feat: Sanitize environment variables (#1192)

Added strip function to remove whitespace and quotes.

.devcontainer.json

@@ -1,6 +0,0 @@
-{
-  "name": "dsm",
-  "service": "dsm",
-  "forwardPorts": [5000],
-  "dockerComposeFile": "compose.yml"
-}

.devcontainer/codespaces.yml

@@ -0,0 +1,19 @@
+services:
+  dsm:
+    container_name: dsm
+    image: ghcr.io/vdsm/virtual-dsm
+    environment:
+      RAM_SIZE: "half"
+      DISK_SIZE: "max"
+      CPU_CORES: "max"
+    devices:
+      - /dev/kvm
+      - /dev/net/tun
+    cap_add:
+      - NET_ADMIN
+    ports:
+      - 5000:5000
+    volumes:
+      - ./dsm:/storage
+    restart: on-failure
+    stop_grace_period: 2m

.devcontainer/devcontainer.json

@@ -0,0 +1,15 @@
+{
+  "name": "Virtual DSM",
+  "service": "dsm",
+  "forwardPorts": [5000],
+  "portsAttributes": {
+    "5000": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "codespaces.yml"
+}

.dockerignore

@@ -1,4 +1,5 @@
 .dockerignore
+.devcontainer
 .git
 .github
 .gitignore

.github/workflows/build.yml

@@ -22,13 +22,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       -
         name: Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           context: git
           images: |
@@ -43,23 +43,23 @@ jobs:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       - 
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login into Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true

.github/workflows/check.yml

@@ -7,9 +7,10 @@ jobs:
     name: shellcheck
     runs-on: ubuntu-latest
     steps:
-      - 
+    - 
-        name: Checkout
+      name: Checkout
-        uses: actions/checkout@v5
+      uses: actions/checkout@v7
+    - parallel:
       -
         name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
@@ -22,3 +23,8 @@ jobs:
           dockerfile: Dockerfile
           ignore: DL3008,DL3003,DL3006,DL3013
           failure-threshold: warning
+      -
+        name: Validate JSON and YML files
+        uses: GrantBirki/json-yaml-validate@v5.0.0
+        with:
+          yaml_exclude_regex: ".*\\kubernetes\\.yml$"

.github/workflows/hub.yml

@@ -12,13 +12,15 @@ jobs:
   dockerHubDescription:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+      -
-    - 
+        name: Checkout repo
-      name: Docker Hub Description
+        uses: actions/checkout@v7
-      uses: peter-evans/dockerhub-description@v5
+      - 
-      with:
+        name: Docker Hub Description
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        uses: peter-evans/dockerhub-description@v5
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
+        with:
-        repository: ${{ secrets.DOCKERHUB_REPO }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
-        short-description: ${{ github.event.repository.description }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
-        readme-filepath: ./readme.md
+          repository: ${{ secrets.DOCKERHUB_REPO }}
+          short-description: ${{ github.event.repository.description }}
+          readme-filepath: ./readme.md

.github/workflows/review.yml

@@ -0,0 +1,71 @@
+on:
+  pull_request:
+
+name: "Review"
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  review:
+    name: review
+    runs-on: ubuntu-latest
+    steps:
+    -
+      name: Checkout
+      uses: actions/checkout@v7
+    - parallel:
+      -
+        name: Spelling
+        uses: reviewdog/action-misspell@v1
+        with:
+          locale: "US"
+          level: warning
+          pattern: |
+            *.md
+            *.sh
+          reporter: github-pr-review
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Hadolint
+        uses: reviewdog/action-hadolint@v1
+        with:
+          level: warning
+          fail_level: error
+          reporter: github-pr-review
+          hadolint_ignore: DL3008 DL3003 DL3006 DL3013
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: YamlLint
+        uses: reviewdog/action-yamllint@v1
+        with:
+          level: warning
+          reporter: github-pr-review
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: ActionLint
+        uses: reviewdog/action-actionlint@v1
+        with:
+          level: warning
+          reporter: github-pr-review
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Shellformat
+        uses: reviewdog/action-shfmt@v1
+        if: false
+        with:
+          level: warning
+          fail_on_error: "true"
+          shfmt_flags: "-i 2 -ci -bn"
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Shellcheck
+        uses: reviewdog/action-shellcheck@v1
+        with:
+          level: warning
+          fail_level: error
+          reporter: github-pr-review
+          shellcheck_flags: -x -e SC1091 -e SC2001 -e SC2034 -e SC2064 -e SC2317 -e SC2153 -e SC2028
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -1,11 +1,6 @@
 on:
   workflow_dispatch:
   pull_request:
-    paths:
-      - '**/*.sh'
-      - 'Dockerfile'
-      - '.github/workflows/test.yml'
-      - '.github/workflows/check.yml'
 
 name: "Test"
 permissions: {}

Dockerfile

@@ -1,19 +1,13 @@
 # syntax=docker/dockerfile:1
 
 FROM qemux/qemu-host:2.05 AS builder
-
-#  FROM golang as builder
-#  WORKDIR /
-#  RUN git clone https://github.com/qemus/qemu-host.git
-#  WORKDIR /qemu-host/src
-#  RUN go mod download
-#  RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o /qemu-host.bin .
-
 FROM debian:trixie-slim
 
