1 files changed, 221 insertions, 8 deletions

diff --git a/recipes-containers/vcontainer/files/vrunner.sh b/recipes-containers/vcontainer/files/vrunner.sh
index b6455330..4058fe54 100755
--- a/recipes-containers/vcontainer/files/vrunner.sh
+++ b/recipes-containers/vcontainer/files/vrunner.sh
@@ -38,6 +38,13 @@ TARGET_ARCH="${VDKR_ARCH:-${VPDMN_ARCH:-aarch64}}"
 TIMEOUT="${VDKR_TIMEOUT:-${VPDMN_TIMEOUT:-300}}"
 VERBOSE="${VDKR_VERBOSE:-${VPDMN_VERBOSE:-false}}"
 
+# Registry authentication config file (docker config.json / podman auth.json).
+# Can be set via $VDKR_CONFIG or $VPDMN_CONFIG in the environment, and is
+# overridden by the --config CLI flag below. The file is passed into the guest
+# over a dedicated read-only virtio-9p share and installed into the guest
+# container runtime's credential location by the init script.
+AUTH_CONFIG="${VDKR_CONFIG:-${VPDMN_CONFIG:-}}"
+
 # Runtime-specific settings (set after parsing --runtime)
 set_runtime_config() {
     case "$RUNTIME" in
@@ -232,6 +239,12 @@ OPTIONS:
     --network, -n        Enable networking (slirp user-mode, outbound only)
     --registry <url>     Default registry for unqualified images (e.g., 10.0.2.2:5000/yocto)
     --insecure-registry <host:port>  Mark registry as insecure (HTTP). Can repeat.
+    --config <path>      Path to docker/podman auth config (config.json / auth.json).
+                         Defaults to $VDKR_CONFIG or $VPDMN_CONFIG from environment.
+                         The file is passed to the guest over a dedicated read-only
+                         virtio-9p share and installed at /root/.docker/config.json
+                         (vdkr) or /run/containers/0/auth.json (vpdmn). The host file
+                         must be a regular file with mode 0600 or stricter.
     --interactive, -it   Run in interactive mode (connects terminal to container)
     --timeout <secs>     QEMU timeout [default: 300]
     --idle-timeout <s>   Daemon idle timeout in seconds [default: 1800]
@@ -406,6 +419,13 @@ while [ $# -gt 0 ]; do
             REGISTRY_PASS="$2"
             shift 2
             ;;
+        --config)
+            # Path to a docker/podman config file (config.json / auth.json)
+            # Overrides $VDKR_CONFIG / $VPDMN_CONFIG. The file is mounted into
+            # the guest via a dedicated read-only virtio-9p share.
+            AUTH_CONFIG="$2"
+            shift 2
+            ;;
         --interactive|-it)
             INTERACTIVE="true"
             shift
@@ -587,13 +607,63 @@ daemon_stop() {
     local pid=$(cat "$DAEMON_PID_FILE")
     log "INFO" "Stopping daemon (PID: $pid)..."
 
-    # Send shutdown command via socket
+    # Send shutdown command via socket, then poll until the VM exits.
+    #
+    # The guest's graceful_shutdown() does sync + umount of
+    # /var/lib/containers/storage + blockdev --flushbufs + sync + sleep 2
+    # + reboot -f. Under load (e.g. tens of MB of just-imported layer
+    # blobs awaiting ext4 journal commit) this routinely takes 5-30
+    # seconds. A fixed 2-second wait followed by SIGTERM kills the
+    # guest mid-umount and leaves the state disk's ext4 journal
+    # half-committed: layer files have correct inode metadata but
+    # partially-unwritten data extents, and the next session's reads
+    # hit EOF or CRC failures during tar-split layer reassembly:
+    #
+    #   Error: reading blob sha256:<hash>: EOF
+    #   Error: reading blob sha256:<hash>: file integrity checksum
+    #          failed for "<file>"
     if [ -S "$DAEMON_SOCKET" ]; then
         echo "===SHUTDOWN===" | socat - "UNIX-CONNECT:$DAEMON_SOCKET" 2>/dev/null || true
-        sleep 2
+        # Poll up to 60s (120 * 0.5s). Generous enough to cover heavy
+        # ext4 journal commits; short enough that a truly hung guest
+        # doesn't block the caller indefinitely.
+        for _i in $(seq 1 120); do
+            kill -0 "$pid" 2>/dev/null || break
+            sleep 0.5
+        done
     fi
 
