wbrawner/toolbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Tool for interactive command line environments on Linux
1067 commits 1 branch 0 tags 9.2 MiB
Shell 54.9%
Go 36.1%
Dockerfile 5.8%
Meson 1.9%
Python 0.7%
Other 0.6%
Find a file
Debarshi Ray 7269547af9 cmd/utils: Handle space-separated input when asking for confirmation 
fmt.Scanf [1] is fragile when it comes to space-separated input.  It
stores successive space-separated values into successive arguments as
determined by the format string.  This breaks with untrusted input that
can have an unknown number of space-separated values.

Here are some examples:

  $ toolbox create
  Image required to create toolbox container.
  Download registry.fedoraproject.org/fedora-toolbox:39 (294.8MB)?
    [y/N]: no no not at all
  $ no not at all
  bash: no: command not found...

  $ toolbox create
  Image required to create toolbox container.
  Download registry.fedoraproject.org/fedora-toolbox:39 (294.8MB)?
    [y/N]: foo bar
  Download registry.fedoraproject.org/fedora-toolbox:39 (294.8MB)?
    [y/N]: Download registry.fedoraproject.org/fedora-toolbox:39
    (294.8MB)? [y/N]:

Instead this is what should happen:

  $ toolbox create
  Image required to create toolbox container.
  Download registry.fedoraproject.org/fedora-toolbox:39 (294.8MB)?
    [y/N]: no no not at all
  Download registry.fedoraproject.org/fedora-toolbox:39 (294.8MB)?
    [y/N]: foo bar
  Download registry.fedoraproject.org/fedora-toolbox:39 (294.8MB)?
    [y/N]:

Fallout from 936f22ff15

[1] https://pkg.go.dev/fmt#Scanf

https://github.com/containers/toolbox/pull/1279
2023-03-27 09:28:14 +02:00
.github .github/CODEOWNERS: Clarify ownership of the Toolbx graphics 2023-03-20 15:25:21 +01:00
data build: Replace join_paths with the / operator 2022-10-21 17:24:03 +02:00
doc Deprecate the --monitor-host option of 'init-container' 2023-03-07 15:39:57 +01:00
images images: Don't leak NAME and VERSION into the Toolbx container 2023-03-01 17:06:58 +01:00
playbooks Report the size of the image that will be downloaded from a registry 2023-03-14 01:05:50 +01:00
profile.d Silence SC2295 2022-12-14 23:09:21 +01:00
src cmd/utils: Handle space-separated input when asking for confirmation 2023-03-27 09:28:14 +02:00
test/system test/system: Test 'create' with a RHEL Toolbx container 2023-03-26 10:49:11 +02:00
.codespellexcludefile .codespellexcludefile: Silence false positives 2022-12-14 23:09:21 +01:00
.gitignore test/system: Track bats libs as submodules & install them better 2021-07-22 10:23:53 +02:00
.gitmodules test/system: Track bats libs as submodules & install them better 2021-07-22 10:23:53 +02:00
.mailmap .mailmap: Canonicalize my email 2022-08-01 18:37:43 +02:00
.zuul.yaml .zuul: Enable testing on Fedora 38 2023-03-16 17:57:46 +01:00
CODE-OF-CONDUCT.md Add Code of Conduct 2020-02-12 17:12:23 +01:00
CONTRIBUTING.md Fix spelling mistakes using codespell 2022-11-17 11:56:58 +01:00
COPYING Rename LICENSE as COPYING 2018-10-19 18:24:23 +02:00
gen-docs-list Update copyright notices 2022-11-28 21:01:18 +01:00
GOALS.md GOALS.md: Cosmetics 2021-01-25 21:13:07 +01:00
meson.build Report the size of the image that will be downloaded from a registry 2023-03-14 01:05:50 +01:00
meson_options.txt build: Enable changing the completion paths & drop install_completions 2022-10-21 16:42:29 +02:00
meson_post_install.py build: Skip a needless failure when running systemd-tmpfiles as non-root 2022-10-21 16:45:37 +02:00
NEWS Release 0.0.99.4 2023-02-20 17:02:55 +01:00
README.md README.md: Clarify that Toolbx isn't a security mechanism 2022-11-29 17:46:34 +01:00
SECURITY.md Add Security Policy 2020-05-13 14:37:08 +02:00
toolbox Silence SC2317 2023-01-12 14:41:53 +01:00

README.md

README

Zuul Daily Pipeline

Arch Linux package Fedora package

Toolbox is a tool for Linux, which allows the use of interactive command line environments for development and troubleshooting the host operating system, without having to install software on the host. It is built on top of Podman and other standard container technologies from OCI.

Toolbox environments have seamless access to the user's home directory, the Wayland and X11 sockets, networking (including Avahi), removable devices (like USB sticks), systemd journal, SSH agent, D-Bus, ulimits, /dev and the udev database, etc..

This is particularly useful on OSTree based operating systems like Fedora CoreOS and Silverblue. The intention of these systems is to discourage installation of software on the host, and instead install software as (or in) containers — they mostly don't even have package managers like DNF or YUM. This makes it difficult to set up a development environment or troubleshoot the operating system in the usual way.

Toolbox solves this problem by providing a fully mutable container within which one can install their favourite development and troubleshooting tools, editors and SDKs. For example, it's possible to do yum install ansible without affecting the base operating system.

However, this tool doesn't require using an OSTree based system. It works equally well on Fedora Workstation and Server, and that's a useful way to incrementally adopt containerization.

The toolbox environment is based on an OCI image. On Fedora this is the fedora-toolbox image. This image is used to create a toolbox container that offers the interactive command line environment.

Note that Toolbox makes no promise about security beyond what's already available in the usual command line environment on the host that everybody is familiar with.

Installation & Use

See our guides on installing & getting started with Toolbox and Linux distro support.