Unit tests can't prove the rewritten binary actually works on each supported
distro and on both podman and docker; this exercises the real thing.
Move the tests in a set of simple scripts to run them.
Make a smaller e2e test for CLI and Images that runs on every PR
Keep the full compatibility suite in a separate job for main merge and
manual runs.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Lock down the container-name slug, enter env allow/deny, and podman/docker
ps parsers so provider JSON drift and symlink/env edge cases fail in CI
instead of in the field. Fixtures also capture the known doc/code and
comma-in-label quirks so they're tracked rather than silently accepted.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
The harness boots real VMs, so gate it to PRs touching distrobox-init or the
test itself instead of every push.
Base images use a split cache restore/save and on failure the per-distro log
dir is uploaded so it's debuggable without a re-run.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
The --nvidia path had no automated coverage and regresses easily (silent
32/64-bit collisions, dropped files), and GPU CI runners to exercise it
don't exist. This harness needs no GPU: it installs the nvidia driver in a
throwaway VM, runs `distrobox create --nvidia` against ubuntu/fedora/arch
guests, and checks every file the host package manager ships is mirrored in
with a matching checksum and resolvable deps. The package manifest is the
source of truth, so any gap fails loudly instead of silently.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
ROCm and other GPU workloads reach the device through /dev/kfd and
/dev/dri/renderD*, which are typically owned by group render (mode 0660).
Podman keeps the invoking user's supplementary groups via the
run.oci.keep_original_groups annotation, but the docker path forwarded only
the primary gid, so the container user was not in render/video and hit EACCES.
This generally puts docker on par with podman+crun
run.oci.keep_original_groups annotation.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
The --nvidia path mapped each driver library to a guest destination by
rewriting its host path (x86_64-linux-gnu / lib64 / lib32 via sed), which is
fragile across distros and can shadow the guest's own libGL/glvnd/Mesa.
Mount libs into /usr/lib/distrobox-nvidia/{lib64,lib32} bucketed by ELF class +
one ld.so.conf, instead of guessing the guest path; 4 mount loops fold into one.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
In rootless containers systemd-tmpfiles chowns the bind-mounted /tmp,
/dev and /sys and fails with EPERM, aborting package setup (systemd
>= 261, tpm-udev). Masks those configs.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
zypper returns >= 100 when the transaction committed but a caveat
applies - e.g. 107 when a package %post fails, common in containers.
Only 106 was accepted; warn on the whole band except 105 (a real abort).
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
alpine:edge's base image musl can lag the repo, so new package binaries
fail to relocate newer symbols (e.g. renameat2) and their post-install
scripts abort.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
The legacy shell tree carried a per-file license header; the Go rewrite
shipped without one. Add it to all files and enforce it going forward
via golangci-lint's goheader linter, so the notice can't be dropped.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
The exported struct was produced and consumed by nothing — no
InspectImage method exists and no caller references it — so it was
dead public surface, not a usable affordance.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
The (:|^)…(:|$) regexes only tested whether a path was an exact
colon-delimited segment — what slices.Contains over strings.Split does
directly, without recompiling a regex on every loop iteration.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* refactor(userenv): drop unreachable UID/GID id-command fallbacks
os.Getuid/os.Getgid only return -1 on Windows, and distrobox is
Linux/macOS only, so the `id -ru`/`id -rg` fallbacks never executed.
Call them directly and drop the now-unused //nolint:gocognit.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* refactor(config): use maps.Copy in mergeConfigMaps
Replace the hand-rolled nested-loop map merge with the stdlib
maps.Copy. Rename the variadic parameter to configMaps so it no
longer shadows the maps package.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* refactor(ephemeral): drop DryRun field shadowing CreateOptions
EphemeralOptions embedded CreateOptions yet redeclared DryRun,
shadowing it. Remove the field and rely on promotion; set DryRun
in the embedded CreateOptions at the call sites instead.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* refactor(create): drop duplicate local --verbose flag
The root command already declares --verbose/-v as a persistent
flag, so create's local copy was redundant. Remove it; -v and
--verbose on `distrobox create` still resolve to the global.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* refactor(containermanager): use time.RFC3339Nano in TimestampNow
Replace the hand-written "…000000000+00:00" layout with the stdlib
RFC3339Nano constant. Output is equivalent RFC3339 (UTC "Z", trailing
zeros trimmed), still valid input for `podman/docker logs --since`.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
---------
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
`distrobox enter my-box --help` and any distrobox flag placed after the
container name, was passed to the container manager as the command instead
of being parsed, so it failed with a crun error. This diverged from the
original bash distrobox-enter, which keeps parsing flags after the name and
only starts the command at -e/--exec/--.
