offbox 0.1.0__py3-none-any.whl

offbox/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.1.0"
+DEFAULT_IMAGE = "ghcr.io/o-avdieiev/offbox-universal:1"

offbox/__main__.py

@@ -0,0 +1,4 @@
+from offbox.cli import app
+
+if __name__ == "__main__":
+    app()

offbox/_data/host/cloud-init.yaml.j2

@@ -0,0 +1,15 @@
+#cloud-config
+ssh_deletekeys: true
+ssh_genkeytypes: []
+ssh_keys:
+  ed25519_private: {{ private_host_key | tojson }}
+  ed25519_public: {{ public_host_key | tojson }}
+disable_root: true
+ssh_pwauth: false
+write_files:
+  - path: /usr/local/sbin/offbox-host-init
+    owner: root:root
+    permissions: "0700"
+    content: {{ script | tojson }}
+runcmd:
+  - {{ bootstrap_argv | tojson }}

offbox/_data/host/host-init.sh

@@ -0,0 +1,230 @@
+#!/bin/sh
+set -eu
+
+docker_key_fingerprint=9DC858229FC7DD38854AE2D88D81803C0EBFCD88
+stage=preflight
+failure=
+work_dir=
+
+fail() {
+    failure=$1
+    printf 'offbox: %s\n  Fix: %s\n' "$1" "$2" >&2
+    exit 3
+}
+
+cleanup() {
+    result=$?
+    if [ -n "$work_dir" ]; then
+        rm -rf "$work_dir"
+    fi
+    if [ "$result" -ne 0 ]; then
+        if [ -d /var/lib/offbox ] && [ -w /var/lib/offbox ]; then
+            printf 'exit=%s stage=%s %s\n' "$result" "$stage" "$failure" > /var/lib/offbox/failed || :
+        fi
+        if [ "$result" -ne 3 ]; then
+            printf 'offbox: bootstrap failed during %s.\n  Fix: Review the bootstrap log and retry after resolving the failure.\n' "$stage" >&2
+        fi
+    fi
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+apt_get() {
+    apt-get -o DPkg::Lock::Timeout=600 "$@"
+}
+
+[ "$(id -u)" -eq 0 ] || fail 'Bootstrap requires root.' 'Run offbox host init with passwordless sudo access.'
+install -d -m 0755 /var/lib/offbox
+rm -f /var/lib/offbox/ready /var/lib/offbox/failed
+[ "$#" -eq 2 ] || fail 'Expected image and SSH public key arguments.' 'Invoke bootstrap through offbox host create or host init.'
+image=$1
+public_key=$2
+harden=${OFFBOX_HARDEN:-1}
+version=${OFFBOX_VERSION:-}
+case "$harden" in 0|1) ;; *) fail 'Invalid OFFBOX_HARDEN.' 'Use 1 for cloud hosts or 0 for an existing host.' ;; esac
+case "$version" in ''|*[!A-Za-z0-9.+_-]*) fail 'Missing or invalid OFFBOX_VERSION.' 'Pass the installed offbox version through OFFBOX_VERSION.' ;; esac
+case "$image" in ''|-*) fail 'Invalid container image.' 'Pass the configured offbox image.' ;; esac
+case "$public_key" in
+    ssh-ed25519\ *|ssh-rsa\ *|ecdsa-sha2-*\ *|sk-ssh-ed25519@openssh.com\ *|sk-ecdsa-sha2-*\ *) ;;
+    *) fail 'Invalid SSH public key.' 'Select an OpenSSH public key file.' ;;
+esac
+newline='
+'
+carriage_return=$(printf '\r')
+case "$public_key" in *"$newline"*|*"$carriage_return"*) fail 'SSH public key must contain one line.' 'Select a single OpenSSH public key.' ;; esac
+[ -f /etc/os-release ] || fail 'Cannot identify host OS.' 'Use Ubuntu 24.04.'
+os_id=$(awk -F= '$1 == "ID" {gsub(/"/, "", $2); print $2}' /etc/os-release)
+os_version=$(awk -F= '$1 == "VERSION_ID" {gsub(/"/, "", $2); print $2}' /etc/os-release)
+[ "$os_id:$os_version" = ubuntu:24.04 ] || fail 'Host must run Ubuntu 24.04.' 'Use an Ubuntu 24.04 host.'
+
+uid_owner=$(getent passwd 1000 | cut -d: -f1 || true)
+if [ -n "$uid_owner" ] && [ "$uid_owner" != offbox ]; then
+    if [ "$harden" != 1 ] || [ "$uid_owner" != ubuntu ]; then
+        fail "UID 1000 belongs to $uid_owner; refusing to change that account." 'Use a dedicated host with UID 1000 available, or move the account manually before retrying.'
+    fi
+    if pgrep -u ubuntu >/dev/null; then
