Thales Maciel
fc72fcd3a1
Add explicit workspace secrets across the CLI, SDK, and MCP, with create-time secret definitions and per-call secret-to-env mapping for exec, shell open, and service start. Persist only safe secret metadata in workspace records, materialize secret files under /run/pyro-secrets, and redact secret values from exec output, shell reads, service logs, and surfaced errors. Fix the remaining real-guest shell gap by shipping bundled guest init alongside the guest agent and patching both into guest-backed workspace rootfs images before boot. The new init mounts devpts so PTY shells work on Firecracker guests, while reset continues to recreate the sandbox and re-materialize secrets from stored task-local secret material. Validation: uv lock; UV_CACHE_DIR=.uv-cache make check; UV_CACHE_DIR=.uv-cache make dist-check; and a real guest-backed Firecracker smoke covering workspace create with secrets, secret-backed exec, shell, service, reset, and delete.
57 lines
1.4 KiB
Bash
57 lines
1.4 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
PATH=/usr/sbin:/usr/bin:/sbin:/bin
|
|
AGENT=/opt/pyro/bin/pyro_guest_agent.py
|
|
|
|
mount -t proc proc /proc || true
|
|
mount -t sysfs sysfs /sys || true
|
|
mount -t devtmpfs devtmpfs /dev || true
|
|
mkdir -p /dev/pts /run /tmp
|
|
mount -t devpts devpts /dev/pts -o mode=620,ptmxmode=666 || true
|
|
hostname pyro-vm || true
|
|
|
|
cmdline="$(cat /proc/cmdline 2>/dev/null || true)"
|
|
|
|
get_arg() {
|
|
key="$1"
|
|
for token in $cmdline; do
|
|
case "$token" in
|
|
"$key"=*)
|
|
printf '%s' "${token#*=}"
|
|
return 0
|
|
;;
|
|
esac
|
|
done
|
|
return 1
|
|
}
|
|
|
|
ip link set lo up || true
|
|
if ip link show eth0 >/dev/null 2>&1; then
|
|
ip link set eth0 up || true
|
|
guest_ip="$(get_arg pyro.guest_ip || true)"
|
|
gateway_ip="$(get_arg pyro.gateway_ip || true)"
|
|
netmask="$(get_arg pyro.netmask || true)"
|
|
dns_csv="$(get_arg pyro.dns || true)"
|
|
if [ -n "$guest_ip" ] && [ -n "$netmask" ]; then
|
|
ip addr add "$guest_ip/$netmask" dev eth0 || true
|
|
fi
|
|
if [ -n "$gateway_ip" ]; then
|
|
ip route add default via "$gateway_ip" dev eth0 || true
|
|
fi
|
|
if [ -n "$dns_csv" ]; then
|
|
: > /etc/resolv.conf
|
|
old_ifs="$IFS"
|
|
IFS=,
|
|
for dns in $dns_csv; do
|
|
printf 'nameserver %s\n' "$dns" >> /etc/resolv.conf
|
|
done
|
|
IFS="$old_ifs"
|
|
fi
|
|
fi
|
|
|
|
if [ -f "$AGENT" ]; then
|
|
python3 "$AGENT" &
|
|
fi
|
|
|
|
exec /bin/sh -lc 'trap : TERM INT; while true; do sleep 3600; done'
|