From 7ada7e3e9ec71cc2bd94902d37f5b2deafb2d169 Mon Sep 17 00:00:00 2001
From: balanza <emanuele@decup.is>
Date: Tue, 19 May 2026 10:34:14 +0200
Subject: [PATCH] fix(assemble): init flag to force set unshare-process and
 unshare-groups

See https://github.com/89luca89/distrobox/blob/a558b1799e4a30a39874453e5c2874ef702ab599/distrobox-create#L319
---
 pkg/commands/assemble.go      |   4 +-
 pkg/commands/assemble_test.go | 100 ++++++++++++++++++++++++++++++++++
 2 files changed, 102 insertions(+), 2 deletions(-)

diff --git a/pkg/commands/assemble.go b/pkg/commands/assemble.go
index 460cc862..dcd3323e 100644
--- a/pkg/commands/assemble.go
+++ b/pkg/commands/assemble.go
@@ -139,9 +139,9 @@ func (ac *AssembleCommand) createItem(ctx context.Context, item manifest.Item, d
 		ContainerHostname:       item.Hostname,
 		UnshareNetNs:            item.UnshareNetns || item.UnshareAll,
 		UnshareDevsys:           item.UnshareDevsys || item.UnshareAll,
-		UnshareGroups:           item.UnshareGroups || item.UnshareAll,
+		UnshareGroups:           item.UnshareGroups || item.UnshareAll || item.Init,
 		UnshareIpc:              item.UnshareIPC || item.UnshareAll,
-		UnshareProcess:          item.UnshareProcess || item.UnshareAll,
+		UnshareProcess:          item.UnshareProcess || item.UnshareAll || item.Init,
 		AdditionalFlags:         item.AdditionalFlags,
 		AdditionalVolumes:       item.Volumes,
 		AdditionalPackages:      item.AdditionalPackages,
diff --git a/pkg/commands/assemble_test.go b/pkg/commands/assemble_test.go
index 8b054f7b..0cc983d3 100644
--- a/pkg/commands/assemble_test.go
+++ b/pkg/commands/assemble_test.go
@@ -291,6 +291,106 @@ func TestAssembleCommand_ExampleManifest(t *testing.T) {
 	)
 }
 
+func TestAssembleCommand_Create_NoFlagsLeavesAllUnshareFalse(t *testing.T) {
+	mock := &testutil.MockContainerManager{}
+	cmd := newTestAssembleCommand(mock)
+
+	err := cmd.Execute(context.Background(), commands.AssembleOptions{
+		Items:  []manifest.Item{{Name: "test-box", Image: "ubuntu:latest"}},
+		DryRun: true,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, mock.Spy.Create, 1)
+	opts := mock.Spy.Create[0][0].(containermanager.CreateOptions)
+	assert.False(t, opts.Init)
+	assert.False(t, opts.UnshareNetNS)
+	assert.False(t, opts.UnshareDevsys)
+	assert.False(t, opts.UnshareGroups)
+	assert.False(t, opts.UnshareIPC)
+	assert.False(t, opts.UnshareProcess)
+}
+
+func TestAssembleCommand_Create_InitImpliesUnshareProcessAndGroups(t *testing.T) {
+	mock := &testutil.MockContainerManager{}
+	cmd := newTestAssembleCommand(mock)
+
+	err := cmd.Execute(context.Background(), commands.AssembleOptions{
+		Items:  []manifest.Item{{Name: "test-box", Image: "ubuntu:latest", Init: true}},
+		DryRun: true,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, mock.Spy.Create, 1)
+	opts := mock.Spy.Create[0][0].(containermanager.CreateOptions)
+	assert.True(t, opts.Init)
+	assert.True(t, opts.UnshareProcess, "init must imply unshare_process")
+	assert.True(t, opts.UnshareGroups, "init must imply unshare_groups")
+	assert.False(t, opts.UnshareNetNS)
+	assert.False(t, opts.UnshareDevsys)
+	assert.False(t, opts.UnshareIPC)
+}
+
+func TestAssembleCommand_Create_UnshareAllImpliesEveryUnshareFlag(t *testing.T) {
+	mock := &testutil.MockContainerManager{}
+	cmd := newTestAssembleCommand(mock)
+
+	err := cmd.Execute(context.Background(), commands.AssembleOptions{
+		Items:  []manifest.Item{{Name: "test-box", Image: "ubuntu:latest", UnshareAll: true}},
+		DryRun: true,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, mock.Spy.Create, 1)
+	opts := mock.Spy.Create[0][0].(containermanager.CreateOptions)
+	assert.False(t, opts.Init)
+	assert.True(t, opts.UnshareNetNS)
+	assert.True(t, opts.UnshareDevsys)
+	assert.True(t, opts.UnshareGroups)
+	assert.True(t, opts.UnshareIPC)
+	assert.True(t, opts.UnshareProcess)
+}
+
+func TestAssembleCommand_Create_InitCombinedWithExplicitUnshareNetnsUnionsBoth(t *testing.T) {
+	mock := &testutil.MockContainerManager{}
+	cmd := newTestAssembleCommand(mock)
+
+	err := cmd.Execute(context.Background(), commands.AssembleOptions{
+		Items:  []manifest.Item{{Name: "test-box", Image: "ubuntu:latest", Init: true, UnshareNetns: true}},
+		DryRun: true,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, mock.Spy.Create, 1)
+	opts := mock.Spy.Create[0][0].(containermanager.CreateOptions)
+	assert.True(t, opts.Init)
+	assert.True(t, opts.UnshareNetNS)
+	assert.True(t, opts.UnshareGroups)
+	assert.True(t, opts.UnshareProcess)
+	assert.False(t, opts.UnshareDevsys)
+	assert.False(t, opts.UnshareIPC)
+}
+
+func TestAssembleCommand_Create_IndividualUnshareDevsysPassesThroughAlone(t *testing.T) {
+	mock := &testutil.MockContainerManager{}
+	cmd := newTestAssembleCommand(mock)
+
+	err := cmd.Execute(context.Background(), commands.AssembleOptions{
+		Items:  []manifest.Item{{Name: "test-box", Image: "ubuntu:latest", UnshareDevsys: true}},
+		DryRun: true,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, mock.Spy.Create, 1)
+	opts := mock.Spy.Create[0][0].(containermanager.CreateOptions)
+	assert.False(t, opts.Init)
+	assert.True(t, opts.UnshareDevsys)
+	assert.False(t, opts.UnshareNetNS)
+	assert.False(t, opts.UnshareGroups)
+	assert.False(t, opts.UnshareIPC)
+	assert.False(t, opts.UnshareProcess)
+}
+
 func TestAssembleCommand_SetupBox_ExportedBins_InvalidExportPath(t *testing.T) {
 	invalidPaths := []string{
 		"",