+        fail 'The default ubuntu account has running processes.' 'Use a fresh cloud host without an active ubuntu session.'
+    fi
+fi
+if id offbox >/dev/null 2>&1; then
+    [ "$(getent passwd offbox | cut -d: -f6)" = /home/offbox ] || fail 'Existing offbox account has an unexpected home directory.' 'Resolve the account configuration before retrying.'
+    [ "$(id -u offbox)" -eq 1000 ] || fail 'Existing offbox account does not have UID 1000.' 'Use a dedicated host or resolve the conflicting offbox account manually.'
+fi
+for package in docker.io docker-compose docker-compose-v2 docker-doc docker-buildx podman-docker containerd runc; do
+    if dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q '^install ok installed$'; then
+        fail "Conflicting package $package is installed." 'Review the existing Docker installation and remove conflicting packages before retrying.'
+    fi
+done
+installed_docker=$(dpkg-query -W -f='${Version}' docker-ce 2>/dev/null || true)
+case "$installed_docker" in ''|5:29.*) ;; *) fail "Existing Docker version $installed_docker differs from required major 29." 'Review and migrate Docker to major 29 before retrying.' ;; esac
+
+work_dir=$(mktemp -d)
+
+install_config() {
+    source_file=$1
+    target_file=$2
+    mode=$3
+    if [ ! -f "$target_file" ] || ! cmp -s "$source_file" "$target_file"; then
+        install -m "$mode" "$source_file" "$target_file"
+        config_changed=1
+    fi
+    chmod "$mode" "$target_file"
+}
+
+printf '%s\n' "$public_key" > "$work_dir/public_key"
+ssh-keygen -lf "$work_dir/public_key" >/dev/null 2>&1 || fail 'SSH public key cannot be parsed.' 'Select a valid OpenSSH public key.'
+
+stage=account
+if [ "$uid_owner" = ubuntu ]; then
+    userdel -r ubuntu
+fi
+if ! getent group offbox >/dev/null; then
+    groupadd offbox
+fi
+if ! id offbox >/dev/null 2>&1; then
+    useradd --uid 1000 --gid offbox --create-home --shell /bin/bash --password '*' offbox
+fi
+usermod --password '*' offbox
+install -d -m 0700 -o offbox -g offbox /home/offbox/.ssh
+printf '%s\n' "$public_key" > "$work_dir/authorized_keys"
+install_config "$work_dir/authorized_keys" /home/offbox/.ssh/authorized_keys 0600
+chown offbox:offbox /home/offbox/.ssh/authorized_keys
+
+stage=packages
+export DEBIAN_FRONTEND=noninteractive
+apt_get update
+apt_get install -y ca-certificates curl sudo jq gpg
+if [ "$harden" = 1 ]; then
+    apt_get install -y ufw fail2ban unattended-upgrades
+fi
+printf 'offbox ALL=(ALL) NOPASSWD:ALL\n' > "$work_dir/sudoers"
+visudo -cf "$work_dir/sudoers"
+install_config "$work_dir/sudoers" /etc/sudoers.d/offbox 0440
+
+if [ "$harden" = 1 ]; then
+    stage=hardening
+    install -d -m 0755 /etc/ssh/sshd_config.d
+    cat > "$work_dir/sshd" <<'SSH'
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitRootLogin no
+AllowUsers offbox
+SSH
+    config_changed=0
+    install_config "$work_dir/sshd" /etc/ssh/sshd_config.d/00-offbox.conf 0644
+    /usr/sbin/sshd -t
+    /usr/sbin/sshd -T > "$work_dir/sshd-effective"
+    for setting in 'passwordauthentication no' 'kbdinteractiveauthentication no' 'permitrootlogin no' 'allowusers offbox'; do
+        grep -qx "$setting" "$work_dir/sshd-effective" || fail 'SSH hardening was overridden by host configuration.' 'Review sshd_config before retrying bootstrap.'
+    done
+    if [ "$config_changed" = 1 ]; then
+        systemctl try-reload-or-restart ssh
+    fi
+    ufw default deny incoming
+    ufw allow 22/tcp
+    ufw --force enable
+    printf '[sshd]\nenabled = true\nbackend = systemd\n' > "$work_dir/fail2ban"
+    config_changed=0