-    # If still running, kill it
+    # If still running after the graceful window, the guest didn't complete
+    # its graceful_shutdown() — meaning the state disk's ext4 journal may
+    # not have committed all pending writes from this session. Any escalation
+    # from here on risks leaving the disk image partially-written: layer
+    # files with correct inode metadata but unwritten data extents, which
+    # surface as "reading blob ...: EOF" or "file integrity checksum failed"
+    # errors on the *next* session's reads. Warn loudly so the operator can
+    # decide whether to start the next session with `memres restart --clean`.
+    if kill -0 "$pid" 2>/dev/null; then
+        log "WARN" "Guest did not exit within graceful window — state disk integrity may be compromised."
+        log "WARN" "If subsequent sessions report 'reading blob ...: EOF' or 'file integrity checksum failed',"
+        log "WARN" "discard state with: ${VCONTAINER_RUNTIME_NAME:-vrunner} memres restart --clean"
+    fi
+
+    # If still running after the graceful window, escalate via QMP quit.
+    # Functionally similar to SIGTERM at the QEMU-process level (both
+    # converge on qemu_system_killed and a block-layer flush), but goes
+    # through QEMU's monitor interface — the same path hv_idle_shutdown()
+    # uses. Keeps the two escalation paths consistent.
+    if kill -0 "$pid" 2>/dev/null; then
+        local qmp_sock="$DAEMON_SOCKET_DIR/qmp.sock"
+        if [ -S "$qmp_sock" ]; then
+            log "INFO" "Sending QMP quit..."
+            echo '{"execute":"qmp_capabilities"}{"execute":"quit"}' | \
+                socat - "UNIX-CONNECT:$qmp_sock" >/dev/null 2>&1 || true
+            sleep 2
+        fi
+    fi
+
+    # If QMP quit didn't take (or no QMP socket — older configs), fall
+    # back to SIGTERM.
     if kill -0 "$pid" 2>/dev/null; then
         log "INFO" "Sending SIGTERM..."
         kill "$pid" 2>/dev/null || true
@@ -847,6 +917,124 @@ fi
 TEMP_DIR="${TMPDIR:-/tmp}/vdkr-$$"
 mkdir -p "$TEMP_DIR"
 