 ARG TARGETARCH
 ARG TARGETPLATFORM
 ARG VERSION_ARG="0.0"
+ARG VERSION_PASST="2026_06_11"
+
 ARG DEBCONF_NOWARNINGS="yes"
 ARG DEBIAN_FRONTEND="noninteractive"
 ARG DEBCONF_NONINTERACTIVE_SEEN="true"
@@ -37,17 +31,19 @@ RUN set -eu && \
         xz-utils \
         iptables \
         iproute2 \
-        apt-utils \
         dnsmasq \
         fakeroot \
+        apt-utils \
         net-tools \
         e2fsprogs \
         qemu-utils \
+        websocketd \
         iputils-ping \
+        inotify-tools \
         ca-certificates \
         netcat-openbsd \
         qemu-system-x86 && \
-    wget "https://github.com/qemus/passt/releases/download/v2025_09_19/passt_2025_09_19_${TARGETARCH}.deb" -O /tmp/passt.deb -q && \
+    wget "https://github.com/qemus/passt/releases/download/v${VERSION_PASST}/passt_${VERSION_PASST}_${TARGETARCH}.deb" -O /tmp/passt.deb -q --timeout=10 && \
     dpkg -i /tmp/passt.deb && \
     apt-get clean && \
     pip3 install --no-cache-dir --break-system-packages --root-user-action=ignore dissect.cstruct && \
@@ -55,7 +51,7 @@ RUN set -eu && \
     echo "allow br0" > /etc/qemu/bridge.conf && \
     unlink /etc/nginx/sites-enabled/default && \
     sed -i 's/^worker_processes.*/worker_processes 1;/' /etc/nginx/nginx.conf && \
-    echo "$VERSION_ARG" > /run/version && \
+    echo "$VERSION_ARG" > /etc/version && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 COPY --chmod=755 ./src /run/

readme.md

@@ -18,11 +18,11 @@ Virtual DSM in a Docker container.
 
  - Multiple disks
  - KVM acceleration
- - Upgrades supported
+ - Automatic download
- 
+
 ## Usage  🐳
 
-##### Via Docker Compose:
+##### Docker Compose:
 
 ```yaml
 services:
@@ -44,22 +44,31 @@ services:
     stop_grace_period: 2m
 ```
 
-##### Via Docker CLI:
+##### Docker CLI:
 
 ```bash
-docker run -it --rm --name dsm -e "DISK_SIZE=256G" -p 5000:5000 --device=/dev/kvm --device=/dev/net/tun --cap-add NET_ADMIN -v "${PWD:-.}/dsm:/storage" --stop-timeout 120 vdsm/virtual-dsm
+docker run -it --rm --name dsm -e "DISK_SIZE=256G" -p 5000:5000 --device=/dev/kvm --device=/dev/net/tun --cap-add NET_ADMIN -v "${PWD:-.}/dsm:/storage" --stop-timeout 120 docker.io/vdsm/virtual-dsm
 ```
 
-##### Via Kubernetes:
+##### Kubernetes:
 
 ```shell
 kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/master/kubernetes.yml
 ```
 
-##### Via Github Codespaces:
+##### GitHub Codespaces:
 
 [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/vdsm/virtual-dsm)
 
+## Requirements ⚙️
+
+ - A Linux host with KVM support, or Docker Desktop / Podman on Windows 11 with nested virtualization enabled.
+ - At least 2 GB of RAM available.
+ - At least 32 GB of free disk space.
+
+> [!NOTE]
+> Docker Desktop on macOS and Windows 10 do not currently provide the required KVM support for this image.
+
 ## FAQ 💬
 
 ### How do I use it?
@@ -95,7 +104,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
   ```
   
 > [!TIP]
-> This can also be used to resize the existing disk to a larger capacity without any data loss.
+> This can also be used to resize an existing disk to a larger capacity without any data loss.
 
 ### How do I add multiple disks?
 
@@ -110,9 +119,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - ./example3:/storage3
   ```
 
-### How do I pass-through a disk?
+### How do I pass through a disk?
 
-   It is possible to pass-through disk devices or partitions directly by adding them to your compose file in this way:
+   You can pass through disk devices or partitions directly by adding them to your compose file in this way:
 
   ```yaml
   devices:
@@ -124,7 +133,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
 ### How do I change the amount of CPU or RAM?
 
-  By default, the container will be allowed to use a maximum of 2 CPU cores and 2 GB of RAM.
+  By default, Virtual DSM will be allowed to use 2 CPU cores and 2 GB of RAM.
 
   If you want to adjust this, you can specify the desired amount using the following environment variables:
 
@@ -158,7 +167,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
   - you enabled "nested virtualization" if you are running the container inside a virtual machine.
 
-  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPS's.
+  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPSs.
 
   If you did not receive any error from `kvm-ok` but the container still complains about a missing KVM device, it could help to add `privileged: true` to your compose file (or `sudo` to your `docker` command) to rule out any permission issue.
 
@@ -214,9 +223,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - 'c *:* rwm'
   ```
 
-### How do I pass-through the GPU?
+### How do I pass through the GPU?
 
-  To pass-through your Intel GPU, add the following lines to your compose file:
+  To pass through your Intel GPU, add the following lines to your compose file:
 