+    install_config "$work_dir/fail2ban" /etc/fail2ban/jail.d/offbox.local 0644
+    systemctl enable --now fail2ban
+    if [ "$config_changed" = 1 ]; then
+        systemctl restart fail2ban
+    fi
+fi
+
+stage=docker
+key_fingerprints() {
+    install -d -m 0700 "$work_dir/gnupg"
+    GNUPGHOME="$work_dir/gnupg" gpg --batch --show-keys --with-colons "$1" 2>/dev/null | awk -F: '$1 == "pub" {primary = 1; next} primary && $1 == "fpr" {print $10; primary = 0}'
+}
+install -d -m 0755 /etc/apt/keyrings
+docker_key=/etc/apt/keyrings/docker.asc
+if [ ! -f "$docker_key" ]; then
+    curl -fsSL --max-time 60 https://download.docker.com/linux/ubuntu/gpg -o "$work_dir/docker.asc"
+    docker_key=$work_dir/docker.asc
+fi
+[ "$(key_fingerprints "$docker_key")" = "$docker_key_fingerprint" ] || fail 'The Docker repository signing key has an unexpected fingerprint.' "Verify $docker_key against Docker's published key $docker_key_fingerprint before retrying."
+if [ "$docker_key" != /etc/apt/keyrings/docker.asc ]; then
+    install_config "$docker_key" /etc/apt/keyrings/docker.asc 0644
+fi
+architecture=$(dpkg --print-architecture)
+cat > "$work_dir/docker.sources" <<APT
+Types: deb
+URIs: https://download.docker.com/linux/ubuntu
+Suites: noble
+Components: stable
+Architectures: $architecture
+Signed-By: /etc/apt/keyrings/docker.asc
+APT
+install_config "$work_dir/docker.sources" /etc/apt/sources.list.d/docker.sources 0644
+cat > "$work_dir/docker.preferences" <<'APT'
+Package: docker-ce docker-ce-cli
+Pin: version 5:29.*
+Pin-Priority: 1001
+APT
+install_config "$work_dir/docker.preferences" /etc/apt/preferences.d/offbox-docker 0644
+apt_get update
+if [ -n "$installed_docker" ]; then
+    docker_version=$installed_docker
+else
+    docker_version=$(apt-cache madison docker-ce | awk '$3 ~ /^5:29[.]/ {print $3; exit}')
+fi
+[ -n "$docker_version" ] || fail 'Docker major 29 is unavailable in the official repository.' 'Check Docker repository access and package availability.'
+set -- "docker-ce=$docker_version" "docker-ce-cli=$docker_version"
+for package in containerd.io docker-buildx-plugin docker-compose-plugin; do
+    if dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q '^install ok installed$'; then
+        set -- "$@" "$package=$(dpkg-query -W -f='${Version}' "$package")"
+    else
+        set -- "$@" "$package"
+    fi
+done
+apt_get install -y "$@"
+usermod -aG docker offbox
+systemctl enable --now docker
+stage=network
+if docker network inspect offbox >/dev/null 2>&1; then
+    subnet=$(docker network inspect --format '{{(index .IPAM.Config 0).Subnet}}' offbox)
+    [ "$subnet" = 10.89.0.0/16 ] || fail 'The existing offbox network has a different subnet.' 'Remove the conflicting offbox network after reviewing its attached containers.'
+else
+    docker network create --label offbox.managed=1 --subnet 10.89.0.0/16 offbox
+fi
+install -d -m 0750 -o offbox -g offbox /srv/offbox/envs
+if [ ! -e /var/lib/offbox/lock ]; then
+    touch /var/lib/offbox/lock
+fi
+chown offbox:offbox /var/lib/offbox/lock
+chmod 0600 /var/lib/offbox/lock
+stage=image
+if ! docker pull -- "$image"; then
+    printf 'offbox: warning: image pull failed; offbox up will retry.\n' >&2
+fi
+if [ "$harden" = 1 ]; then
+    stage=updates
+    printf 'APT::Periodic::Update-Package-Lists "1";\nAPT::Periodic::Unattended-Upgrade "1";\n' > "$work_dir/auto-upgrades"
+    install_config "$work_dir/auto-upgrades" /etc/apt/apt.conf.d/20auto-upgrades 0644
+    systemctl enable --now unattended-upgrades
+fi
+printf '%s\n' "$version" > /var/lib/offbox/version
+touch /var/lib/offbox/ready

