/programs/workerbee/src/incus_config.zig at 37a6756c352b6421455a80e59a1811a45369b7e9

// Copyright 2025 Shota FUJI <pockawoooh@gmail.com>
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: Apache-2.0

const std = @import("std");

const exit = @import("./exit.zig");

const incus = struct {
    const ProxyDevice = struct {
        type: []const u8 = "proxy",
        bind: enum { host, instance } = .instance,
        connect: []const u8,
        gid: []const u8,
        listen: []const u8,
        mode: []const u8,
        @"security.gid": []const u8,
        @"security.uid": []const u8,
        uid: []const u8,
    };

    const DiskDevice = struct {
        type: []const u8 = "disk",
        shift: bool = true,
        source: []const u8,
        path: []const u8,
    };
};

const WaylandSocket = struct {
    host_location: []const u8,
    uid: std.posix.uid_t,
    gid: std.posix.gid_t,
};

const Options = struct {
    /// Project directory to bind mount.
    project_dir: ?[]const u8 = null,

    /// Enable container nesting (only container).
    nesting: bool = true,

    /// Wayland socket to bind.
    wayland_socket: ?WaylandSocket = null,

    const WriteError = std.Io.Writer.Error || std.mem.Allocator.Error;

    fn writeJson(self: *const Options, allocator: std.mem.Allocator, writer: *std.Io.Writer) WriteError!void {
        var json: std.json.Stringify = .{ .writer = writer };

        try json.beginObject();

        try self.writeInstanceConfig(&json);

        try self.writeDevices(allocator, &json);

        try json.endObject();
    }

    fn writeInstanceConfig(self: *const Options, json: *std.json.Stringify) WriteError!void {
        try json.objectField("config");
        try json.beginObject();

        try json.objectField("security.idmap.isolated");
        try json.write(true);

        if (self.nesting) {
            try json.objectField("security.nesting");
            try json.write(true);
        }

        try json.endObject();
    }

    fn writeDevices(self: *const Options, allocator: std.mem.Allocator, json: *std.json.Stringify) WriteError!void {
        try json.objectField("devices");
        try json.beginObject();

        if (self.wayland_socket) |wayland_socket| {
            try json.objectField("wayland-socket");

            const host_address = try std.fmt.allocPrint(allocator, "unix:{s}", .{wayland_socket.host_location});

            try json.write(incus.ProxyDevice{
                .connect = host_address,
                .gid = try std.fmt.allocPrint(allocator, "{d}", .{wayland_socket.gid}),
                .listen = "unix:/mnt/wayland-0",
                .mode = "0700",
                .@"security.gid" = "1000",
                .@"security.uid" = "1000",
                .uid = try std.fmt.allocPrint(allocator, "{d}", .{wayland_socket.uid}),
            });
        }

        if (self.project_dir) |project_dir| {
            try json.objectField("project");
            try json.write(incus.DiskDevice{
                .source = project_dir,
                .path = "/home/workerbee/project",
            });
        }

        try json.endObject();
    }
};

const help =
    \\,workerbee incus config - Print Incus instance configuration to stdout
    \\
    \\[USAGE]
    \\,workerbee incus config <OPTIONS>
    \\
    \\[OPTIONS]
    \\--help             Print this message to stdout and exits.
    \\
    \\--disable-nesting  Disable container features inside the container.
    \\                   Non-Incus sandbox technologies such as Nix and podman
    \\                   won't work when disabled.
    \\
    \\--wayland          Proxy host's Wayland socket to the container,
    \\                   at "/mnt/wayland-0". As this command Wayland socket
    \\                   path and UID of local machine (where the command runs
    \\                   on,) host and local machine MUST be the same.
    \\
    \\--project <PATH>, -p <PATH>
    \\                   Project directory to bind mount. To use this option,
    \\                   host and local machine MUST be the same.
    \\
;

pub fn run(allocator: std.mem.Allocator, args: *std.process.ArgIterator) !exit.Code {
    var options: Options = .{};

    while (args.next()) |arg| {
        if (std.mem.eql(u8, arg, "--help")) {
            var buf: [1024]u8 = undefined;
            var stdout = std.fs.File.stdout().writer(&buf);
            const writer = &stdout.interface;

            writer.writeAll(help) catch return .stdout_write_error;
            writer.flush() catch return .stdout_write_error;
            return .ok;
        }

        if (std.mem.eql(u8, arg, "--disable-nesting")) {
            options.nesting = false;
            continue;
        }

        if (std.mem.eql(u8, arg, "--wayland")) {
            // The current Zig stdlib misses `std.posix.getgid`.
            const gid = std.os.linux.getgid();
            const uid = std.posix.getuid();

            const wayland_display = std.posix.getenv("WAYLAND_DISPLAY") orelse {
                std.log.err("$WAYLAND_DISPLAY is not set", .{});
                return .incorrect_usage;
            };

            if (std.fs.path.isAbsolute(wayland_display)) {
                options.wayland_socket = .{
                    .host_location = wayland_display,
                    .uid = uid,
                    .gid = gid,
                };
                continue;
            }

            const xdg_runtime_dir = std.posix.getenv("XDG_RUNTIME_DIR") orelse {
                std.log.err("$WAYLAND_DISPLAY set to non-absolute path, but $XDG_RUNTIME_DIR is not set", .{});
                return .incorrect_usage;
            };

            const resolved_path = std.fs.path.join(allocator, &.{ xdg_runtime_dir, wayland_display }) catch {
                return .out_of_memory;
            };

            options.wayland_socket = .{
                .host_location = resolved_path,
                .uid = uid,
                .gid = gid,
            };
            continue;
        }

        if (std.mem.eql(u8, arg, "--project") or std.mem.eql(u8, arg, "-p")) {
            const path = args.next() orelse {
                std.log.err("{s} option requires a value", .{arg});
                return .incorrect_usage;
            };

            const realpath = std.fs.cwd().realpathAlloc(allocator, path) catch |err| switch (err) {
                std.mem.Allocator.Error.OutOfMemory => return .out_of_memory,
                else => {
                    std.log.err("Failed to resolve path \"{s}\": {t}", .{ path, err });
                    return .filename_error;
                },
            };

            options.project_dir = realpath;
            continue;
        }

        std.log.err("Unknown option value: {s}", .{arg});
        return .incorrect_usage;
    }

    var output_buffer: [1024]u8 = undefined;
    var output_writer = std.fs.File.stdout().writer(&output_buffer);
    const writer = &output_writer.interface;

    options.writeJson(allocator, writer) catch |err| {
        std.log.err("Failed to write to stdout: {t}", .{err});
        return .stdout_write_error;
    };

    writer.writeByte('\n') catch |err| {
        std.log.err("Failed to write to stdout: {t}", .{err});
        return .stdout_write_error;
    };

    writer.flush() catch |err| {
        std.log.err("Failed to flush write buffer: {t}", .{err});
        return .stdout_write_error;
    };

    return .ok;
}