Tunnel token out of the systemd unit's ExecStart: EnvironmentFile or --token-file
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 72/100
Research direction
Start with scripts/setup-peer.sh and scripts/install-lab-tunnel.sh, which write containarium-tunnel.service, then find the daemon's tunnel command and its existing --token-file support from #3629. Update both unit generation paths to read the token from a file with mode 0600. Done when a test confirms the rendered unit contains no token and the token file is 0600.
Written by the indexing model from the issue text.
Description
Finding
The tunnel token is in ExecStart --token ... in containarium-tunnel.service, written by scripts/setup-peer.sh and scripts/install-lab-tunnel.sh. #3654 made the unit 0600, so only root can read it. But the token still appears in the unit's command line, which shows in systemctl cat and process listings for root.
Moving it to a EnvironmentFile (0600) or a --token-file removes it from the unit and the argv.
Acceptance criteria
- The token is not in
ExecStartor the unit file. It is read from anEnvironmentFileor--token-file, and that file is 0600. - The daemon's
tunnelcommand accepts the token from the file (reuses the--token-filepath from #3629). - Test: the rendered unit contains no token; the token file is 0600.
Depends on #3629 (merged): the --token-file flag already exists and is reused here.
Follow-up to #3654.
- Dominant language
- Go
- Stars
- 296
- Forks
- 38
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 648
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from FootprintAI/Containarium
-
model:sonnet runtime:claude security size:S
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
FootprintAI/Containarium#3671 ·
Maintainers usually reply within 1 day
-
model:sonnet runtime:claude security size:S
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
FootprintAI/Containarium#3624 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
FootprintAI/Containarium#2491 ·
Maintainers usually reply within 1 day
-
In-box root chown/mkdir on user-owned paths: decide whether box-internal root is a trust boundaryOpenmodel:sonnet needs-decision runtime:claude security size:M
Difficulty 5/5 Over a week Newbie friendliness 35/100
FootprintAI/Containarium#3670 ·
Maintainers usually reply within 1 day
-
model:sonnet runtime:claude security size:S
Difficulty 3/5 1-2 days Newbie friendliness 68/100
FootprintAI/Containarium#3669 ·
Maintainers usually reply within 1 day
All issues in FootprintAI/Containarium
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 5 days
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
keyxmakerx/Chronicle#2190 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
llm-d/llm-d-inference-sim#897 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
inference-sim/inference-sim#2110 ·
Maintainers usually reply within 1 day
-
backlog
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
EchoTools/nevr-runtime#2385 ·
Maintainers usually reply within 1 day