offbox/_data/images/universal/Dockerfile

@@ -0,0 +1,101 @@
+# syntax=docker/dockerfile:1
+FROM ubuntu:24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac
+
+ARG TARGETARCH
+ARG NODE_VERSION=22.23.4
+ARG NODE_SHA256=1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce
+ARG GO_VERSION=1.27.3
+ARG GO_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+ARG UV_VERSION=0.13.5
+ARG UV_SHA256=f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f
+ARG BUN_VERSION=1.4.4
+ARG BUN_SHA256=e0446eb55995772eb9894bebae9a6be368d985a8b9271ee124486f9946eedd76
+ARG MISE_VERSION=2026.10.18
+ARG MISE_SHA256=e97c38973336aa2ff350fea50f47b412b266fe263b102b7200ff1e9b118c6942
+ARG RUSTUP_VERSION=1.29.2
+ARG RUSTUP_SHA256=5be191e8c70a5007074254cb74d78dbfdd25cd5a61c27de7b8e5410122ec24f4
+ARG RUST_VERSION=1.99.1
+ARG PLAYWRIGHT_VERSION=1.64.1
+ARG DOCKER_KEY_FINGERPRINT=9DC858229FC7DD38854AE2D88D81803C0EBFCD88
+
+ENV LANG=en_US.UTF-8 \
+    LC_ALL=en_US.UTF-8 \
+    HOME=/home/dev \
+    CARGO_HOME=/home/dev/.cargo \
+    RUSTUP_HOME=/home/dev/.rustup \
+    GOPATH=/home/dev/go \
+    PLAYWRIGHT_BROWSERS_PATH=/home/dev/.cache/ms-playwright \
+    PATH=/home/dev/.local/share/mise/shims:/home/dev/.local/bin:/home/dev/.cargo/bin:/home/dev/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+RUN test "$TARGETARCH" = amd64 \
+    && if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
+    && groupadd --gid 1000 dev \
+    && useradd --uid 1000 --gid 1000 --create-home --shell /bin/bash dev \
+    && apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        build-essential curl wget jq unzip xz-utils make cmake pkg-config ca-certificates git openssh-client \
+        sudo tini locales pipx procps util-linux iptables iproute2 kmod gpg \
+        postgresql-client redis-tools sqlite3 ffmpeg libpq-dev libssl-dev \
+    && locale-gen en_US.UTF-8 \
+    && printf 'dev ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dev \
+    && chmod 0440 /etc/sudoers.d/dev \
+    && install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL --max-time 60 https://download.docker.com/linux/ubuntu/gpg -o /tmp/docker.asc \
+    && docker_key_fingerprints=$(GNUPGHOME=$(mktemp -d) gpg --batch --show-keys --with-colons /tmp/docker.asc | awk -F: '$1 == "pub" {primary = 1; next} primary && $1 == "fpr" {print $10; primary = 0}') \
+    && test "$docker_key_fingerprints" = "$DOCKER_KEY_FINGERPRINT" \
+    && install -m 0644 /tmp/docker.asc /etc/apt/keyrings/docker.asc \
+    && rm /tmp/docker.asc \
+    && printf 'Types: deb\nURIs: https://download.docker.com/linux/ubuntu\nSuites: noble\nComponents: stable\nArchitectures: amd64\nSigned-By: /etc/apt/keyrings/docker.asc\n' > /etc/apt/sources.list.d/docker.sources \
+    && printf 'Package: docker-ce docker-ce-cli\nPin: version 5:29.*\nPin-Priority: 1001\n' > /etc/apt/preferences.d/offbox-docker \
+    && apt-get update \
+    && docker_version=$(apt-cache madison docker-ce | awk '$3 ~ /^5:29[.]/ {print $3; exit}') \
+    && test -n "$docker_version" \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        "docker-ce=$docker_version" "docker-ce-cli=$docker_version" containerd.io docker-buildx-plugin docker-compose-plugin \
