Initial release

scripts/run-vm.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# scripts/run-vm.sh NAME URL: starts a VM with the app's flags, prints the host socket.
+# Env: KNOTCHY_DEBUG, KNOTCHY_FIRST_VIEWER_TIMEOUT, KNOTCHY_ENV_FILE, KNOTCHY_SECRETS_DIR.
+# Name VMs knotchyctl-<8 hex> so the app's orphan sweep ignores them.
+set -euo pipefail
+name="${1:?usage: run-vm.sh NAME URL}"
+url="${2:?usage: run-vm.sh NAME URL}"
+if [[ ! "$name" =~ ^[a-z0-9][a-z0-9-]{0,40}$ ]]; then
+  echo "run-vm.sh: invalid VM name '$name' (lowercase letters, digits, dashes)" >&2; exit 2
+fi
+if [[ "$name" =~ ^knotchy-[0-9a-f]{8}$ ]]; then
+  echo "run-vm.sh: '$name' uses the app's naming; use knotchyctl-<8 hex>" >&2; exit 2
+fi
+
+tmp="${TMPDIR:-/tmp}"
+run_dir="${tmp%/}/knotchy"
+mkdir -p -m 700 "$run_dir"
+if [[ ! -d "$run_dir" || -L "$run_dir" || ! -O "$run_dir" ]]; then
+  echo "run-vm.sh: refusing unsafe socket directory $run_dir" >&2; exit 1
+fi
+chmod 700 "$run_dir"
+sock="$run_dir/$name.sock"
+rm -f "$sock"
+
+# The Mac's networks may be public addresses, so the VM blocks them explicitly.
+block=$(python3 - <<'PY'
+import ipaddress, re, subprocess
+out = subprocess.run(["ifconfig"], capture_output=True, text=True).stdout
+nets = set()
+for ip, mask in re.findall(r"inet (\d+\.\d+\.\d+\.\d+)(?: --> \S+)? netmask 0x([0-9a-f]{8})", out):
+    if ip.startswith("127."):
+        continue
+    net = ipaddress.ip_network(f"{ip}/{bin(int(mask, 16)).count('1')}", strict=False)
+    if net.prefixlen >= 8:
+        nets.add(str(net))
+print(" ".join(sorted(nets)))
+PY
+)
+if [[ -z "$block" ]]; then
+  echo "run-vm.sh: warning: found no Mac IPv4 networks to block" >&2
+fi
+
+container run -d --rm --name "$name" \
+  --cpus 4 --memory 2g --shm-size 512m \
+  --dns 1.1.1.1 \
+  --cap-add NET_ADMIN \
+  --masked-path NONE --read-only-path NONE \
+  --publish-socket "$sock:/tmp/knotchy/knotchy.sock" \
+  -e "KNOTCHY_URL=$url" \
+  -e "KNOTCHY_SIZE=1024x640" \
+  -e "KNOTCHY_BLOCK_CIDRS=$block" \
+  -e "KNOTCHY_DEBUG=${KNOTCHY_DEBUG:-0}" \
+  -e "KNOTCHY_FIRST_VIEWER_TIMEOUT=${KNOTCHY_FIRST_VIEWER_TIMEOUT:-60}" \
+  ${KNOTCHY_ENV_FILE:+--env-file "$KNOTCHY_ENV_FILE"} \
+  ${KNOTCHY_SECRETS_DIR:+--cap-add SYS_ADMIN --mount "type=bind,source=$KNOTCHY_SECRETS_DIR,target=/run/knotchy-secrets"} \
+  local/knotchy-vm:latest >/dev/null
+echo "$sock"