The port stopped flag parsing at the first positional (StopOnNthArg), which
cannot tell the name from the command: when --name or DBX_CONTAINER_NAME
already supplies the name, the first positional *is* the command. So the
command boundary is resolved before parsing and everything past it is handed
to urfave verbatim, letting flags be recognized wherever they appear while
the custom command is still passed through untouched. ephemeral gets the
same treatment.
Unknown flags after the name are rejected, as in bash, so a mistyped flag
surfaces instead of being silently executed inside the container.
Fixes https://github.com/89luca89/distrobox/issues/2160
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
v1 containers bind-mount distrobox-{init,export,host-exec} from host
$bindir, and v1 desktop entries launch via `distrobox-enter`. Both
would silently break under v2's single binary. argv[0] dispatch
routes distrobox-* symlinks to the right subcommand, and the helpers
ship at the v1 paths so v1 containers keep working.
BREAKING CHANGE: v2 rc1 and rc2 prerelease containers used ~/.local/share/distrobox/v2/
for their helpers and must be recreated.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
IsDistrobox matched any label key OR value containing "distrobox", so
unrelated containers carrying a path or project tag that happened to
include the substring (e.g. a workdir under a "distrobox" directory)
leaked into `distrobox list` — and into the rm/upgrade/stop pipelines
that filter through the same call.
Label values are never authoritative; only `manager=distrobox` and the
`distrobox.*` key namespace are ever set by us. Check those directly,
keeping 24b31ed8 working for manager-overridden boxes (apx).
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Rewrite distrobox-*.md to `distrobox <cmd>`, reconcile flag tables with
internal/cli, refresh README+useful_tips, regenerate man/man1/*.1.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Wrappers in completions/ call --generate-shell-completion; a Go
ShellComplete callback emits flag names so urfave's default response
(subcommands only) is replaced with the full candidate set.
This replaces old hard-coded way to auto-complete using shell script's
parsing.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Fix "contaiers" typo (list, rm), route the upgrade error through the
printer, and simplify joinHooks now that tests/compare.sh is gone.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Env vars were read in three layers — cli.EnvVars on flags, os.Getenv
in CLI actions, and the podman provider — leaving library users no
single override point. Funnelling every DBX_* through pkg/config gives
consumers one injection point, lets the container manager receive its
configuration instead of sniffing for it, and fixes the create flags
whose Usage advertised a default the env-set value was already
shadowing.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Replace four fmt.Print*/Fprintf calls in pkg/commands/rm.go with a
printer field on RmCommand, converting warnUnknownContainers and
findExportedDesktopApps to methods. cli/rm, assemble, and ephemeral
propagate the new constructor arg so library users can control output.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Shell distrobox-create:204 prints `default: $(uname -n)`. Compute it
via os.Hostname() at command-build time so --help mirrors the shell.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Value: cfg.DefaultContainerImage made cmd.String("image") never empty,
which killed the `containerImage == ""` branch in makeContainerImage
and spuriously triggered the `name == default` fallback for `--name foo`
alone. The Usage string already shows the default.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
strings.Contains(container.Status, "Up") missed podman's lowercase
"running" status, leaving the force prompt unreachable under podman.
IsRunning() matches both docker ("Up …") and podman ("running").
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
`distrobox create --image alpine my-box` silently ignored the
positional; only --name was read. Override ContainerName from
cmd.Args().First() to match the shell (distrobox-create:453-461).
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
dryRun was misrouted into RmOptions.NoTTY, so `assemble rm --dry-run`
and `assemble create --replace --dry-run` actually deleted containers.
Match the shell which skips rm entirely (distrobox-assemble:316-319).
