Skip to content

fix(tools): harden apple container bootstrap execs #405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
penso merged 2 commits into from
Mar 12, 2026
Merged

fix(tools): harden apple container bootstrap execs #405

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c5f498
fix(tools): harden apple container bootstrap execs
penso Mar 11, 2026
e41e748
test(tools): make create_sandbox_off deterministic
penso Mar 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 66 additions & 21 deletions crates/tools/src/sandbox.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,13 +39,11 @@ async fn provision_packages(cli: &str, container_name: &str, packages: &[String]
let pkg_list = packages.join(" ");
info!(container = container_name, packages = %pkg_list, "provisioning sandbox packages");
let output = tokio::process::Command::new(cli)
.args([
"exec",
.args(container_exec_shell_args(
cli,
container_name,
"sh",
"-c",
&format!("apt-get update -qq && apt-get install -y -qq {pkg_list} 2>&1 | tail -5"),
])
format!("apt-get update -qq && apt-get install -y -qq {pkg_list} 2>&1 | tail -5"),
))
.output()
.await?;
if !output.status.success() {
Expand Down Expand Up @@ -640,7 +638,7 @@ fn canonical_sandbox_packages(packages: &[String]) -> Vec<String> {
const SANDBOX_HOME_DIR: &str = "/home/sandbox";
const GOGCLI_MODULE_PATH: &str = "github.com/steipete/gogcli/cmd/gog";
const GOGCLI_VERSION: &str = "latest";
#[cfg(target_os = "macos")]
#[cfg(any(target_os = "macos", test))]
const APPLE_CONTAINER_SAFE_WORKDIR: &str = "/tmp";

fn sanitize_path_component(input: &str) -> String {
Expand Down Expand Up @@ -1041,17 +1039,22 @@ WORKDIR {SANDBOX_HOME_DIR}\n"
)
}

#[cfg(target_os = "macos")]
#[cfg(any(target_os = "macos", test))]
const APPLE_CONTAINER_FALLBACK_SLEEP_SECONDS: u64 = 2_147_483_647;

#[cfg(target_os = "macos")]
#[cfg(any(target_os = "macos", test))]
fn apple_container_wrap_shell_command(shell_command: String) -> String {
format!("mkdir -p {SANDBOX_HOME_DIR} && {shell_command}")
}

#[cfg(any(target_os = "macos", test))]
fn apple_container_bootstrap_command() -> String {
format!(
"mkdir -p {SANDBOX_HOME_DIR} && if command -v gnusleep >/dev/null 2>&1; then exec gnusleep infinity; else exec sleep {APPLE_CONTAINER_FALLBACK_SLEEP_SECONDS}; fi"
)
apple_container_wrap_shell_command(format!(
"if command -v gnusleep >/dev/null 2>&1; then exec gnusleep infinity; else exec sleep {APPLE_CONTAINER_FALLBACK_SLEEP_SECONDS}; fi"
))
}

#[cfg(target_os = "macos")]
#[cfg(any(target_os = "macos", test))]
fn apple_container_run_args(
name: &str,
image: &str,
Expand Down Expand Up @@ -1083,7 +1086,7 @@ fn apple_container_run_args(
args
}

#[cfg(target_os = "macos")]
#[cfg(any(target_os = "macos", test))]
fn apple_container_exec_args(name: &str, shell_command: String) -> Vec<String> {
vec![
"exec".to_string(),
Expand All @@ -1092,6 +1095,25 @@ fn apple_container_exec_args(name: &str, shell_command: String) -> Vec<String> {
name.to_string(),
"sh".to_string(),
"-c".to_string(),
apple_container_wrap_shell_command(shell_command),
]
}

fn container_exec_shell_args(
cli: &str,
container_name: &str,
shell_command: String,
) -> Vec<String> {
#[cfg(any(target_os = "macos", test))]
if cli == "container" {
return apple_container_exec_args(container_name, shell_command);
}

vec![
"exec".to_string(),
container_name.to_string(),
"sh".to_string(),
"-c".to_string(),
shell_command,
]
}
Expand Down Expand Up @@ -6776,7 +6798,6 @@ mod tests {
assert!(!is_apple_container_unavailable_error("permission denied"));
}

#[cfg(target_os = "macos")]
#[test]
fn test_should_restart_after_readiness_error() {
Comment on lines 6804 to 6805
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Re-add macOS gating for restart-readiness test

This test now executes on every target, but it calls should_restart_after_readiness_error and ContainerState, which remain behind #[cfg(target_os = "macos")] in this file, so non-macOS test runs fail at compile time before any tests execute (I reproduced this with cargo test -p moltis-tools container_exec_shell_args -- --nocapture). Please gate this test with the same macOS cfg (or make the referenced symbols available under test) so Linux CI can compile the test target.

Useful? React with 👍 / 👎.

assert!(should_restart_after_readiness_error(
Expand All @@ -6793,7 +6814,6 @@ mod tests {
));
}

#[cfg(target_os = "macos")]
#[test]
fn test_apple_container_bootstrap_command_uses_portable_sleep() {
let command = apple_container_bootstrap_command();
Expand All @@ -6804,7 +6824,6 @@ mod tests {
assert!(!command.contains("exec sleep infinity"));
}

#[cfg(target_os = "macos")]
#[test]
fn test_apple_container_run_args_pin_workdir_and_bootstrap_home() {
let args =
Expand All @@ -6829,7 +6848,6 @@ mod tests {
assert_eq!(args, expected);
}

#[cfg(target_os = "macos")]
#[test]
fn test_apple_container_run_args_with_home_volume() {
let args = apple_container_run_args(
Expand Down Expand Up @@ -6860,9 +6878,8 @@ mod tests {
assert_eq!(args, expected);
}

#[cfg(target_os = "macos")]
#[test]
fn test_apple_container_exec_args_pin_workdir() {
fn test_apple_container_exec_args_pin_workdir_and_bootstrap_home() {
let args = apple_container_exec_args("moltis-sandbox-test", "true".to_string());
let expected = vec![
"exec",
Expand All @@ -6871,14 +6888,42 @@ mod tests {
"moltis-sandbox-test",
"sh",
"-c",
"true",
"mkdir -p /home/sandbox && true",
]
.into_iter()
.map(str::to_string)
.collect::<Vec<_>>();
assert_eq!(args, expected);
}

#[test]
fn test_container_exec_shell_args_apple_container_uses_safe_wrapper() {
let args = container_exec_shell_args("container", "moltis-sandbox-test", "echo hi".into());
let expected = vec![
"exec",
"--workdir",
"/tmp",
"moltis-sandbox-test",
"sh",
"-c",
"mkdir -p /home/sandbox && echo hi",
]
.into_iter()
.map(str::to_string)
.collect::<Vec<_>>();
assert_eq!(args, expected);
}

#[test]
fn test_container_exec_shell_args_docker_keeps_standard_exec_shape() {
let args = container_exec_shell_args("docker", "moltis-sandbox-test", "echo hi".into());
let expected = vec!["exec", "moltis-sandbox-test", "sh", "-c", "echo hi"]
.into_iter()
.map(str::to_string)
.collect::<Vec<_>>();
assert_eq!(args, expected);
}

#[test]
fn test_apple_container_status_from_inspect() {
assert_eq!(
Expand Down
Loading