iceBear67
c7afb86ebc
Security & correctness fixes following the audit in REPORT.md.
- setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
check failures properly, return valid exit codes, and fetch
/releases/latest (arch-aware) instead of the possibly-draft .[0]
- entrypoint.sh: quote "$@" and build --net conditionally so empty
NET_INTERFACE/NET_MAC don't yield "tap=,mac="
- image-updater: replace tight 3s retry loop with capped exponential
backoff + periodic pull instead of hammering the registry
- sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
- vm.Dockerfile: copy only host private keys at mode 600 instead of
the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
- Makefile: stop generating redundant _pub key files
- build-image.sh: detect failure via alpine-make-vm-image's real exit
status rather than grepping stdout for "ERROR"
- remove orphaned etc/alloy/config.alloy (service not installed)
- README: correct data.raw path
- add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
38 lines
921 B
Bash
Executable File
38 lines
921 B
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
API_SOCKET="/hy.socks"
|
|
|
|
# Build the --net argument, omitting empty fields so cloud-hypervisor can pick
|
|
# sensible defaults (auto-created tap / generated MAC) instead of getting
|
|
# "tap=,mac=".
|
|
NET_INTERFACE="${NET_INTERFACE:-}"
|
|
NET_MAC="${NET_MAC:-}"
|
|
NET_ARG="tap=${NET_INTERFACE}"
|
|
if [ -n "$NET_MAC" ]; then
|
|
NET_ARG="${NET_ARG},mac=${NET_MAC}"
|
|
fi
|
|
|
|
/usr/bin/cloud-hypervisor \
|
|
--kernel /boot/vmlinuz-virt --initramfs /boot/initramfs-virt \
|
|
--disk path=/image/vm.raw,image_type=raw \
|
|
--disk path=/image/data.raw,direct=on,image_type=raw \
|
|
--api-socket "$API_SOCKET" \
|
|
--cmdline "root=/dev/vda rootfstype=ext4 modules=ext4a rw console=hvc0" \
|
|
--cpus boot=${CPU_COUNT:-4} \
|
|
--memory size=${MEMORY:-4G},shared=on \
|
|
--net "$NET_ARG" \
|
|
"$@" &
|
|
|
|
CH_PID=$!
|
|
|
|
_stop() {
|
|
echo "STOPPING!!"
|
|
ch-remote --api-socket "$API_SOCKET" power-button
|
|
wait $CH_PID
|
|
}
|
|
|
|
trap _stop TERM INT
|
|
|
|
wait $CH_PID
|