+# ============================================================================
+# Registry auth config (docker config.json / podman auth.json)
+# ============================================================================
+# The AUTH_CONFIG path (from $VDKR_CONFIG, $VPDMN_CONFIG, or --config) points
+# to a file containing container-registry credentials. For defence-in-depth we:
+#   * reject non-regular files (symlinks, devices, directories)
+#   * reject files readable by group/other (mode must be <= 0600)
+#   * warn if the file is not owned by the invoking user
+#   * copy it into a private per-invocation directory under $TEMP_DIR at 0400
+#   * expose it to the guest via a *separate* read-only virtio-9p tag
+#     ("${TOOL_NAME}_auth") mounted at /mnt/auth (not the generic /mnt/share
+#     which holds input/output and is wiped between daemon commands)
+#   * never pass the file contents or path on the kernel cmdline; only a flag
+#     "${CMDLINE_PREFIX}_auth=1" to tell the init script to look at /mnt/auth
+#   * rely on the existing $TEMP_DIR EXIT/INT/TERM trap to delete the copy
+#
+# The auth file is never logged (path is visible, but contents are not).
+AUTH_SHARE_DIR=""
+
+validate_auth_config() {
+    local path="$1"
+
+    # Resolve symlinks to the canonical path so the perm check applies to the
+    # actual file, but still require the *named* path to be a regular file
+    # (not a symlink pointing into sensitive areas like /proc/self/environ).
+    if [ -L "$path" ]; then
+        log "ERROR" "--config must not be a symlink: $path"
+        return 1
+    fi
+    if [ ! -e "$path" ]; then
+        log "ERROR" "--config file not found: $path"
+        return 1
+    fi
+    if [ ! -f "$path" ]; then
+        log "ERROR" "--config must be a regular file: $path"
+        return 1
+    fi
+    if [ ! -r "$path" ]; then
+        log "ERROR" "--config file is not readable: $path"
+        return 1
+    fi
+
+    # Size sanity: docker config.json / podman auth.json should be small.
+    # 1 MiB is already generous. Reject unusually large files to avoid
+    # accidentally shipping a large credential blob.
+    local size
+    size=$(stat -c %s "$path" 2>/dev/null || echo 0)
+    if [ "$size" -gt 1048576 ]; then
+        log "ERROR" "--config file is too large ($size bytes, max 1 MiB): $path"
+        return 1
+    fi
+    # Minimum valid JSON object "{}" is 2 bytes. Anything smaller (including a
+    # 0-byte truncation or a lone newline from "echo '' > file") can't be a
+    # real auth config; reject rather than silently shipping garbage.
+    if [ "$size" -lt 2 ]; then
+        log "ERROR" "--config file is empty or too small to be valid JSON: $path"
+        return 1
+    fi
+
+    # Permission check: must not be readable by group or world.
+    local mode
+    mode=$(stat -c %a "$path" 2>/dev/null || echo 0)
+    # stat %a emits octal without leading zero. Forbid any group/other bits.
+    case "$mode" in
+        400|600|200) ;;
+        *)
+            log "ERROR" "--config file has unsafe permissions ($mode); expected 0600 or 0400."
+            log "ERROR" "Fix with: chmod 600 \"$path\""
+            return 1
+            ;;
+    esac
+
+    # Ownership check: warn if file is not owned by the current user.
+    local uid owner
+    uid=$(id -u)
+    owner=$(stat -c %u "$path" 2>/dev/null || echo "")
+    if [ -n "$owner" ] && [ "$owner" != "$uid" ]; then
+        log "WARN" "--config file is not owned by current user (uid=$uid, owner=$owner)"
+    fi
+
+    return 0
+}
+
+# Stage the auth config into a dedicated read-only 9p share. Must be called
+# AFTER $TEMP_DIR exists and AFTER hypervisor backend functions are sourced.
+# Sets $AUTH_SHARE_DIR and appends to $HV_OPTS / $KERNEL_APPEND.
+setup_auth_share() {
+    [ -z "$AUTH_CONFIG" ] && return 0
+
+    if ! validate_auth_config "$AUTH_CONFIG"; then
+        log "ERROR" "Refusing to stage $AUTH_CONFIG — see above."
+        exit 1
+    fi
+
+    AUTH_SHARE_DIR="$TEMP_DIR/auth_share"
+    # 0700 so nothing outside our process can peek at the staged file.
+    mkdir -p "$AUTH_SHARE_DIR"
+    chmod 700 "$AUTH_SHARE_DIR"
+
+    # Always stage as config.json regardless of source filename — the guest
+    # init script knows to look for this fixed name.
+    if ! cp "$AUTH_CONFIG" "$AUTH_SHARE_DIR/config.json"; then
+        log "ERROR" "Failed to stage auth config"
+        exit 1
+    fi
+    chmod 400 "$AUTH_SHARE_DIR/config.json"
+
+    local auth_tag="${TOOL_NAME}_auth"
+    hv_build_9p_opts "$AUTH_SHARE_DIR" "$auth_tag" "readonly=on"
+    KERNEL_APPEND="$KERNEL_APPEND ${CMDLINE_PREFIX}_auth=1"
+
+    # Deliberately log the *fact* of staging, not the path contents or
+    # credentials. The path itself is useful for debugging and appears in
+    # --verbose mode only.
+    log "INFO" "Registry auth config staged on read-only 9p share (tag=$auth_tag)"
+    log "DEBUG" "Auth source: $AUTH_CONFIG"
+}
+
 cleanup() {
     if [ "$KEEP_TEMP" = "true" ]; then
         log "DEBUG" "Keeping temp directory: $TEMP_DIR"
@@ -956,11 +1144,15 @@ if [ "$BATCH_IMPORT" = "true" ]; then
         fi
     done
 
