cadey
/
propellor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Improve enter-machine scripts for nspawn containers to unset most environment variables.

This commit is contained in:
Joey Hess 2015-05-27 21:11:36 -04:00
parent 672a783d3a
commit 9ce43e55f8
3 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config-joey.hs
View File

@ -134,10 +134,10 @@ orca = standardSystem "orca.kitenet.net" Unstable "amd64"
! Docker.docked (GitAnnexBuilder.standardAutoBuilderContainer dockerImage "amd64" 15 "2h") ! Docker.docked (GitAnnexBuilder.standardAutoBuilderContainer dockerImage "amd64" 15 "2h")
! Docker.docked (GitAnnexBuilder.standardAutoBuilderContainer dockerImage "i386" 45 "2h") ! Docker.docked (GitAnnexBuilder.standardAutoBuilderContainer dockerImage "i386" 45 "2h")
! Docker.docked (GitAnnexBuilder.androidAutoBuilderContainer dockerImage (Cron.Times "1 1 * * *") "3h") ! Docker.docked (GitAnnexBuilder.androidAutoBuilderContainer dockerImage (Cron.Times "1 1 * * *") "3h")
! Docker.docked (GitAnnexBuilder.armelCompanionContainer dockerImage)
! Docker.docked (GitAnnexBuilder.armelAutoBuilderContainer dockerImage (Cron.Times "1 3 * * *") "5h")
& Docker.garbageCollected -- `period` Daily & Docker.garbageCollected -- `period` Daily
& Systemd.nspawned (GitAnnexBuilder.standardAutoBuilderContainerNspawn "amd64" 15 "2h") & Systemd.nspawned (GitAnnexBuilder.standardAutoBuilderContainerNspawn "amd64" 15 "2h")
& Docker.docked (GitAnnexBuilder.armelCompanionContainer dockerImage)
& Docker.docked (GitAnnexBuilder.armelAutoBuilderContainer dockerImage (Cron.Times "1 3 * * *") "5h")
& Apt.buildDep ["git-annex"] `period` Daily & Apt.buildDep ["git-annex"] `period` Daily
-- This is not a complete description of kite, since it's a -- This is not a complete description of kite, since it's a

2
debian/changelog vendored
View File

@ -7,6 +7,8 @@ propellor (2.5.0) UNRELEASED; urgency=medium
* Export CommandParam, boolSystem, safeSystem and shellEscape from * Export CommandParam, boolSystem, safeSystem and shellEscape from
Propellor.Property.Cmd, so they are available for use in constricting Propellor.Property.Cmd, so they are available for use in constricting
your own Properties when using propellor as a library. your own Properties when using propellor as a library.
* Improve enter-machine scripts for nspawn containers to unset most
environment variables.
-- Joey Hess <id@joeyh.name> Thu, 07 May 2015 12:08:34 -0400 -- Joey Hess <id@joeyh.name> Thu, 07 May 2015 12:08:34 -0400

20
src/Propellor/Property/Systemd.hs
View File

@ -215,15 +215,19 @@ enterScript c@(Container name _ _) = setup <!> teardown
where where
setup = combineProperties ("generated " ++ enterScriptFile c) setup = combineProperties ("generated " ++ enterScriptFile c)
[ scriptfile `File.hasContent` [ scriptfile `File.hasContent`
[ "#!/bin/sh" [ "#!/usr/bin/perl"
, "# Generated by propellor" , "# Generated by propellor"
, "pid=\"$(machinectl show " ++ shellEscape name ++ " -p Leader | cut -d= -f2)\" || true" , "my $pid=`machinectl show " ++ shellEscape name ++ " -p Leader | cut -d= -f2`;"
, "if [ -n \"$pid\" ]; then" , "chomp $pid;"
, "\tnsenter -p -u -n -i -m -t \"$pid\" \"$@\"" , "if (length $pid) {"
, "else" , "\tforeach my $var (keys %ENV) {"
, "\techo container not running >&2" , "\t\tdelete $var unless $var eq 'PATH' || $var eq 'TERM';"
, "\texit 1" , "\t}"
, "fi" , "\texec('nsenter', '-p', '-u', '-n', '-i', '-m', '-t', $pid, @ARGV);"
, "} else {"
, "\tdie 'container not running';"
, "}"
, "exit(1);"
] ]
, scriptfile `File.mode` combineModes (readModes ++ executeModes) , scriptfile `File.mode` combineModes (readModes ++ executeModes)
] ]