+    && usermod -aG docker dev \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSL --retry 3 --max-time 120 "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" -o /tmp/node.tar.xz \
+    && printf '%s  /tmp/node.tar.xz\n' "$NODE_SHA256" | sha256sum -c - \
+    && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \
+    && corepack enable \
+    && curl -fsSL --retry 3 --max-time 120 "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -o /tmp/go.tar.gz \
+    && printf '%s  /tmp/go.tar.gz\n' "$GO_SHA256" | sha256sum -c - \
+    && tar -xzf /tmp/go.tar.gz -C /usr/local \
+    && curl -fsSL --retry 3 --max-time 120 "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz" -o /tmp/uv.tar.gz \
+    && printf '%s  /tmp/uv.tar.gz\n' "$UV_SHA256" | sha256sum -c - \
+    && tar -xzf /tmp/uv.tar.gz -C /tmp \
+    && install -m 0755 /tmp/uv-x86_64-unknown-linux-gnu/uv /tmp/uv-x86_64-unknown-linux-gnu/uvx /usr/local/bin/ \
+    && curl -fsSL --retry 3 --max-time 120 "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64-baseline.zip" -o /tmp/bun.zip \
+    && printf '%s  /tmp/bun.zip\n' "$BUN_SHA256" | sha256sum -c - \
+    && unzip -q /tmp/bun.zip -d /tmp \
+    && install -m 0755 /tmp/bun-linux-x64-baseline/bun /usr/local/bin/bun \
+    && curl -fsSL --retry 3 --max-time 120 "https://github.com/jdx/mise/releases/download/v${MISE_VERSION}/mise-v${MISE_VERSION}-linux-x64" -o /tmp/mise \
+    && printf '%s  /tmp/mise\n' "$MISE_SHA256" | sha256sum -c - \
+    && install -m 0755 /tmp/mise /usr/local/bin/mise \
+    && npx -y "playwright@${PLAYWRIGHT_VERSION}" install-deps chromium \
+    && rm -rf /tmp/node.tar.xz /tmp/go.tar.gz /tmp/uv.tar.gz /tmp/uv-x86_64-unknown-linux-gnu /tmp/bun.zip /tmp/bun-linux-x64-baseline /tmp/mise /home/dev/.npm /var/lib/apt/lists/* \
+    && chown -R dev:dev /home/dev
+
+USER dev
+RUN uv python install 3.13 --default \
+    && uv tool install poetry \
+    && curl -fsSL --retry 3 --max-time 120 "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x86_64-unknown-linux-gnu/rustup-init" -o /tmp/rustup-init \
+    && printf '%s  /tmp/rustup-init\n' "$RUSTUP_SHA256" | sha256sum -c - \
+    && chmod 0755 /tmp/rustup-init \
+    && /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain "$RUST_VERSION" \
+    && rm /tmp/rustup-init \
+    && uv cache clean \
+    && printf '\neval "$(mise activate bash)"\n' >> /home/dev/.bashrc
+
+USER root
+COPY --chmod=0755 images/universal/offbox-init images/universal/offbox-run /usr/local/bin/
+RUN install -d -m 0755 /run/offbox \
+    && install -d -m 0700 -o dev -g dev /run/offbox/exec \
+    && install -d -m 0755 -o dev -g dev /work /home/dev/.cache/ms-playwright \
+    && chown -R dev:dev /home/dev/.cache \
+    && printf 'export PATH="/home/dev/.local/share/mise/shims:/home/dev/.local/bin:/home/dev/.cargo/bin:/home/dev/go/bin:/usr/local/go/bin:$PATH"\n' > /etc/profile.d/offbox-path.sh
+
+WORKDIR /work
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/offbox-init"]