   ```yaml
   environment:
@@ -254,12 +263,12 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
 ### Is this project legal?
 
-  Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project will be considered legal. 
+  Yes, this project contains only open-source code and does not distribute any material owned by Synology. Neither does it try to circumvent any copyright protection measures.
   
   However, by installing Synology's Virtual DSM, you must accept their end-user license agreement, which does not permit installation on non-Synology hardware. So only run this container on an official Synology NAS, as any other use will be a violation of their terms and conditions.
 
 ## Stars 🌟
-[![Stars](https://starchart.cc/vdsm/virtual-dsm.svg?variant=adaptive)](https://starchart.cc/vdsm/virtual-dsm)
+[![Stargazers](https://raw.githubusercontent.com/star-stats/stars/refs/heads/data/charts/vdsm-virtual-dsm.svg)](https://github.com/vdsm/virtual-dsm/stargazers)
 
 ## Disclaimer ⚖️
 

src/check.sh

@@ -4,15 +4,15 @@ set -Eeuo pipefail
 : "${DHCP:="N"}"
 : "${NETWORK:="Y"}"
 
-[ -f "/run/shm/qemu.end" ] && echo "QEMU is shutting down.." && exit 1
+[ -f "/run/shm/qemu.end" ] && echo "QEMU is shutting down..." && exit 1
-[ ! -s "/run/shm/qemu.pid" ] && echo "QEMU is not running yet.." && exit 0
+[ ! -s "/run/shm/qemu.pid" ] && echo "QEMU is not running yet..." && exit 0
-[[ "$NETWORK" == [Nn]* ]] && echo "Networking is disabled.." && exit 0
+[[ "$NETWORK" == [Nn]* ]] && echo "Networking is disabled." && exit 0
 
 file="/run/shm/dsm.url"
 address="/run/shm/qemu.ip"
 gateway="/run/shm/qemu.gw"
 
-[ ! -s  "$file" ] && echo "DSM has not enabled networking yet.." && exit 1
+[ ! -s  "$file" ] && echo "DSM has not enabled networking yet..." && exit 1
 
 location=$(<"$file")
 

src/config.sh

@@ -3,6 +3,7 @@ set -Eeuo pipefail
 
 DEF_OPTS="-nodefaults -boot strict=on"
 RAM_OPTS=$(echo "-m ${RAM_SIZE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
+MON_OPTS="-name $PROCESS,process=$PROCESS,debug-threads=on -pidfile $QEMU_PID"
 CPU_OPTS="-cpu $CPU_FLAGS -smp $CPU_CORES,sockets=1,dies=1,cores=$CPU_CORES,threads=1"
 MAC_OPTS="-machine type=q35,smm=off,usb=off,vmport=off,dump-guest-core=off,hpet=off${KVM_OPTS}"
 DEV_OPTS="-device virtio-balloon-pci,id=balloon0,bus=pcie.0,addr=0x4"
@@ -12,32 +13,4 @@ DEV_OPTS+=" -device virtio-rng-pci,rng=objrng0,id=rng0,bus=pcie.0,addr=0x1c"
 ARGS="$DEF_OPTS $CPU_OPTS $RAM_OPTS $MAC_OPTS $DISPLAY_OPTS $MON_OPTS $SERIAL_OPTS $NET_OPTS $DISK_OPTS $DEV_OPTS $ARGUMENTS"
 ARGS=$(echo "$ARGS" | sed 's/\t/ /g' | tr -s ' ')
 
-# Check available memory as the very last step
-
-if [[ "$RAM_CHECK" != [Nn]* ]]; then
-
-  RAM_AVAIL=$(free -b | grep -m 1 Mem: | awk '{print $7}')
-  AVAIL_MEM=$(formatBytes "$RAM_AVAIL")
-
-  if (( (RAM_WANTED + RAM_SPARE) > RAM_AVAIL )); then
-    msg="Your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is too high for the $AVAIL_MEM of memory available, please set a lower value."
-    [[ "${FS,,}" != "zfs" ]] && error "$msg" && exit 17
-    info "$msg"
-  else
-    if (( (RAM_WANTED + (RAM_SPARE * 3)) > RAM_AVAIL )); then
-      msg="your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is very close to the $AVAIL_MEM of memory available, please consider a lower value."
-      if [[ "${FS,,}" != "zfs" ]]; then
-        warn "$msg"
-      else
-        info "$msg"
-      fi
-    fi
-  fi
-
-fi
-
-if [[ "$DEBUG" == [Yy1]* ]]; then
-  printf "QEMU arguments:\n\n%s\n\n" "${ARGS// -/$'\n-'}"
-fi
-
 return 0

src/disk.sh

@@ -11,14 +11,31 @@ set -Eeuo pipefail
 : "${DISK_DISCARD:="on"}"         # Controls whether unmap (TRIM) commands are passed to the host.
 : "${DISK_ROTATION:="1"}"         # Rotation rate, set to 1 for SSD storage and increase for HDD
 
+# Sanitize all variables
+DISK_IO=$(strip "$DISK_IO")
+DISK_FMT=$(strip "$DISK_FMT")
+DISK_TYPE=$(strip "$DISK_TYPE")
+DISK_FLAGS=$(strip "$DISK_FLAGS")
+DISK_CACHE=$(strip "$DISK_CACHE")
+DISK_DISCARD=$(strip "$DISK_DISCARD")
+DISK_ROTATION=$(strip "$DISK_ROTATION")
+
 BOOT="$STORAGE/$BASE.boot.img"
 SYSTEM="$STORAGE/$BASE.system.img"
 
 [ ! -s "$BOOT" ] && error "Virtual DSM boot-image does not exist ($BOOT)" && exit 81
 [ ! -s "$SYSTEM" ] && error "Virtual DSM system-image does not exist ($SYSTEM)" && exit 82
 
+if ! setOwner "$BOOT"; then
