bwrap-home

#!/usr/bin/env bash

# Run command with a fake $HOME and optionally tmpfs in /tmp,
# mounting everything but $PWD read-only.
#
# Useful for running those "modern" language-specific package managers
# in a controlled environment.

set -eu -o pipefail

# shellcheck source-path=..
. "$HOME"/bin/.o

options=$(
	unset GETOPT_COMPATIBLE
	getopt \
		-o hH:Ttm:M: \
		--long "help,home:,home-tmpfs,tmp:,tmpfs,mount:,mount-rw:" \
		-- "$@"
)
eval "set -- $options"

home=$PWD/.home
home_tmpfs=
tmpdir=
tmpfs=
mount=()
mount_rw=()
while (( $# )); do
	opt=$1; shift
	case "$opt" in
		-h|--help)
			echo "Usage: bwrap-home [-h|--home=PATH] [-T|--home-tmpfs] [--tmp=PATH] [-t|--tmpfs] [-m|--mount=PATH] [-M|--mount-rw=PATH] -- <command> [<args>…]"
			exit
			;;

		-H|--home) home=$1; shift ;;
		-T|--home-tmpfs) home_tmpfs=: ;;
		--tmp) tmpdir=$1; shift ;;
		-t|--tmpfs) tmpfs=: ;;
		-m|--mount) mount+=("$1"); shift ;;
		-M|--mount-rw) mount_rw+=("$1"); shift ;;
		--) break ;;
	esac
done

real_HOME=$(readlink -f "$HOME")
if [[ "${real_HOME%/}"/ == "${PWD%/}"/* ]]; then
	echo "\$HOME under \$PWD, would mount \$HOME read-write, exiting"
	exit 1
fi

bwrap_opts=()

if [[ $tmpfs ]]; then
	real_tmp=$(readlink -f /tmp)
	if [[ "${real_tmp%/}"/ == "${PWD%/}"/* ]]; then
		echo "/tmp under \$PWD, would mount /tmp read-write, exiting"
		exit 1
	fi

	bwrap_opts+=(--tmpfs /tmp)
elif [[ $tmpdir ]]; then
	[[ -d "$tmpdir" ]] || o mkdir -p "$tmpdir"

	real_tmp=$(readlink -f /tmp)
	real_tmpdir=$(readlink -f "$tmpdir")
	if [[ "${real_tmpdir%/}"/ != "${real_tmp%/}"/* ]]; then
		echo "--tmp $tmpdir must be under /tmp, exiting"
		exit 1
	fi

	bwrap_opts+=(--bind "$tmpdir" /tmp)
else
	bwrap_opts+=(--bind /tmp{,})
fi

orig_HOME="$HOME"
if [[ $home_tmpfs ]]; then
	bwrap_opts+=(
		--tmpfs "$HOME"
		--bind "$PWD"{,}
	)
else
	home=$(readlink -f "$home")

	if [[ "${real_HOME%/}"/ == "${home%/}"/* ]]; then
		echo "\$HOME under --home $home, would mount \$HOME read-write, exiting"
		exit 1
	fi

	[[ -d "$home" ]] || o mkdir -p "$home"
	export HOME="$home"
	bwrap_opts+=(
		--bind "$PWD"{,}
		--bind "$HOME"{,}
	)
fi

if [[ "$HOME" != "$orig_HOME" ]]; then
	bwrap_opts+=(
		--ro-bind {"$orig_HOME","$HOME"}/.config/mise
		--ro-bind {"$orig_HOME","$HOME"}/.local/share/mise
	)
fi

for m in "${mount[@]}" "${mount_rw[@]}"; do
	if [[ "${real_HOME%/}"/ == "${m%/}"/* ]]; then
		echo "\$HOME under $m, would make \$HOME accessible, exiting"
		exit 1
	fi
	if [[ $tmpfs && "${real_tmp%/}"/ == "${m%/}"/* ]]; then
		echo "/tmp under $m, would make /tmp accessible, exiting"
		exit 1
	fi
done

for m in "${mount[@]}"; do
	bwrap_opts+=(
		--ro-bind "$m"{,}
	)
done
for m in "${mount_rw[@]}"; do
	bwrap_opts+=(
		--bind "$m"{,}
	)
done

(( $# )) || set -- bash

o exec bwrap \
	--ro-bind /{,} \
	--dev /dev \
	--proc /proc \
	"${bwrap_opts[@]}" \
	-- "$@"