offbox/_data/images/universal/offbox-init

@@ -0,0 +1,75 @@
+#!/bin/sh
+set -eu
+
+fail() {
+    printf 'offbox: %s\n  Fix: Check the privileged container settings and dockerd log.\n' "$1" >&2
+    if [ -f /var/log/dockerd.log ]; then
+        tail -n 40 /var/log/dockerd.log >&2
+    fi
+    exit 1
+}
+
+# Invoked by TERM/INT traps while waiting for dockerd.
+# shellcheck disable=SC2317,SC2329
+stop_daemon() {
+    trap '' TERM INT
+    rm -f /run/offbox/ready
+    if [ -n "$daemon_pid" ]; then
+        kill -TERM "$daemon_pid" 2>/dev/null || :
+        wait "$daemon_pid" || :
+    fi
+    exit 0
+}
+
+daemon_pid=
+trap 'stop_daemon' TERM INT
+
+install -d -m 0755 /etc/docker /run/offbox
+install -d -m 0700 -o dev -g dev /run/offbox/exec
+rm -f /run/offbox/ready /var/run/docker.pid /var/run/docker.sock
+rm -rf /var/run/docker
+cat > /etc/docker/daemon.json <<'JSON'
+{"data-root":"/var/lib/docker","storage-driver":"overlay2","bip":"172.31.0.1/24","default-address-pools":[{"base":"172.30.0.0/16","size":24}],"log-driver":"local"}
+JSON
+
+if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
+    mkdir -p /sys/fs/cgroup/init || fail 'Cannot create the nested cgroup.'
+    processes=$(cat /sys/fs/cgroup/cgroup.procs)
+    for pid in $processes; do
+        if ! printf '%s\n' "$pid" > /sys/fs/cgroup/init/cgroup.procs; then
+            [ ! -e "/proc/$pid" ] || fail 'Cannot move processes into the nested cgroup.'
+        fi
+    done
+    controllers=$(cat /sys/fs/cgroup/cgroup.controllers)
+    for controller in $controllers; do
+        case "$controller" in
+            cpu|memory|pids|io)
+                printf '+%s\n' "$controller" > /sys/fs/cgroup/cgroup.subtree_control || fail 'Cannot enable nested cgroup controllers.'
+                ;;
+        esac
+    done
+fi
+
+log_fifo=/run/offbox/dockerd.log.fifo
+rm -f "$log_fifo"
+mkfifo -m 0600 "$log_fifo"
+awk -v log_file=/var/log/dockerd.log -v limit=10485760 '
+    { print > log_file; fflush(log_file); size += length($0) + 1 }
+    size >= limit { close(log_file); system("mv -f " log_file " " log_file ".1"); size = 0 }
+' < "$log_fifo" &
+dockerd --host=unix:///var/run/docker.sock > "$log_fifo" 2>&1 &
+daemon_pid=$!
+deadline=$(($(date +%s) + 60))
+while [ "$(date +%s)" -lt "$deadline" ]; do
+    kill -0 "$daemon_pid" 2>/dev/null || fail 'The nested Docker daemon exited during startup.'
+    if [ -S /var/run/docker.sock ] && timeout 1 docker --host=unix:///var/run/docker.sock info >/dev/null 2>&1; then
+        touch /run/offbox/ready
+        set +e
+        wait "$daemon_pid"
+        status=$?
+        rm -f /run/offbox/ready
+        exit "$status"
+    fi
+    sleep 1
+done
+fail 'The nested Docker daemon was not ready within 60 seconds.'