+  error "Failed to set the owner for \"$BOOT\" !"
+fi
+
+if ! setOwner "$SYSTEM"; then
+  error "Failed to set the owner for \"$SYSTEM\" !"
+fi
+
 fmt2ext() {
-  local DISK_FMT=$1
+  local DISK_FMT="$1"
 
   case "${DISK_FMT,,}" in
     qcow2)
@@ -34,7 +51,7 @@ fmt2ext() {
 }
 
 ext2fmt() {
-  local DISK_EXT=$1
+  local DISK_EXT="$1"
 
   case "${DISK_EXT,,}" in
     qcow2)
@@ -50,7 +67,7 @@ ext2fmt() {
 }
 
 getSize() {
-  local DISK_FILE=$1
+  local DISK_FILE="$1"
   local DISK_EXT DISK_FMT
 
   DISK_EXT=$(echo "${DISK_FILE//*./}" | sed 's/^.*\.//')
@@ -70,7 +87,7 @@ getSize() {
 }
 
 isCow() {
-  local FS=$1
+  local FS="$1"
 
   if [[ "${FS,,}" == "btrfs" ]]; then
     return 0
@@ -80,7 +97,7 @@ isCow() {
 }
 
 supportsDirect() {
-  local FS=$1
+  local FS="$1"
 
   if [[ "${FS,,}" == "ecryptfs" || "${FS,,}" == "tmpfs" ]]; then
     return 1
@@ -91,18 +108,18 @@ supportsDirect() {
 
 createDisk() {
 
-  local DISK_FILE=$1
+  local DISK_FILE="$1"
-  local DISK_SPACE=$2
+  local DISK_SPACE="$2"
-  local DISK_DESC=$3
+  local DISK_DESC="$3"
-  local DISK_FMT=$4
+  local DISK_FMT="$4"
-  local FS=$5
+  local FS="$5"
   local DATA_SIZE DIR SPACE GB FA
 
-  DATA_SIZE=$(numfmt --from=iec "$DISK_SPACE")
-
   rm -f "$DISK_FILE"
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  DATA_SIZE=$(numfmt --from=iec "$DISK_SPACE")
+
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -113,6 +130,7 @@ createDisk() {
       error "Not enough free space to create a $DISK_DESC of ${DISK_SPACE/G/ GB} in $DIR, it has only $GB available..."
       error "Please specify a smaller ${DISK_DESC^^}_SIZE or disable preallocation by setting ALLOCATE=N." && exit 76
     fi
+
   fi
 
   html "Creating a $DISK_DESC image..."
@@ -130,7 +148,7 @@ createDisk() {
         { chattr +C "$DISK_FILE"; } || :
       fi
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Create an empty file
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -177,19 +195,19 @@ createDisk() {
 
 resizeDisk() {
 
-  local DISK_FILE=$1
+  local DISK_FILE="$1"
-  local DISK_SPACE=$2
+  local DISK_SPACE="$2"
-  local DISK_DESC=$3
+  local DISK_DESC="$3"
-  local DISK_FMT=$4
+  local DISK_FMT="$4"
-  local FS=$5
+  local FS="$5"
   local CUR_SIZE DATA_SIZE DIR SPACE GB
 
   CUR_SIZE=$(getSize "$DISK_FILE")
   DATA_SIZE=$(numfmt --from=iec "$DISK_SPACE")
-  local REQ=$((DATA_SIZE-CUR_SIZE))
+  local REQ=$(( DATA_SIZE - CUR_SIZE ))
   (( REQ < 1 )) && error "Shrinking disks is not supported yet, please increase ${DISK_DESC^^}_SIZE." && exit 71
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -200,6 +218,7 @@ resizeDisk() {
       error "Not enough free space to resize $DISK_DESC to ${DISK_SPACE/G/ GB} in $DIR, it has only $GB available.."
       error "Please specify a smaller ${DISK_DESC^^}_SIZE or disable preallocation by setting ALLOCATE=N." && exit 74
     fi
+
   fi
 
   GB=$(formatBytes "$CUR_SIZE")
@@ -211,7 +230,7 @@ resizeDisk() {
   case "${DISK_FMT,,}" in
     raw)
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Resize file by changing its length
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -245,26 +264,28 @@ resizeDisk() {
 
 convertDisk() {
 
-  local SOURCE_FILE=$1
+  local SOURCE_FILE="$1"
-  local SOURCE_FMT=$2
+  local SOURCE_FMT="$2"
-  local DST_FILE=$3
+  local DST_FILE="$3"
-  local DST_FMT=$4
+  local DST_FMT="$4"
-  local DISK_BASE=$5
+  local DISK_BASE="$5"
-  local DISK_DESC=$6
+  local DISK_DESC="$6"
-  local FS=$7
+  local FS="$7"
 
   [ -f "$DST_FILE" ] && error "Conversion failed, destination file $DST_FILE already exists?" && exit 79
-  [ ! -f "$SOURCE_FILE" ] && error "Conversion failed, source file $SOURCE_FILE does not exists?" && exit 79
+  [ ! -f "$SOURCE_FILE" ] && error "Conversion failed, source file $SOURCE_FILE does not exist?" && exit 79
 
   local TMP_FILE="$DISK_BASE.tmp"
   rm -f "$TMP_FILE"
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  local DIR FA
+  DIR=$(dirname "$TMP_FILE")
 
-    local DIR CUR_SIZE SPACE GB
+  if ! disabled "$ALLOCATE"; then
+
+    local CUR_SIZE SPACE GB
 
     # Check free diskspace
-    DIR=$(dirname "$TMP_FILE")
     CUR_SIZE=$(getSize "$SOURCE_FILE")
     SPACE=$(df --output=avail -B 1 "$DIR" | tail -n 1)
 
@@ -273,6 +294,7 @@ convertDisk() {
       error "Not enough free space to convert $DISK_DESC to $DST_FMT in $DIR, it has only $GB available..."