-    # Add final images command to show what was imported
+    # Show what was imported (informational only).
+    # IMPORTANT: Must not use 'exit' — the command runs inside PID 1 init's
+    # eval, and exit kills init → kernel panic. The import chain runs in a
+    # subshell so its exit code is captured without risk. The images listing
+    # is best-effort and doesn't affect the result.
     if [ "$RUNTIME" = "docker" ]; then
-        COMPOUND_CMD="$COMPOUND_CMD && docker images"
+        COMPOUND_CMD="( $COMPOUND_CMD ); docker images 2>/dev/null; true"
     else
-        COMPOUND_CMD="$COMPOUND_CMD && podman images"
+        COMPOUND_CMD="( $COMPOUND_CMD ); podman images 2>/dev/null; true"
     fi
 
     log "DEBUG" "Batch command: $COMPOUND_CMD"
@@ -1306,6 +1498,10 @@ if [ "$DAEMON_MODE" = "start" ]; then
         log "DEBUG" "CA certificate copied to shared folder"
     fi
 
+    # Stage registry auth config (config.json / auth.json) on a dedicated
+    # read-only 9p share. See setup_auth_share() for the security model.
+    setup_auth_share
+
     log "INFO" "Starting daemon..."
     log "DEBUG" "PID file: $DAEMON_PID_FILE"
     log "DEBUG" "Socket: $DAEMON_SOCKET"
@@ -1361,7 +1557,18 @@ if [ "$DAEMON_MODE" = "start" ]; then
         # Set up port forwards via backend (e.g., iptables for Xen)
         hv_setup_port_forwards
 
-        # Start host-side idle watchdog if timeout is set
+        # Start host-side idle watchdog if timeout is set.
+        #
+        # The watchdog is a long-running background subshell that outlives
+        # vrunner.sh itself. It MUST fully detach from the invoking shell's
+        # stdio: when the caller (e.g. the vdkr CLI, or a test harness that
+        # wraps vdkr in subprocess.run(capture_output=True)) reads
+        # stdout/stderr via pipes, any inherited write-end fd in the
+        # watchdog keeps those pipes open and blocks the caller's
+        # communicate()/read until the daemon is stopped (up to
+        # IDLE_TIMEOUT, default 30 minutes). Redirect all three fds so the
+        # watchdog holds no descriptors from the caller, and disown it so
+        # the shell's job table doesn't retain it either.
         if [ "$IDLE_TIMEOUT" -gt 0 ] 2>/dev/null; then
             ACTIVITY_FILE="$DAEMON_SOCKET_DIR/activity"
             touch "$ACTIVITY_FILE"
@@ -1395,7 +1602,8 @@ if [ "$DAEMON_MODE" = "start" ]; then
                         exit 0
                     fi
                 done
-            ) &
+            ) </dev/null >/dev/null 2>&1 &
+            disown $! 2>/dev/null || true
             log "DEBUG" "Started host-side idle watchdog (timeout: ${IDLE_TIMEOUT}s)"
         fi
 
@@ -1423,6 +1631,11 @@ if [ -n "$CA_CERT" ] && [ -f "$CA_CERT" ]; then
     log "DEBUG" "CA certificate available via 9p"
 fi
 
+# Stage registry auth config (config.json / auth.json) on a dedicated read-only
+# 9p share for non-daemon and batch-import modes. Safe to call when AUTH_CONFIG
+# is empty — it no-ops. See setup_auth_share() for the security model.
+setup_auth_share
+
 log "INFO" "Starting VM ($VCONTAINER_HYPERVISOR)..."
 
 # Interactive mode runs VM in foreground with stdio connected