offbox/_data/images/universal/offbox-run

@@ -0,0 +1,131 @@
+#!/bin/sh
+set -eu
+umask 077
+
+fail() {
+    printf 'offbox-run: %s\n  Fix: %s\n' "$1" "$2" >&2
+    exit 2
+}
+
+validate_id() {
+    case "$1" in ''|*[!A-Za-z0-9_-]*) fail 'Invalid run ID.' 'Use a unique alphanumeric run ID without path separators.' ;; esac
+    [ "${#1}" -le 64 ] || fail 'Run ID is too long.' 'Use at most 64 characters.'
+}
+
+process_info() {
+    if [ -r "/proc/$1/stat" ]; then
+        sed 's/^.*) //' "/proc/$1/stat" 2>/dev/null | awk '{print $3, $20}'
+    fi
+}
+
+state_dir=/run/offbox/exec
+mkdir -p "$state_dir"
+if [ "${1:-}" = --signal ]; then
+    [ "$#" -eq 3 ] || fail 'Expected --signal SIGNAL ID.' 'Pass INT, TERM or KILL and the recorded run ID.'
+    signal=$2
+    run_id=$3
+    case "$signal" in INT|TERM|KILL) ;; *) fail 'Unsupported signal.' 'Use INT, TERM or KILL.' ;; esac
+    validate_id "$run_id"
+    [ ! -f "$state_dir/$run_id.code" ] || exit 0
+    [ ! -f "$state_dir/$run_id.tty" ] || fail 'External group signaling is unavailable for TTY runs.' 'Use terminal controls for a TTY command.'
+    if [ ! -f "$state_dir/$run_id.pid" ] || [ ! -f "$state_dir/$run_id.start" ]; then
+        fail 'Run metadata is unavailable.' 'Check the run status before retrying.'
+    fi
+    pid=$(cat "$state_dir/$run_id.pid")
+    started=$(cat "$state_dir/$run_id.start")
+    case "$pid:$started" in *[!0-9:]*|:*|*:) fail 'Invalid process metadata.' 'Check the run status before retrying.' ;; esac
+    [ "$pid" -gt 1 ] || fail 'Unsafe process group.' 'Check the run status before retrying.'
+    actual=$(process_info "$pid")
+    [ "$actual" = "$pid $started" ] || fail 'Run process group no longer matches its recorded identity.' 'Check the run status; do not signal a reused PID.'
+    /bin/kill -"$signal" -- "-$pid"
+    exit 0
+fi
+
+tty=0
+if [ "${1:-}" = --tty ]; then
+    tty=1
+    shift
+fi
+[ "$#" -ge 4 ] || fail 'Expected ID CWD -- COMMAND.' 'Pass the run ID, absolute work directory and command argv.'
+run_id=$1
+directory=$2
+shift 2
+[ "$1" = -- ] || fail 'Missing command separator.' 'Put -- before the command argv.'
+shift
+validate_id "$run_id"
+case "$directory" in /*) ;; *) fail 'Work directory must be absolute.' 'Use the mapped /work directory.' ;; esac
+if [ -e "$state_dir/$run_id.pid" ] || [ -e "$state_dir/$run_id.code" ]; then
+    fail 'Run ID already exists.' 'Use a new run ID.'
+fi
+find "$state_dir" -maxdepth 1 -type f -mmin +1440 -print | while IFS= read -r expired; do
+    expired_name=${expired##*/}
+    case "$expired_name" in
+        *.code.tmp) expired_id=${expired_name%.code.tmp} ;;
+        *.code|*.pid|*.start|*.tty) expired_id=${expired_name%.*} ;;
+        *) continue ;;
+    esac
+    case "$expired_id" in ''|*[!A-Za-z0-9_-]*) continue ;; esac
+    if [ -f "$state_dir/$expired_id.code" ] && [ "$expired_name" != "$expired_id.code" ]; then
+        continue
+    fi
+    expired_pid=$(cat "$state_dir/$expired_id.pid" 2>/dev/null || :)
+    expired_start=$(cat "$state_dir/$expired_id.start" 2>/dev/null || :)
+    case "$expired_pid:$expired_start" in
+        *[!0-9:]*|:*|*:) ;;
+        *)
+            expired_identity=$(process_info "$expired_pid")
+            if [ ! -f "$state_dir/$expired_id.code" ] && [ -n "$expired_identity" ] && [ "${expired_identity##* }" = "$expired_start" ]; then
+                continue
+            fi
+            ;;
+    esac
+    rm -f "$state_dir/$expired_id.code" "$state_dir/$expired_id.pid" "$state_dir/$expired_id.start" "$state_dir/$expired_id.tty" "$state_dir/$expired_id.code.tmp"
+done
+cd "$directory" || fail 'Cannot enter the work directory.' 'Flush sync and check that the remote directory exists.'
+child_pid=
+pending_signal=
+forward_signal() {
+    pending_signal=$1
+    if [ -n "$child_pid" ]; then
+        if [ "$tty" = 1 ]; then
+            [ "$1" != INT ] || return 0
+            /bin/kill -s "$1" "$child_pid" 2>/dev/null || :
+        else
+            /bin/kill -"$1" -- "-$child_pid" 2>/dev/null || /bin/kill -s "$1" "$child_pid" 2>/dev/null || :
+        fi
+    fi
+}
+trap 'forward_signal INT' INT
+trap 'forward_signal TERM' TERM
+trap 'forward_signal HUP' HUP
+exec 3<&0
+if [ "$tty" = 1 ]; then
+    touch "$state_dir/$run_id.tty"
+fi
+umask 022
+if [ "$tty" = 1 ]; then
+    env --default-signal=INT,TERM,HUP -- "$@" <&3 3<&- &
+else
+    setsid env --default-signal=INT,TERM,HUP -- "$@" <&3 3<&- &
+fi
+child_pid=$!
+umask 077
+exec 3<&-
+identity=$(process_info "$child_pid")
+printf '%s\n' "${identity##* }" > "$state_dir/$run_id.start"
+printf '%s\n' "$child_pid" > "$state_dir/$run_id.pid"
+if [ -n "$pending_signal" ]; then
+    forward_signal "$pending_signal"
+fi
+while :; do
+    if wait "$child_pid"; then
+        status=0
+    else
+        status=$?
+    fi
+    kill -0 "$child_pid" 2>/dev/null || break
+done
+child_pid=
+printf '%s\n' "$status" > "$state_dir/$run_id.code.tmp"
+mv "$state_dir/$run_id.code.tmp" "$state_dir/$run_id.code"
+exit "$status"