       error "Please free up some disk space or disable preallocation by setting ALLOCATE=N." && exit 76
     fi
+
   fi
 
   local msg="Converting $DISK_DESC to $DST_FMT"
@@ -284,7 +306,7 @@ convertDisk() {
   isCow "$FS" && DISK_PARAM+=",nocow=on"
 
   if [[ "$DST_FMT" != "raw" ]]; then
-    if [[ "$ALLOCATE" == [Nn]* ]]; then
+    if disabled "$ALLOCATE"; then
       CONV_FLAGS+=" -c"
     fi
     [ -n "$DISK_FLAGS" ] && DISK_PARAM+=",$DISK_FLAGS"
@@ -297,7 +319,7 @@ convertDisk() {
   fi
 
   if [[ "$DST_FMT" == "raw" ]]; then
-    if [[ "$ALLOCATE" != [Nn]* ]]; then
+    if ! disabled "$ALLOCATE"; then
       # Work around qemu-img bug
       CUR_SIZE=$(stat -c%s "$TMP_FILE")
       if ! fallocate -l "$CUR_SIZE" "$TMP_FILE" &>/dev/null; then
@@ -327,31 +349,31 @@ convertDisk() {
 
 checkFS () {
 
-  local FS=$1
+  local FS="$1"
-  local DISK_FILE=$2
+  local DISK_FILE="$2"
-  local DISK_DESC=$3
+  local DISK_DESC="$3"
   local DIR FA
 
   DIR=$(dirname "$DISK_FILE")
   [ ! -d "$DIR" ] && return 0
 
-  if [[ "${FS,,}" == "overlay"* ]]; then
+  if [[ "${FS,,}" == "overlay"* && "${ENGINE,,}" == "docker" ]]; then
-    info "Warning: the filesystem of $DIR is OverlayFS, this usually means it was binded to an invalid path!"
+    warn "the filesystem of $DIR is OverlayFS, this usually means it was binded to an invalid path!"
   fi
 
   if [[ "${FS,,}" == "fuse"* ]]; then
-    info "Warning: the filesystem of $DIR is FUSE, this extra layer will negatively affect performance!"
+    warn "the filesystem of $DIR is FUSE, this extra layer will negatively affect performance!"
   fi
 
   if ! supportsDirect "$FS"; then
-    info "Warning: the filesystem of $DIR is $FS, which does not support O_DIRECT mode, adjusting settings..."
+    warn "the filesystem of $DIR is $FS, which does not support O_DIRECT mode, adjusting settings..."
   fi
 
   if isCow "$FS"; then
     if [ -f "$DISK_FILE" ]; then
       FA=$(lsattr "$DISK_FILE")
       if [[ "$FA" != *"C"* ]]; then
-        info "Warning: COW (copy on write) is not disabled for $DISK_DESC image file $DISK_FILE, this is recommended on ${FS^^} filesystems!"
+        warn "COW (copy on write) is not disabled for $DISK_DESC image file $DISK_FILE, this is recommended on ${FS^^} filesystems!"
       fi
     fi
   fi
@@ -361,15 +383,15 @@ checkFS () {
 
 createDevice () {
 
-  local DISK_FILE=$1
+  local DISK_FILE="$1"
-  local DISK_TYPE=$2
+  local DISK_TYPE="$2"
-  local DISK_INDEX=$3
+  local DISK_INDEX="$3"
-  local DISK_ADDRESS=$4
+  local DISK_ADDRESS="$4"
-  local DISK_FMT=$5
+  local DISK_FMT="$5"
-  local DISK_IO=$6
+  local DISK_IO="$6"
-  local DISK_CACHE=$7
+  local DISK_CACHE="$7"
-  local DISK_SERIAL=$8
+  local DISK_SERIAL="$8"
-  local DISK_SECTORS=$9
+  local DISK_SECTORS="$9"
   local DISK_ID="data$DISK_INDEX"
 
   local index=""
@@ -413,18 +435,32 @@ createDevice () {
   return 0
 }
 
+finishDisks () {
+
+  case "${DISK_TYPE,,}" in
+    "blk" | "scsi" | "virtio-blk" | "virtio-scsi" )
+      DISK_OPTS+=" -object iothread,id=io2" ;;
+  esac
+
+  if ! enabled "$DISK_DISABLE"; then
+    html "Initialized disks successfully..."
+  fi
+
+  return 0
+}
+
 addDisk () {
 
-  local DISK_BASE=$1
+  local DISK_BASE="$1"
-  local DISK_TYPE=$2
+  local DISK_TYPE="$2"
-  local DISK_DESC=$3
+  local DISK_DESC="$3"
-  local DISK_SPACE=$4
+  local DISK_SPACE="$4"
-  local DISK_INDEX=$5
+  local DISK_INDEX="$5"
-  local DISK_ADDRESS=$6
+  local DISK_ADDRESS="$6"
-  local DISK_FMT=$7
+  local DISK_FMT="$7"
-  local DISK_IO=$8
+  local DISK_IO="$8"
-  local DISK_CACHE=$9
+  local DISK_CACHE="$9"
-  local DISK_EXT DIR SPACE DATA_SIZE FS PREV_FMT PREV_EXT CUR_SIZE
+  local DISK_EXT DIR SPACE GB DATA_SIZE FS PREV_FMT PREV_EXT CUR_SIZE LEFT FREE USED
 
   DISK_EXT=$(fmt2ext "$DISK_FMT")
   local DISK_FILE="$DISK_BASE.$DISK_EXT"
@@ -432,8 +468,25 @@ addDisk () {
   DIR=$(dirname "$DISK_FILE")
   [ ! -d "$DIR" ] && return 0
 
+  if [[ "${DISK_SPACE,,}" == "max" || "${DISK_SPACE,,}" == "half" ]]; then
+
+    local SPARE=1073741824
+    FREE=$(df --output=avail -B 1 "$DIR" | tail -n 1)
+
+    if [[ "${DISK_SPACE,,}" == "max" ]]; then
+      FREE=$(( FREE - SPARE ))
+    else
+      FREE=$(( FREE / 2 ))
+    fi
+
+    (( FREE < SPARE )) && FREE="$SPARE"
+    GB=$(( FREE / 1073741825 ))
