it to run as an
 # unprivileged user in a gVisor sandbox.
+# Its behavior can be modified with the following environment variables:
+# RUNSC_DEBUG: If set, print debug messages to stderr, and log all gVisor
+# output to stderr.
+# RUNSC_FLAGS: If set, pass these flags to the `runsc` invocation.
+# These environment variables are not passed on to the sandboxed process.
 
-# Define flags.
-parser = argparse.ArgumentParser(
- prog="gvisor_wrapper",
- description="Run a command in a nested gVisor sandbox",
- prefix_chars="-",
- fromfile_prefix_chars=None,
-)
-flags_with_values = []
-parser.add_argument(
- "--pre_gvisor", action="store_true", help="Run command without gVisor wrapping"
-)
-parser.add_argument(
- "--gvisor_debug", action="store_true", help="Enable gVisor debug logging"
-)
-parser.add_argument(
- "--gvisor_strace", action="store_true", help="Enable system call tracing in gVisor"
-)
-flags_with_values.append(
- parser.add_argument(
- "--gvisor_flag",
- action="append",
- help="Add gVisor flag, may be specified multiple times",
- )
-)
-parser.add_argument(
- "command",
- nargs=argparse.PARSER,
- help="Command to run in the sandbox (or outside if --pre_gvisor is specified)",
-)
-
-if len(sys.argv) <= 1: # No arguments: bail.
- print("No command line specified.", file=sys.stderr)
- parser.print_help()
- sys.exit(2)
+def log(message, *values):
+ """Helper function to log messages if RUNSC_DEBUG is set."""
+ if os.environ.get("RUNSC_DEBUG"):
+ print(message.format(*values), file=sys.stderr)
 
-# We can't pass `sys.argv` directly to `parser` here because this may end up
-# processing flags from the wrapped command line that happen to match flags
-# that are defined in `parser`. For example, if the user were to somehow
-# make a file named `--pre_gvisor`, that would be pretty bad.
-# So we scan for the first argument that does not look like it is intended
-# for this entrypoint script, and we only pass this subset to `parser`.
-parser_args = None
-wrapped_command = None
-next_arg_is_value_of_previous_flag = False
-for i, arg in enumerate(sys.argv):
- if i == 0:
- continue # Skip argv[0]
- if next_arg_is_value_of_previous_flag:
- next_arg_is_value_of_previous_flag = False
- continue
- if arg == "--":
- parser_args = sys.argv[1:i]
- wrapped_command = sys.argv[i + 1 :]
- break
- if not arg.startswith(parser.prefix_chars):
- parser_args = sys.argv[1:i]
- wrapped_command = sys.argv[i:]
- break
- if "=" not in arg:
- arg_name = arg.lstrip(parser.prefix_chars)
- if any(arg_name == flag.dest for flag in flags_with_values):
- next_arg_is_value_of_previous_flag = True
-if parser_args is None or wrapped_command is None: # No command specified.
- parser_args = sys.argv[1:]
- wrapped_command = []
+wrapped_command = sys.argv[1:]
 if len(wrapped_command) == 0:
+ log("Invoked without a command; will execute 'sh'.")
  wrapped_command = ["sh"]
-parser_args.append("command") # To satisfy the parser's `command` argument.
-args = parser.parse_args(parser_args)
+else:
+ log("Invoked with command: {}", " ".join(shlex.quote(s) for s in wrapped_command))
 
 # Find the UID/GID of who we should run as within the sandbox.
 sandboxed_uid = int(
@@ -114,7 +60,7 @@
 # This can all be removed and simplified once gvisor.dev/issue/9918 is fixed.
 gvisor_issue_9918_is_fixed = False
 sandbox_capabilities = []
-if not gvisor_issue_9918_is_fixed and not args.pre_gvisor:
+if not gvisor_issue_9918_is_fixed:
  wrapped_command = [
  "su-exec",
  "%d:%d" % (sandboxed_uid, sandboxed_gid),
@@ -201,67 +147,47 @@
  ],
  },
 }
-not_forwarded_env = set(("PATH", "HOME", "SHLVL", "HOSTNAME", "TERM", "PWD"))
+not_forwarded_env = set((
+ "PATH",
+ "HOME",
+ "SHLVL",
+ "HOSTNAME",
+ "TERM",
+ "PWD",
+ "RUNSC_FLAGS",
+ "RUNSC_DEBUG",
+))
 for key_val in oci_config["process"]["env"]:
  not_forwarded_env.add(key_val[: key_val.index("=")])
 for key, val in os.environ.items():
  if key in not_forwarded_env:
  continue
  oci_config["process"]["env"].append("%s=%s" % (key, val))
-if args.gvisor_debug:
- print("Command inside gVisor sandbox:", wrapped_command, file=sys.stderr)
- print("OCI config:", file=sys.stderr)
+if os.environ.get("RUNSC_DEBUG"):
+ log("Command inside gVisor sandbox: {}", wrapped_command)
+ log("OCI config:")
  json.dump(oci_config, sys.stderr, indent=2, sort_keys=True)
  # json.dump doesn't print a trailing newline, so print one here:
- print("", file=sys.stderr)
+ log("")
 with open("/dangerzone-image/config.json", "w") as oci_config_out:
  json.dump(oci_config, oci_config_out, indent=2, sort_keys=True)
 
 # Run gVisor.
-runsc_binary = "/usr/bin/runsc"
-runsc_argv = [os.path.basename(runsc_binary), "--rootless=true", "--network=none"]
-if args.gvisor_debug:
+runsc_argv = ["/usr/bin/runsc", "--rootless=true", "--network=none"]
+if os.environ.get("RUNSC_DEBUG"):
  runsc_argv += ["--debug=true", "--alsologtostderr=true"]
-if args.gvisor_strace:
- runsc_argv += ["--strace=true"]
-if args.gvisor_flag is not None:
- for gvisor_flag in args.gvisor_flag:
- if gvisor_flag:
- runsc_argv += [gvisor_flag]
+if os.environ.get("RUNSC_FLAGS"):
+ runsc_argv += [x for x in shlex.split(os.environ.get("RUNSC_FLAGS")) if x]
 runsc_argv += ["run", "--bundle=/dangerzone-image", "dangerzone"]
-
-# Check for `--pre_gvisor` which can be used to run commands without wrapping.
-if args.pre_gvisor:
- print(
- "Would be running the following command if --pre_gvisor had not been specified:",
- " ".join(shlex.quote(s) for s in runsc_argv),
- file=sys.stderr,
- )
- print(
- "Executing this command instead:",
- " ".join(shlex.quote(s) for s in wrapped_command),
- file=sys.stderr,
- )
- try:
- os.execvp(wrapped_command[0], wrapped_command)
- except Exception as e:
- raise e.__class__("Process %s failed: %s" % (wrapped_command, e))
- else:
- assert False, "This code should never be reachable"
-
-if args.gvisor_debug:
- print(
- "Running gVisor with command line:",
- " ".join(shlex.quote(s) for s in runsc_argv),
- file=sys.stderr,
- )
+log(
+ "Running gVisor with command line: {}",
+ " ".join(shlex.quote(s) for s in runsc_argv)
+)
 runsc_process = subprocess.run(
  runsc_argv,
- executable=runsc_binary,
  check=False,
 )
-if args.gvisor_debug:
- print("gVisor quit with exit code:", runsc_process.returncode, file=sys.stderr)
+log("gVisor quit with exit code: {}", runsc_process.returncode)
 
 # We're done.
 sys.exit(runsc_process.returncode)