Rewrite init script in rust and fix non-shell CMDs

src/inject.rs

@@ -1,15 +1,14 @@
-//! Inject: inspect a podman image's config, infer the default command, and
-//! inject distro-agnostic /slim/ scripts (init + exec) into the mounted rootfs.
+//! Inject: inspect a podman image's config, infer the default command argv,
+//! and inject the slim init binary + null-delimited argv/env files into the
+//! mounted rootfs.
 
 use anyhow::{Context, Result, anyhow};
 use serde::Deserialize;
-use std::fmt::Write as _;
 use std::fs;
 use std::path::Path;
 
 use crate::command::cmd;
-
-const SLIM_INIT: &str = include_str!("scripts/slim-init.sh");
+use crate::registry::init_binary_path;
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(rename_all = "PascalCase")]
@@ -40,56 +39,38 @@ pub fn inspect_config(image: &str) -> Result<Config> {
     Ok(config)
 }
 
-/// Infer the command string from the image config.
+/// Infer the command argv from the image config.
 ///
 /// Concatenates ENTRYPOINT + CMD (Docker semantics). If neither is present,
-/// falls back to `/bin/sh`.
-pub fn infer_command(config: &Config) -> String {
-    let parts = config.entrypoint.iter().chain(config.cmd.iter());
-    let parts: Vec<_> = parts.map(|s| s.as_str()).collect();
-
-    match &parts[..] {
-        [] => "/bin/sh".into(),
-        ["/bin/sh" | "sh", "-c", cmd] => cmd.to_string(),
-        _ => shell_join(&parts),
-    }
-}
-
-fn shell_escape(s: &str) -> String {
-    format!("'{}'", s.replace('\'', "'\\''"))
-}
-
-fn shell_join(parts: &[&str]) -> String {
-    parts
+/// falls back to `["/bin/sh"]`.
+pub fn infer_argv(config: &Config) -> Vec<String> {
+    let parts: Vec<String> = config
+        .entrypoint
         .iter()
-        .map(|p| shell_escape(p))
-        .collect::<Vec<_>>()
-        .join(" ")
+        .chain(config.cmd.iter())
+        .cloned()
+        .collect();
+
+    if parts.is_empty() {
+        vec!["/bin/sh".into()]
+    } else {
+        parts
+    }
 }
 
-/// Generate the /slim/exec script from a command string, env vars, and working dir.
-pub fn build_exec_script(command: &str, env: &[String], working_dir: Option<&str>) -> String {
-    let mut lines = String::from("#!/bin/sh\n");
-    if let Some(dir) = working_dir.filter(|d| !d.is_empty()) {
-        _ = writeln!(&mut lines, "cd {} 2>/dev/null", shell_escape(dir));
+/// Join items as null-delimited bytes.
+pub fn null_delimited(items: &[String]) -> Vec<u8> {
+    let mut data = Vec::new();
+    for item in items {
+        data.extend_from_slice(item.as_bytes());
+        data.push(0);
     }
-    for var in env {
-        if let Some((key, val)) = var.split_once('=') {
-            _ = writeln!(
-                &mut lines,
-                "export {}={}",
-                shell_escape(key),
-                shell_escape(val)
-            );
-        }
-    }
-    _ = writeln!(&mut lines, "exec /bin/sh -c {}", shell_escape(command));
-    lines
+    data
 }
 
 /// Install `content` into the mounted rootfs at `<mount>/slim/<name>` with
 /// the given mode.
-fn install_into_rootfs(mount: &str, name: &str, mode: &str, content: &str) -> Result<()> {
+fn install_into_rootfs(mount: &str, name: &str, mode: &str, content: &[u8]) -> Result<()> {
     let temp = tempfile::NamedTempFile::new()?;
     fs::write(temp.path(), content)?;
     let src = temp.path().to_str().context("temp path is not UTF-8")?;
@@ -100,25 +81,34 @@ fn install_into_rootfs(mount: &str, name: &str, mode: &str, content: &str) -> Re
     Ok(())
 }
 
-/// Inject /slim/init, /slim/exec, and optionally /slim/user and /slim/workdir
-/// into a mounted container image rootfs.
+/// Inject /slim/init (binary), /slim/exec (null-delimited argv), /slim/env
+/// (null-delimited env), and optionally /slim/user and /slim/workdir into a
+/// mounted container image rootfs.
 pub fn inject(
     mount_path: &Path,
-    exec_script: &str,
+    argv: &[String],
+    env: &[String],
     user: Option<&str>,
     working_dir: Option<&str>,
 ) -> Result<()> {
     let mount_str = mount_path.to_str().context("mount path is not UTF-8")?;
 
-    install_into_rootfs(mount_str, "init", "755", SLIM_INIT)?;
-    install_into_rootfs(mount_str, "exec", "755", exec_script)?;
+    let init_binary = fs::read(init_binary_path()?).context("Failed to read slim-init binary")?;
+    let exec_data = null_delimited(argv);
+    let env_data = null_delimited(env);
+
+    install_into_rootfs(mount_str, "init", "755", &init_binary)?;
+    install_into_rootfs(mount_str, "exec", "644", &exec_data)?;
+    if !env_data.is_empty() {
+        install_into_rootfs(mount_str, "env", "644", &env_data)?;
+    }
 
     if let Some(user) = user.filter(|u| !u.is_empty()) {
-        install_into_rootfs(mount_str, "user", "644", user)?;
+        install_into_rootfs(mount_str, "user", "644", user.as_bytes())?;
     }
 
     if let Some(dir) = working_dir.filter(|d| !d.is_empty()) {
-        install_into_rootfs(mount_str, "workdir", "644", dir)?;
+        install_into_rootfs(mount_str, "workdir", "644", dir.as_bytes())?;
     }
 
     Ok(())