Merge pull request 'Say when the audit is describing the wrong machine' (#6) from container-banner into main

Reviewed-on: #6
Reviewed-by: branderson <brad@branderson.io>

bin/dejima-devbox-audit

@@ -380,7 +380,42 @@ cmd_radius() {
     return 0
 }
 
+# This program describes the machine it runs on. Run inside a container it
+# describes the container, and every reading is real: the gateway is the
+# bridge, the credential is whatever is mounted here, the group memberships
+# are the image's. None of it is about the devbox, and nothing in the output
+# would say so.
+#
+# DETECTED rather than declared, which is the opposite of test/devbox.bats, and
+# the difference is the direction each one fails in. A test that mis-detects
+# skips and reports nothing, so it takes a declared variable. This mis-detects
+# and prints one extra paragraph. Loud and wrong is cheap; quiet and wrong is
+# the thing worth avoiding.
+in_container() {
+    [ -f /.dockerenv ] && return 0
+    [ -f /run/.containerenv ] && return 0
+    grep -qaE 'docker|libpod|containerd' /proc/1/cgroup 2>/dev/null && return 0
+    return 1
+}
+
+# Warn, do not refuse. Someone reading the program's output while developing it
+# has a good reason to be here, and refusing would only teach them to work
+# around the check.
+container_warning() {
+    in_container || return 0
+    say "$PROG: this looks like a container, not a devbox."
+    say ""
+    say "  What follows describes this container. The gateway probed is the"
+    say "  container's own, any credential found is what is mounted here, and"
+    say "  the verdict is about the container's egress rather than the VM's."
+    say ""
+    say "  For a reading about the devbox, install this with"
+    say "  dejima-devbox-bootstrap and run it there. Continuing anyway."
+    say ""
+}
+
 main() {
+    container_warning
     case "${1:-all}" in
         reach)  cmd_reach ;;
         radius) cmd_radius ;;

test/audit.bats

@@ -293,3 +293,39 @@ setup() {
     [[ "$output" != *TOKENMATERIAL* ]]
     [[ "$output" == *"cannot be moved off"* ]]
 }
+
+# --- wrong machine ----------------------------------------------------------
+
+@test "running in a container says so before reporting anything" {
+    in_container() { return 0; }
+    run main radius
+    [[ "$output" == *"container, not a devbox"* ]]
+}
+
+@test "the warning comes before the findings, not after them" {
+    # After the report it is a footnote on conclusions already drawn.
+    in_container() { return 0; }
+    run main radius
+    warn=$(printf '%s\n' "$output" | grep -n "container, not a devbox" | head -1 | cut -d: -f1)
+    first=$(printf '%s\n' "$output" | grep -n "What root on this VM would get" | head -1 | cut -d: -f1)
+    [ -n "$warn" ] && [ -n "$first" ]
+    [ "$warn" -lt "$first" ]
+}
+
+@test "it warns rather than refusing, so a deliberate run still works" {
+    in_container() { return 0; }
+    run main radius
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"What root on this VM would get"* ]]
+}
+
+@test "on a devbox the banner does not appear" {
+    # Matched on the banner's own wording, not on the word "container": the
+    # report says that legitimately in several places, and a test keyed to it
+    # would fail for reasons that have nothing to do with this.
+    in_container() { return 1; }
+    HOME="$BATS_TEST_TMPDIR"
+    run main radius
+    [[ "$output" != *"this looks like a container"* ]]
+    [[ "$output" == *"What root on this VM would get"* ]]
+}