consul-template crashes because it assumes sh is installed and added to the command before running it

[bbourbie]

Hello,

We are running consul-template in a docker image named google distroless and for security reasons, there are no shell installed.

Last version of consule-template that was working well was 0.25.2, when I install consule-template 0.27.0, we now have the crash

2021-08-20T19:03:03.260Z [DEBUG] (runner) all templates rendered
2021-08-20T19:03:03.260Z [INFO] (child) spawning: sh -c /app/monitor -listen :8443 -metrics.path /metrics
2021-08-20T19:03:03.261Z [ERR] (cli) child: exec: "sh": executable file not found in $PATH

the command line is

 consul-template  -config /home/splunk/config.hcl  -exec /app/monitor -listen :8443 -metrics.path /metrics

A quick look at the source code shows me a prepCommand in runner.go and nothing to change that preCommand.

I don't think it's correct to assume there's a sh installed, I don't want to add sh to my docker image for security reasons

@eikenb

[eikenb]

Hey @bbourbie, sorry for your troubles. I know the problem and have an idea for a pretty quick fix.

The problem is that earlier versions used a shell parsing library that was a constant source of bugs and, after a review, was found to mishandle quoting at a base level requiring a large rewrite to fix. I decided to skip trying to parse shell command lines and call the system shell with the configured command passed to it, leaving the shell parsing to the shell. I made this the only way code was executed on *nix systems.

For Windows I had it only accept single argument commands as it doesn't have a shell. I could make the change pretty easily to expand that to all environments, that is that if the configured command is a single command (no spaces/tabs/etc) then it would be run directly w/o the underlying shell call.

This is a small change that shouldn't impact anyone's use, but would fix your case. What do you think? I think I could add this pretty speedily and I'm already looking to do a release soon due to a security issue...

[eikenb]

Hey @bbourbie .. I just posted the PR to make this change. I think it is probably a good general fix for cases like this but I'd like to hear back that it does address your case before going forward with it.

Thanks.

[bbourbie]

Thank you for your fast responses!! Let me review the PR.

[eikenb]

Hey @bbourbie,

I've made a few updates to the PR and it has gone through internal review. I'm ready to merge and release 0.27.1 with the fixes but wanted to let you have a chance to review it and verify that it would address your needs.

Thanks.