+    DISK_SPACE="${GB}G"
+
+  fi
+
   SPACE="${DISK_SPACE// /}"
-  [ -z "$SPACE" ] && SPACE="16G"
+  [ -z "$SPACE" ] && SPACE="256G"
   [ -z "${SPACE//[0-9. ]}" ] && SPACE="${SPACE}G"
   SPACE=$(echo "${SPACE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
 
@@ -444,7 +497,7 @@ addDisk () {
   DATA_SIZE=$(numfmt --from=iec "$SPACE")
 
   if (( DATA_SIZE < 6442450944 )); then
-    error "Please increase ${DISK_DESC^^}_SIZE to at least 6 GB." && exit 73
+    error "Please increase the ${DISK_DESC^^}_SIZE variable to at least 6 GB." && exit 73
   fi
 
   FS=$(stat -f -c %T "$DIR")
@@ -455,7 +508,7 @@ addDisk () {
     DISK_CACHE="writeback"
   fi
 
-  if ! [ -s "$DISK_FILE" ] ; then
+  if [ ! -s "$DISK_FILE" ] ; then
 
     if [[ "${DISK_FMT,,}" != "raw" ]]; then
       PREV_FMT="raw"
@@ -468,6 +521,7 @@ addDisk () {
     if [ -s "$DISK_BASE.$PREV_EXT" ] ; then
       convertDisk "$DISK_BASE.$PREV_EXT" "$PREV_FMT" "$DISK_FILE" "$DISK_FMT" "$DISK_BASE" "$DISK_DESC" "$FS" || exit $?
     fi
+
   fi
 
   if [ -s "$DISK_FILE" ]; then
@@ -475,7 +529,18 @@ addDisk () {
     CUR_SIZE=$(getSize "$DISK_FILE")
 
     if (( DATA_SIZE > CUR_SIZE )); then
+
       resizeDisk "$DISK_FILE" "$SPACE" "$DISK_DESC" "$DISK_FMT" "$FS" || exit $?
+
+    else
+
+      if (( DATA_SIZE < CUR_SIZE )); then
+
+        if [[ "${DISK_SPACE,,}" != "max" && "${DISK_SPACE,,}" != "half" ]]; then
+          info "You decreased the ${DISK_DESC^^}_SIZE variable to ${DISK_SPACE/G/ GB} but shrinking disks is not supported, will be ignored..."
+        fi
+
+      fi
     fi
 
   else
@@ -484,6 +549,38 @@ addDisk () {
 
   fi
 
+  if [ -f "$DISK_FILE" ] && disabled "$ALLOCATE"; then
+
+    CUR_SIZE=$(getSize "$DISK_FILE")
+    USED=$(du -sB 1 "$DISK_FILE" | cut -f1)
+    FREE=$(df --output=avail -B 1 "$DIR" | tail -n 1)
+    LEFT=$(( CUR_SIZE - USED - FREE ))
+
+    if (( LEFT > 0 )); then
+
+      GB=$(formatBytes "$FREE")
+      LEFT=$(formatBytes "$LEFT")
+      CUR_SIZE=$(formatBytes "$CUR_SIZE")
+      msg="The virtual size of the ${DISK_DESC,,} is $CUR_SIZE"
+
+      if [ -n "$USED" ] && [[ "$USED" != "0" ]]; then
+        USED=$(formatBytes "$USED")
+        msg+=" (of which $USED is used)"
+      fi
+
+      info "$msg, but there is only $GB of free space remaining in $DIR now."
+      info "Please consider making at least $LEFT more space available in $DIR for future expansions."
+
+    fi
+
+  fi
+
+  if [ -f "$DISK_FILE" ]; then
+    if ! setOwner "$DISK_FILE"; then
+      error "Failed to set the owner for \"$DISK_FILE\" !"
+    fi
+  fi
+
   DISK_OPTS+=$(createDevice "$DISK_FILE" "$DISK_TYPE" "$DISK_INDEX" "$DISK_ADDRESS" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" "" "")
 
   return 0
@@ -491,27 +588,34 @@ addDisk () {
 
 addDevice () {
 
-  local DISK_DEV=$1
+  local DISK_DEV="$1"
-  local DISK_TYPE=$2
+  local DISK_TYPE="$2"
-  local DISK_INDEX=$3
+  local DISK_INDEX="$3"
-  local DISK_ADDRESS=$4
+  local DISK_ADDRESS="$4"
 
   [ -z "$DISK_DEV" ] && return 0
   [ ! -b "$DISK_DEV" ] && error "Device $DISK_DEV cannot be found! Please add it to the 'devices' section of your compose file." && exit 55
 
   local sectors=""
-  local result logical physical
+  local dev_type=""
-  result=$(fdisk -l "$DISK_DEV" | grep -m 1 -o "(logical/physical): .*" | cut -c 21-)
+  dev_type=$(lsblk -no TYPE "$DISK_DEV" 2>/dev/null | head -n1)
-  logical="${result%% *}"
-  physical=$(echo "$result" | grep -m 1 -o "/ .*" | cut -c 3-)
-  physical="${physical%% *}"
 
-  if [ -n "$physical" ]; then
+  # Only detect and apply sector sizes for partitions, not whole disks
-    if [[ "$physical" != "512" ]]; then
+  # Whole disk passthrough with explicit sector sizes causes DSM not to recognize the disk
-      sectors=",logical_block_size=$logical,physical_block_size=$physical"
+  if [[ "$dev_type" == "part" ]]; then
+    local result logical physical
+    result=$(fdisk -l "$DISK_DEV" | grep -m 1 -o "(logical/physical): .*" | cut -c 21-)
+    logical="${result%% *}"
+    physical=$(echo "$result" | grep -m 1 -o "/ .*" | cut -c 3-)
+    physical="${physical%% *}"
+
+    if [ -n "$physical" ]; then
+      if [[ "$physical" != "512" ]]; then
+        sectors=",logical_block_size=$logical,physical_block_size=$physical"
+      fi
+    else
+      warn "Failed to determine the sector size for $DISK_DEV"