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Rootless podman/docker create now mounts /dev/null:/run/.distrobox.rootless:ro
(distrobox-create:577), so distrobox-init skips the /etc/shadow heuristic that
false-positives on Docker Desktop/macOS.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Thread RemoveHome into removeContainer; only prompt to delete the custom
home when --rm-home is set, interactive, and it differs from the host
home matching the shell. Without the flag the home is never touched.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Map the reference key `volume` (alongside `volumes`) and whitespace-split
the value so `volume="/a:/b /c:/d"` becomes separate mounts, matching
distrobox-assemble.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
- enter: fall back to cfg.DefaultContainerName (was passing "" to the manager)
- rm: fall back to cfg.DefaultContainerName (was a silent no-op)
- upgrade: error with "Please specify the name of the container." (was silently using my-distrobox)
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
`makeContainerName` replaced user-provided names with DefaultContainerName
whenever `image=` was empty, and `sectionToItem` kept whitespace from
headers like `[ generic1]`.
Both made `assemble create` emit `--name my-distrobox` (or a leading-space name)
for sections without an explicit image.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
PullImage ignored opts.DryRun and pulled anyway.
Thread DryRun through PullImage and gate
the usesRunc / supportsKeepIDSize probes.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Wire signal.NotifyContext in main so SIGINT/SIGTERM cancel the context
instead of killing the process.
ephemeral and assemble now defer rm on a detached cleanup ctx, so the
in-flight container is removed even when the user hits Ctrl+C.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
`Interactive: !NoTTY` routed stdio to discarded buffers whenever
--no-tty was set, breaking ptyxis. --no-tty only governs whether
`--tty` is appended to the exec args, not stdio plumbing.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
CustomCommand was joined into a string and re-split on whitespace,
collapsing quoted args — `sh -c "echo a || echo b"` lost its script
body, and any value passed by upgrade/assemble with embedded spaces
or quotes got mangled. Pass argv through as []string end-to-end.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* test(rewrite): add shell-vs-Go compatibility test suite
Compares command generation and flag parity between shell distrobox and
the Go rewrite. Uses a single image (alpine:3.21) since all tests
operate at the command-generation level, not runtime.
Shell output is always the reference — if Go differs it's a failure,
not a skip. Go stderr is captured for diagnostics on flag rejections.
Container targeting is per-name only (no --all) to avoid interfering
with existing distroboxes.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* fix add more tests
* fix add more tests
* fix add more tests
* fix(tests): fix malformed test cases in compare.sh
Three value-flag tests were broken by word splitting on unquoted
${flags} expansion — multi-word values caused trailing tokens to
clobber the container name:
- --additional-flags "--ulimit nofile=4096:4096" → --memory=512m
- --init-hooks "echo test-init-hook" → true
- --pre-init-hooks "echo test-pre-init-hook" → true
Also fix flag_slug computation (tr ' -' → tr ' -/:') in all four
loop sites so paths containing / or : don't create bogus filenames,
which silently broke the -H /tmp/dbx-test-home short-flag test.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* fix: test refinement
remove version checks
remove ephemeral until we fix upstream
add test that surfaces go vs shell difference
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* fix: exclude SHLVL from checks, reduce noise
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* fix(test): remove some noise from env vars
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
* chore: rename output file so that are grouped by operation
* chore(tests): fix linting issues and port comparison tests to POSIX sh
* chore(tests): apply shfmt
---------
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Co-authored-by: balanza <emanuele@decup.is>
Co-authored-by: Alessio Biancalana <alessio@dottorblaster.it>
Go rewrite emitted --userns keep-id without :size=65536 and
--platform <val> instead of --platform=<val>, diverging from the
shell reference implementation.
Sync assets internal shell with current upstream
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
On container storage drivers where CAP_DAC_OVERRIDE is not effective
(e.g. fuse-overlayfs in rootless mode, or VMs like Docker Desktop /
Colima on macOS), root cannot read files with mode 000 despite having
the capability in its effective set. This causes pam_unix.so account
management to fail with "Authentication service cannot retrieve
authentication info" when calling getspnam(), because glibc's NSS
files backend cannot open /etc/shadow.
Fedora and Arch ship /etc/shadow and /etc/gshadow as mode 000, relying
on CAP_DAC_OVERRIDE to grant root access. Set them to 0400 (owner-read)
after password setup so that standard POSIX owner checks suffice.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Modify user attributes (username, shell, GID, groups, UID) separately
with individual checks and fallbacks for each, rather than using a
single usermod call. This improves reliability by only modifying
attributes that differ from the expected values and provides more
granular error handling.
This also includes a fix in /etc/group that would make usermod fail if
it does not end with a newline.
Fix#1991Fix#1979
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
Luca Di Maio
