Sandbox env, and an image's own environment a72abeeedd78

                  [--env NAME=value …]      #   with the image's own environment (a Dockerfile's ENV)

    let mut fields = vec![

    ];

    // Environment as sorted [name, value] pairs; absent when empty, so

    // sandboxes without one hash as before.

    if !s.env.is_empty() {

        fields.push((6, Value::Array(s.env.iter().map(|(k, v)| Value::Array(vec![text(k), text(v)])).collect())));

    }

    Value::map(fields)

    /// Environment every job in this sandbox starts from; a job's own `env`

    /// overrides it.

    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]

    pub env: BTreeMap<String, String>,

    /// The job's environment on top of its sandbox's: what it runs with.

    pub fn in_sandbox(&self, sandbox: &Sandbox) -> Job {

        let mut job = self.clone();

        for (k, v) in &sandbox.env {

            job.env.entry(k.clone()).or_insert_with(|| v.clone());

        }

        job

    }

    let mut env = BTreeMap::new();

        }

        if key == "env" {

            parse_env(ctx, c, &mut env);

            continue;

    }

    Some(Sandbox { name, runtime: runtime?, rootfs: rootfs?, memory_mib: memory?, cpus: cpus?, network: network?, env })

}

/// An `env` block of `NAME "value"` lines, into `env`.

fn parse_env(ctx: &mut Ctx, c: &KdlNode, env: &mut BTreeMap<String, String>) {

    if !c.entries().is_empty() {

        ctx.err(c.span(), "`env` takes a block of NAME \"value\" lines");

    }

    for e in block(ctx, c) {

        let k = e.name().value().to_string();

        let valid =

            !k.is_empty() && !k.starts_with(|c: char| c.is_ascii_digit()) && k.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_');

        if !valid {

            ctx.err(e.span(), format!("environment name {k:?} must be letters, digits and _"));

            continue;

        }

        ctx.no_children(e);

        if let Some(v) = ctx.one_string(e) {

            if env.insert(k.clone(), v).is_some() {

                ctx.err(e.span(), format!("environment {k} is set twice"));

            }

        }

            "env" => parse_env(ctx, c, &mut job.env),

#[test]

fn a_sandbox_env_is_where_jobs_start() {

    let src = |sandbox_env: &str| {

        format!(

            "schema-version 1\nsandbox \"mos\" {{\n    rootfs \"cas://blob/{ROOTFS}\"\n{sandbox_env}}}\njob \"build\" {{\n    sandbox \"mos\"\n    env {{\n        X16EMU \"/opt/job\"\n    }}\n    exec \"make\"\n}}\n"

        )

    };

    let with =

        Pipeline::parse(&src("    env {\n        PATH \"/opt/llvm-mos/bin:/usr/bin:/bin\"\n        X16EMU \"/opt/x16emu\"\n    }\n"))

            .unwrap();

    let sb = &with.sandboxes["mos"];

    assert_eq!(sb.env["PATH"], "/opt/llvm-mos/bin:/usr/bin:/bin");

    let job = with.jobs["build"].in_sandbox(sb);

    assert_eq!(job.env["PATH"], "/opt/llvm-mos/bin:/usr/bin:/bin", "from the sandbox");

    assert_eq!(job.env["X16EMU"], "/opt/job", "the job's own value wins");

    // The sandbox's environment is part of the pipeline's hash; a sandbox

    // without one hashes as before.

    let without = Pipeline::parse(&src("")).unwrap();

    assert!(without.sandboxes["mos"].env.is_empty());

    assert_ne!(with.hash(), without.hash());

    let bad = problems(&src("    env {\n        BAD-NAME \"x\"\n    }\n"));

    assert!(bad.iter().any(|(_, m)| m.contains("letters, digits and _")), "{bad:?}");

}

/// A job's environment: `PATH` and `HOME=/tmp` by default, then the

/// image's own (`/etc/flow/env`, written by `flow rootfs import --env`),

/// then the job's (its sandbox's and its own, already merged by the host).