     fi
-  else
-    warn "Failed to determine the sector size for $DISK_DEV"
   fi
 
   DISK_OPTS+=$(createDevice "$DISK_DEV" "$DISK_TYPE" "$DISK_INDEX" "$DISK_ADDRESS" "raw" "$DISK_IO" "$DISK_CACHE" "" "$sectors")
@@ -519,13 +623,16 @@ addDevice () {
   return 0
 }
 
-msg="Initializing disks..."
-html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
-
 [ -z "${DISK_OPTS:-}" ] && DISK_OPTS=""
 [ -z "${DISK_TYPE:-}" ] && DISK_TYPE="scsi"
 [ -z "${DISK_NAME:-}" ] && DISK_NAME="data"
+[ -z "${DISK_DISABLE:-}" ] && DISK_DISABLE=""
+
+if ! enabled "$DISK_DISABLE"; then
+  msg="Initializing disks..."
+  html "$msg"
+  enabled "$DEBUG" && echo "$msg"
+fi
 
 case "${DISK_TYPE,,}" in
   "ide" | "sata" | "nvme" | "usb" | "scsi" | "blk" | "auto" | "none" ) ;;
@@ -536,7 +643,7 @@ if [ -z "$ALLOCATE" ]; then
   ALLOCATE="N"
 fi
 
-if [[ "$ALLOCATE" == [Nn]* ]]; then
+if disabled "$ALLOCATE"; then
   DISK_STYLE="growable"
   DISK_ALLOC="preallocation=off"
 else
@@ -547,38 +654,14 @@ fi
 DISK_OPTS+=$(createDevice "$BOOT" "$DISK_TYPE" "1" "0xa" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 DISK_OPTS+=$(createDevice "$SYSTEM" "$DISK_TYPE" "2" "0xb" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 
+if enabled "$DISK_DISABLE"; then
+  finishDisks
+  return 0
+fi
+
 DISK1_FILE="$STORAGE/${DISK_NAME}"
-if [ ! -f "$DISK1_FILE.img" ] && [ -f "$STORAGE/data${DISK_SIZE}.img" ]; then
-  # Fallback for legacy installs
-  mv "$STORAGE/data${DISK_SIZE}.img" "$DISK1_FILE.img"
-fi
-
 DISK2_FILE="/storage2/${DISK_NAME}2"
-if [ ! -f "$DISK2_FILE.img" ]; then
-  # Fallback for legacy installs
-  FALLBACK="/storage2/data.img"
-  if [[ -f "$DISK1_FILE.img" && -f "$FALLBACK" ]]; then
-    SIZE1=$(stat -c%s "$FALLBACK")
-    SIZE2=$(stat -c%s "$DISK1_FILE.img")
-    if [[ SIZE1 -ne SIZE2 ]]; then
-      mv "$FALLBACK" "$DISK2_FILE.img"
-    fi
-  fi
-fi
-
 DISK3_FILE="/storage3/${DISK_NAME}3"
-if [ ! -f "$DISK3_FILE.img" ]; then
-  # Fallback for legacy installs
-  FALLBACK="/storage3/data.img"
-  if [[ -f "$DISK1_FILE.img" && -f "$FALLBACK" ]]; then
-    SIZE1=$(stat -c%s "$FALLBACK")
-    SIZE2=$(stat -c%s "$DISK1_FILE.img")
-    if [[ SIZE1 -ne SIZE2 ]]; then
-      mv "$FALLBACK" "$DISK3_FILE.img"
-    fi
-  fi
-fi
-
 DISK4_FILE="/storage4/${DISK_NAME}4"
 
 : "${DISK2_SIZE:=""}"
@@ -625,7 +708,6 @@ else
   addDisk "$DISK4_FILE" "$DISK_TYPE" "disk4" "$DISK4_SIZE" "6" "0xf" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" || exit $?
 fi
 
-DISK_OPTS+=" -object iothread,id=io2"
+finishDisks
 
-html "Initialized disks successfully..."
 return 0

src/display.sh

@@ -8,9 +8,14 @@ set -Eeuo pipefail
 : "${DISPLAY:="none"}"  # Display type
 : "${RENDERNODE:="/dev/dri/renderD128"}"  # Render node
 
+# Sanitize variables
+VGA=$(strip "$VGA")
+DISPLAY=$(strip "$DISPLAY")
+RENDERNODE=$(strip "$RENDERNODE")
+
 CPU_VENDOR=$(lscpu | awk '/Vendor ID/{print $3}')
 
-if [[ "$GPU" != [Yy1]* || "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
+if ! enabled "$GPU" || [[ "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
 
   [[ "${DISPLAY,,}" == "none" ]] && VGA="none"
   DISPLAY_OPTS="-display $DISPLAY -vga $VGA"
@@ -20,7 +25,7 @@ fi
 
 msg="Configuring display drivers..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 DISPLAY_OPTS="-display egl-headless,rendernode=$RENDERNODE"
 DISPLAY_OPTS+=" -vga $VGA"

src/entry.sh

@@ -1,14 +1,16 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+: "${PLATFORM:="x64"}"
 : "${APP:="Virtual DSM"}"
 : "${SUPPORT:="https://github.com/vdsm/virtual-dsm"}"
 
 cd /run
 
-. start.sh      # Placeholder
+. start.sh      # Startup hook
 . utils.sh      # Load functions
 . reset.sh      # Initialize system
+. server.sh     # Start webserver
 . install.sh    # Run installation
 . disk.sh       # Initialize disks
 . display.sh    # Initialize graphics
@@ -16,23 +18,29 @@ cd /run
 . proc.sh       # Initialize processor
 . serial.sh     # Initialize serialport
 . power.sh      # Configure shutdown
+. memory.sh     # Check available memory
 . config.sh     # Configure arguments
+. finish.sh     # Finish initialization
 
 trap - ERR
 
-version=$(qemu-system-x86_64 --version | head -n 1 | cut -d '(' -f 1 | awk '{ print $NF }')
+cmd=(qemu-system-x86_64)
+version=$("${cmd[@]}" --version | awk 'NR==1 { print $4 }')