offbox/_data/providers/gcp/.terraform.lock.hcl

@@ -0,0 +1,52 @@
+# Provider checksums for Terraform (registry.terraform.io) and OpenTofu (registry.opentofu.org).
+# Each tool verifies its own registry entry; init drops the other entry from the host workspace copy.
+# Regenerate both with "providers lock" for linux_amd64, linux_arm64, darwin_amd64 and darwin_arm64.
+
+provider "registry.terraform.io/hashicorp/google" {
+  version     = "8.7.0"
+  constraints = ">= 8.7.0, < 8.8.0"
+  hashes = [
+    "h1:cIHzuLy+Umw4IzKl9oZPmPGfiBgvhSjZRodgPtF7xtM=",
+    "h1:jTjjmmzCvAvLSD9MErHVepggzn0/OXoETsmLPNqQrGc=",
+    "h1:r0evOKSNhYYj04qb6VCTVtm7/uWr67jMZ2TsgLubk6o=",
+    "h1:vCPO1IbM2/WfU4R3QYtzxIyM5ZLYL0pgDS8bmap20hI=",
+    "zh:087771b1c22126084ec1ac26272f7e0bce1030bedd9d692b6eef38e6baf5db2e",
+    "zh:4e075872421717124f1a059f80a9cd2a742e868e94ee74546e52494a02f656d2",
+    "zh:5024e53d378a551d354244db25085c2db530dfdd7bdbd3a3df03abdc957a8a20",
+    "zh:52dd649ad0c39f51bf39218e896ced370d4c56d65876715b6c12e2ac17f16f71",
+    "zh:70d6c8f5371a354f8265fe4f2c279e0c2f6a06054538dbe2d92e428692192439",
+    "zh:7aceb5fe517d2dbd270644663a2b237fc3be3e06577a40d2009983b5a5088fcd",
+    "zh:bb3a6fd8f472080f3199e57e61cbbdd253c8210b2b70e6c4e30e06b08c39e7de",
+    "zh:cbd1a1de219397ba98f17203751300433766f5c36953e6aece4a1fb1817638a9",
+    "zh:d12886e54a30e3b6f174f879777616401f8749466443bc6db870eddd42985fa7",
+    "zh:d58a84d3a387c78e8ac58b200ceb51a3e332105a11420f33e03aa69b3ec4449f",
+    "zh:ed11511bc8ee66fbe2d0e6b59f694c127f140cba7ea9654e332c3ebfbdf8bea9",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/google" {
+  version     = "8.7.0"
+  constraints = ">= 8.7.0, < 8.8.0"
+  hashes = [
+    "h1:4f5uR7DRaSDcWTCnI8ESIrjLcWBP6uvveOgb/fdaUq8=",
+    "h1:OTU1cJ4k7eTOT3gXrHqfUKhnr/Tev4kfK3g0s//VhEc=",
+    "h1:WppZq4GTyQzA/OukXL1hxZmzGmvdwfIXPNXQ2j5KeIc=",
+    "h1:dIPWOtPEfzBV/4jfx2DxCHkco5MTHuummMIiryZKSZY=",
+    "zh:008989fe85359406fc8360d22d2b16ed489af46d188c9977240af7728dd213e0",
+    "zh:2517a434f1ba090f3acdb8e4233f7e25c8356e9fb1db3b783aef72a3de8fb3d7",
+    "zh:5e966672da5706954d28a7827301bb6d10a571c008ff2053fb2ac1da6f9c4b64",
+    "zh:5f1a7c5092cb0181e0f8b4ff8292811ac81f4ea653fd0d76c8ae716fa86e4cfc",
+    "zh:9566f745e3cea3fa80f41c9e4c925246362f06a9d57594e0e9898b3f9f371ec2",
+    "zh:964bd33553e43dbd119000bc0e72aae9c5e962d9a5da56691bdb40540df1e555",
+    "zh:96f862ceba3417764985b2aee67ca70bc44ee4c423139ee804e47b0a7c34d877",
+    "zh:a4b8c18426ca672d3928ae7693810afd40805d77d79c7c297d8f7a3ece9236a3",
+    "zh:b76b615ca838bb3f108339d97772ca0cf071b5e2be072ec8ee78f092bab0d65d",
+    "zh:c10933f0e23728a1998583a30d0ccd9c4a09be93230c396a40a7b0bbc6b89e59",
+    "zh:d90496a56ccd9a8a926f8b83bfb27a334efbc98813090898e1ee87bae416e03e",
+    "zh:dbe5e8a6db8dd5c2ec1f15be6648860dd543898eff94d4228bc2929725d7697f",
+    "zh:e4a31b8c8f41530608722b6752a474561b596171ac7828227c99c67cd596764d",
+    "zh:e754176ae7dacfc977393e977e874ed875578271ba6ac47c2e91b9bac07b90b2",
+    "zh:ea30e4a294b6a52641406b2bb49d847f2e253833c2fb425de2e1fd10a532c893",
+  ]
+}