/// Later ones win, so a pipeline can always set `PATH`.

fn job_env(image: Option<&str>, job: &[(String, String)]) -> std::collections::BTreeMap<String, String> {

    let mut env = std::collections::BTreeMap::new();

    env.insert("PATH".to_string(), PATH.to_string());

    env.insert("HOME".to_string(), "/tmp".to_string());

    for line in image.unwrap_or("").lines() {

        if let Some((k, v)) = line.split_once('=') {

            if !k.is_empty() {

                env.insert(k.to_string(), v.to_string());

            }

        }

    }

    for (k, v) in job {

        env.insert(k.clone(), v.clone());

    }

    env

}

    let vars = job_env(std::fs::read_to_string("/etc/flow/env").ok().as_deref(), &job.env);

    let path = vars.get("PATH").map(String::as_str).unwrap_or(PATH);

    let program = cstr(&resolve_program(&job.argv[0], path).ok_or_else(|| format!("cannot run {:?}: not found in {path}", job.argv[0]))?)?;

    let env: Vec<CString> = vars.iter().map(|(k, v)| cstr(&format!("{k}={v}"))).collect::<Result<_, _>>()?;

    use super::{dev_links, job_env, resolve_program};

    #[test]

    fn the_image_environment_sits_under_the_jobs() {

        let image = "PATH=/opt/llvm-mos/bin:/usr/bin:/bin\nX16EMU=/opt/x16emu\nnot a line\n";

        let env = job_env(Some(image), &[("X16EMU".into(), "/job".into()), ("LANG".into(), "C".into())]);

        assert_eq!(env["PATH"], "/opt/llvm-mos/bin:/usr/bin:/bin", "the image's PATH replaces the default");

        assert_eq!(env["X16EMU"], "/job", "the job's value wins");

        assert_eq!(env["HOME"], "/tmp");

        assert_eq!(env["LANG"], "C");

        assert_eq!(job_env(None, &[])["PATH"], super::PATH);

    }

        /// The image's own environment, NAME=value (repeatable): what a

        /// Dockerfile's ENV sets and `docker export` loses. Jobs start from

        /// it; their sandbox's and their own `env` override it

        #[arg(long = "env", value_name = "NAME=VALUE")]

        env: Vec<String>,

                RootfsCmd::Import { tarball, sha256, env } => rootfs_import(&home, &tarball, sha256.as_deref(), &env),

/// The image environment file flow-init reads (`/etc/flow/env`): one

/// `NAME=value` per line, names checked as a pipeline's are.

fn image_env_file(env: &[String]) -> Result<String> {

    let mut out = String::new();

    for e in env {

        let Some((k, v)) = e.split_once('=') else { bail!("--env {e:?}: expected NAME=value") };

        let ok = !k.is_empty() && !k.starts_with(|c: char| c.is_ascii_digit()) && k.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_');

        if !ok || v.contains('\n') || v.contains('\0') {

            bail!("--env {e:?}: a name is letters, digits and _, and a value is one line");

        }

        out.push_str(&format!("{k}={v}\n"));

    }

    Ok(out)

}

fn rootfs_import(home: &Home, tarball: &Path, sha256: Option<&str>, env: &[String]) -> Result<()> {

    let env_file = image_env_file(env)?;

        }

        if !env_file.is_empty() {

            std::fs::create_dir_all(tree.join("etc/flow"))?;

            std::fs::write(tree.join("etc/flow/env"), &env_file)?;

        let job = &job.in_sandbox(sb).with_flow_env(&[("FLOW_JOB".into(), job.name.clone()), ("FLOW_RUN".into(), "local".into())]);

    }

}

#[cfg(test)]

mod tests {

    use super::image_env_file;

    #[test]

    fn image_environments_are_checked_lines() {

        let f = image_env_file(&["PATH=/opt/bin:/usr/bin".into(), "X16EMU=/opt/x16emu".into(), "EMPTY=".into()]).unwrap();

        assert_eq!(f, "PATH=/opt/bin:/usr/bin\nX16EMU=/opt/x16emu\nEMPTY=\n");

        assert!(image_env_file(&["NOEQUALS".into()]).is_err());

        assert!(image_env_file(&["1X=y".into()]).is_err());

        assert!(image_env_file(&["X=two\nlines".into()]).is_err());

        assert_eq!(image_env_file(&[]).unwrap(), "");

        let job = claim.job.in_sandbox(&claim.sandbox).with_flow_env(&claim.flow_env());

    env { PATH "/opt/tool/bin:/usr/bin:/bin" }  // every job's starting environment

- A sandbox's `env` is where each of its jobs' environments starts; a

  job's own `env` overrides it name by name. It is part of the sandbox's

  canonical form (field 6, present only when set). Below both is the

  image's own environment: `flow rootfs import --env NAME=value`

  (repeatable) writes `/etc/flow/env` into the image, for what a

  Dockerfile's `ENV` sets and `docker export` loses, such as a toolchain's

  `PATH`. It is part of the image, so of its hash. Under all three are

  `PATH` (the usual directories) and `HOME=/tmp`.