#!/usr/bin/env bash
# run-arm.sh ARM REP: one run of one arm, inside a container that has no network at all.
#
# The container: --network none (only lo, no routes), not root, every capability dropped, read-only root,
# private tmpfs /tmp holding a throwaway HOME, a fresh random /etc/machine-id, and /etc/resolv.conf pointing
# at the logging fake DNS that inside.py starts. Output lands in $PROBE_RUNS/ARM-rREP/.
#
# Environment: PROBE_WORK, PROBE_PYTHON_DIR, PROBE_IMAGE as in prepare.sh; PROBE_RUNS (default ./runs);
#              PROBE_HOLD seconds the subject stays alive after its work (default 120).
set -euo pipefail
KIT=$(cd "$(dirname "$0")" && pwd)
WORK=${PROBE_WORK:-$KIT/work}
RUNS=${PROBE_RUNS:-$KIT/runs}
IMAGE=${PROBE_IMAGE:-debian:12-slim}
HOLD=${PROBE_HOLD:-120}
CA=/etc/ssl/certs/ca-certificates.crt          # public CA list, so the TLS client behaves as on a host
ARM=${1:?arm}; REP=${2:?rep}

#        arm              venv   mode     subject environment
case "$ARM" in
  ort130-default) VENV=v1300 MODE=default ENVS="" ;;
  ort130-envoff)  VENV=v1300 MODE=default ENVS="ORT_DISABLE_TELEMETRY=1" ;;
  ort130-apioff)  VENV=v1300 MODE=api     ENVS="" ;;
  ort129-default) VENV=v1290 MODE=default ENVS="" ;;
  ort128-default) VENV=v1280 MODE=default ENVS="" ;;
  posctl)         VENV=v1300 MODE=posctl  ENVS="" HOLD=25 ;;
  *) echo "unknown arm: $ARM" >&2; exit 2 ;;
esac

OUT=$RUNS/$ARM-r$REP
mkdir -p "$OUT"
[ -z "$(ls -A "$OUT")" ] || { echo "refusing to overwrite $OUT" >&2; exit 2; }
od -An -tx1 -N16 /dev/urandom | tr -d ' \n' > "$OUT/machine-id"
PREREG=$KIT/../PREREG-probe.md
PREREG_SHA=$( [ -f "$PREREG" ] && sha256sum "$PREREG" | cut -c1-64 || echo none )
PY=${PROBE_PYTHON_DIR:+/probe/python/bin/python3}
PY=${PY:-python3}

rc=0
docker run --rm --name "probe-$ARM-r$REP-$$" --hostname ortprobe-host \
  --network none --user "$(id -u):$(id -g)" --cap-drop ALL --security-opt no-new-privileges \
  --read-only --tmpfs /tmp:rw,mode=1777,size=256m --memory 1g --cpus 2 --pids-limit 512 \
  -v "$KIT:/probe/kit:ro" -v "$WORK:/probe/work:ro" -v "$OUT:/probe/out:rw" \
  -v "$KIT/resolv.conf:/etc/resolv.conf:ro" -v "$OUT/machine-id:/etc/machine-id:ro" \
  $( [ -f "$CA" ] && echo "-v $CA:$CA:ro" ) \
  ${PROBE_PYTHON_DIR:+-v "$PROBE_PYTHON_DIR:/probe/python:ro"} \
  "$IMAGE" "$PY" /probe/kit/inside.py --arm "$ARM" --rep "$REP" --venv "/probe/work/venvs/$VENV" \
  --mode "$MODE" --hold "$HOLD" --prereg-sha256 "$PREREG_SHA" ${ENVS:+--subject-env $ENVS} \
  > "$OUT/harness.log" 2>&1 || rc=$?
echo "exit $rc $ARM r$REP: $(tail -1 "$OUT/harness.log")"
exit $rc