waaghals/toip

Configure your development tools as containers. Allows all developers to use the exact same tooling without having to install or manage them manually. Run them as if they are install locally.

toip's Issues

Improve image pulling

• Remove unnecessary copy (between downloading layer and extracting layer)
• Use Rayon
  • Convert layer download from for loop to map
  • Zip diff_id with manifest.layers
  • Convert to Rayon with par_iter()
  • Render multiple progress bars using MultiProgress

Build with github ci

Rename to Toip

Remove alias options from config

Inherit configured envvars from calling container

Config debug command

Add a command to debug the parsed configuration

arguments:
$ toip config debug

Serialize config into yaml

Configure volume for containers

• Allow absolute paths configured in user config
• Error when volume is not known in main config

Example configuration:

# toip.yaml
containers:
  container_with_volumes:
    image: ...
    volumes:
      /absolute/path/in/container: volume_a
      /path: volume_b

  other_container:
    image: ...
    mounts:
      /path: volume_b
      /other/path: volume_c

volumes:
  volume_a:
    source: relative/path/relative/to/config/file
    readonly: true
  volume_b: 
    source: shared/between/containers
  volume_c:
    name: anonymous
  volume_d:
    name: ${ENV_VAR}
    external: true
  volume_e: 
    source: ${HOME}/in/home/dir

Give ready signal when call listener is ready

Both the call/instructions listener and the call invocation happen in separate threads.
But the call invocation should only happen after the call/instructions listener is ready.

Now the call invocation sleeps for 100ms before actually passing the message to the socket, but it could wait for a ready signal.

Modify configuration using .env substitution

Allow values to be env substituted. Loads .env and uses processes available env vars.

Example:

aliases:
  ...
containers:
  container_a:
    image:
      context: .
      target: ${TARGET}
    cmd: ${COMMAND_TARGET}
    volumes:
      /app: ${VOLUME_NAME:-path_substitution}
    env:
      CONTAINER_VARIABLE: ${ENV_FROM_HOST}
    workdir: ${WORKDIR}
  container_b:
    image: some_image:${TAG}
  container_c:
    image: ${IMAGE}
volumes:
  path_substitution:
    source: ${PATH}/more
    readonly: true
  name_substitution:
    name: ${VOLUME_NAME?missing volume}

Support pluggable backends

Use higher level tooling for running the containers instead of doing the heavy lifting our self.

Backend	Driver	CLI
colima docker	docker	docker
colima containerd	nerdctl	colima nerdctl
lima	nerdctl	lima nerdctl
podman	docker	podman
nerdctl	nerdctl	nerctl
docker	docker	docker

nerdctl is docker compatible, so does not need to be implemented initially. Only when requiring nerdctl specific features.

Add install command to download and extract images

Force minimal version

Allow configuring a minimum required version of the binary.
This way you can make sure all developers are using them same version.

https://docs.rs/semver/latest/semver/index.html

Cleanup

• Cleanup dependencies
• Remove runc stuff
• Remove OCI handling

RUSTSEC-2020-0071: Potential segfault in the time crate

Potential segfault in the time crate

Details
Package	time
Version	0.1.43
URL	time-rs/time#293
Date	2020-11-18
Patched versions	>=0.2.23
Unaffected versions	=0.2.0,=0.2.1,=0.2.2,=0.2.3,=0.2.4,=0.2.5,=0.2.6

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

• time::UtcOffset::local_offset_at
• time::UtcOffset::try_local_offset_at
• time::UtcOffset::current_local_offset
• time::UtcOffset::try_current_local_offset
• time::OffsetDateTime::now_local
• time::OffsetDateTime::try_now_local

The affected functions in time 0.1 (all versions) are:

• at
• at_utc
• now

Non-Unix targets (including Windows and wasm) are unaffected.

Patches

Pending a proper fix, the internal method that determines the local offset has been modified to always return None on the affected operating systems. This has the effect of returning an Err on the try_* methods and UTC on the non-try_* methods.

Users and library authors with time in their dependency tree should perform cargo update, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3 series.

Workarounds

No workarounds are known.

References

time-rs/time#293

See advisory page for additional details.

Configure image and build separately

Similar to docker-compose.
When both image and build are provided, tag the build image with with the name and tag from the image field.

Allow both build and image to be configured using strings instead of structs when they are simple:
https://serde.rs/string-or-struct.html

Store extracted layers into state directory to prevent re-extraction

• Update directories crate to 4.0
• Store container in state directory
• Do not re-extract layers upon container invocation/creation
• Remove container on command exit

Socket is not removed after run invocation

The socket created by the run subcommand does not delete the socket after the process exists.

Prompt returns to soon

Reproduce:

1. Run sh from with cargo run -- run sh_musl
2. Run linked container cowsay like cowsay hi

Expected output:

/ # cowsay hi
 ____
< hi >
 ----
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
/ # 

Actual output

/ # cowsay hi
/ #  ____
< hi >
 ----
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

Create new socket for each invocation from host

Environment variable `TOIP_SOCK` does not exists

Improve CLI commands

• Update clap crate to 3.0, remove structopt crate
• Organize commands into separate directories

Convert configuration to yaml

Configuring nested tables in toml is a pain.

Mac build support

Use https://github.com/tormol/uds or something similar to support fd passing on mac.

Allow passing arguments starting with dash

Arguments with dashes must be passed using a separator.
php -v does not work while php info_version.php does

Support build secrets and ssh agent forwarding

RUSTSEC-2020-0159: Potential segfault in `localtime_r` invocations

Potential segfault in localtime_r invocations

Details
Package	chrono
Version	0.4.19
URL	chronotope/chrono#499
Date	2020-11-10

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

• time-rs/time#293

See advisory page for additional details.

Remove init process

No longer needed. Initially created to modify a container's PATH variable, but that is now handled in the OCI runtime bundle.

Add inject command to configure path on host

• Create run scripts into special directory (hashed to directory of current config)
• Symlink current run script dir into current $PATH
• Skip directories without configuration file
• Traverse up the directories to find first available configuration

	Configure cd 'hooks'	Add flag to configure re-export of PATH	Documentation
Bash
Fish
Zsh

Similar to starship.

Package into rpm, deb and apk

• Setup automatic builds using Github action
• Package using nFPM