 info "Booting $APP using QEMU v$version..."
 
-if [[ "$CONSOLE" == [Yy]* ]]; then
+if ! enabled "$SHUTDOWN"; then
-  exec qemu-system-x86_64 ${ARGS:+ $ARGS}
+  exec "${cmd[@]}" ${ARGS:+ $ARGS}
 fi
 
-{ qemu-system-x86_64 ${ARGS:+ $ARGS} >"$QEMU_OUT" 2>"$QEMU_LOG"; rc=$?; } || :
+if [ ! -t 1 ] || [ ! -c /dev/tty ]; then
-(( rc != 0 )) && error "$(<"$QEMU_LOG")" && exit 15
+  "${cmd[@]}" ${ARGS:+ $ARGS} &
+else
+  "${cmd[@]}" ${ARGS:+ $ARGS} </dev/tty >/dev/tty &
+fi
 
-terminal
+rc=0
-tail -fn +0 "$QEMU_LOG" 2>/dev/null &
+wait $! || rc=$?
-cat "$QEMU_TERM" 2>/dev/null & wait $! || :
+[ -f "$QEMU_END" ] && exit "$rc"
 
 sleep 1 & wait $!
-[ ! -f "$QEMU_END" ] && finish 0
+finish "$rc"

src/finish.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+if enabled "$DEBUG"; then
+  printf "QEMU arguments:\n\n%s\n\n" "${ARGS// -/$'\n-'}"
+fi
+
+return 0

src/install.sh

@@ -27,11 +27,12 @@ FILE=$(find / -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ ! -s "$FILE" ] && FILE=$(find "$STORAGE" -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ -s "$FILE" ] && BASE="DSM_VirtualDSM" && URL="file://$FILE" 
 
+URL=$(strip "$URL")
+
 if [ -n "$URL" ] && [ ! -s "$FILE" ] && [ ! -d "$DIR" ]; then
   BASE=$(basename "$URL" .pat)
   if [ ! -s "$STORAGE/$BASE.system.img" ]; then
     BASE=$(basename "${URL%%\?*}" .pat)
-    BASE="${BASE//+/ }"
     printf -v BASE '%b' "${BASE//%/\\x}"
     BASE="${BASE//[!A-Za-z0-9._-]/_}"
   fi
@@ -66,7 +67,6 @@ fi
 
 if [ ! -s "$FILE" ]; then
   BASE=$(basename "${URL%%\?*}" .pat)
-  BASE="${BASE//+/ }"
   printf -v BASE '%b' "${BASE//%/\\x}"
   BASE="${BASE//[!A-Za-z0-9._-]/_}"
 fi
@@ -82,16 +82,16 @@ rm -f "$STORAGE/$BASE.system.img"
 # Check filesystem
 FS=$(stat -f -c %T "$STORAGE")
 
-if [[ "${FS,,}" == "overlay"* ]]; then
+if [[ "${FS,,}" == "overlay"* && "${ENGINE,,}" == "docker" ]]; then
-  info "Warning: the filesystem of $STORAGE is OverlayFS, this usually means it was binded to an invalid path!"
+  warn "the filesystem of $STORAGE is OverlayFS, this usually means it was binded to an invalid path!"
 fi
 
 if [[ "${FS,,}" == "fuse"* ]]; then
-  info "Warning: the filesystem of $STORAGE is FUSE, this extra layer will negatively affect performance!"
+  warn "the filesystem of $STORAGE is FUSE, this extra layer will negatively affect performance!"
 fi
 
 if [[ "${FS,,}" == "ecryptfs" || "${FS,,}" == "tmpfs" ]]; then
-  info "Warning: the filesystem of $STORAGE is $FS, which does not support O_DIRECT mode, adjusting settings..."
+  warn "the filesystem of $STORAGE is $FS, which does not support O_DIRECT mode, adjusting settings..."
 fi
 
 if [[ "${FS,,}" == "fat"* || "${FS,,}" == "vfat"* || "${FS,,}" == "msdos"* ]]; then
@@ -100,6 +100,10 @@ fi
 
 if [[ "${FS,,}" != "exfat"* && "${FS,,}" != "ntfs"* && "${FS,,}" != "unknown"* ]]; then
   TMP="$STORAGE/tmp"
+  rm -rf "$TMP"
+  if ! makeDir "$TMP"; then
+    error "Failed to create directory \"$TMP\" !" && exit 93
+  fi
 else
   TMP="/tmp/dsm"
   TMP_SPACE=2147483648
@@ -108,10 +112,9 @@ else
   if (( TMP_SPACE > SPACE )); then
     error "Not enough free space inside the container, have $SPACE_MB available but need at least 2 GB." && exit 93
   fi
+  rm -rf "$TMP" && mkdir -p "$TMP"
 fi
 
-rm -rf "$TMP" && mkdir -p "$TMP"
-
 # Check free diskspace
 ROOT_SPACE=536870912
 SPACE=$(df --output=avail -B 1 / | tail -n 1)
@@ -224,6 +227,8 @@ if ! touch "$SYSTEM"; then
   error "Could not create file $SYSTEM for the system disk." && exit 98
 fi
 
+! setOwner "$SYSTEM" && error "Failed to set the owner for \"$SYSTEM\" !"
+
 if [[ "${FS,,}" == "btrfs" ]]; then
   { chattr +C "$SYSTEM"; } || :
   FA=$(lsattr "$SYSTEM")
@@ -256,7 +261,11 @@ PART="$TMP/partition.fdisk"
 sfdisk -q "$SYSTEM" < "$PART"
 
 MOUNT="$TMP/system"
-rm -rf "$MOUNT" && mkdir -p "$MOUNT"
+rm -rf "$MOUNT"
+
+if ! makeDir "$MOUNT"; then
+  error "Failed to create directory \"$MOUNT\" !" && exit 93
+fi
 
 MSG="Extracting system partition..."
 info "Install: $MSG" && html "$MSG"
@@ -291,6 +300,7 @@ fakeroot -- bash -c "set -Eeu;\
 
 rm -rf "$MOUNT"
 echo "$BASE" > "$STORAGE/dsm.ver"
+! setOwner "$STORAGE/dsm.ver" && error "Failed to set the owner for \"$STORAGE/dsm.ver\" !"
 
 if [[ "$URL" == "file://$STORAGE/$BASE.pat" ]]; then
   rm -f "$PAT"
@@ -298,10 +308,13 @@ else
   mv -f "$PAT" "$STORAGE/$BASE.pat"
 fi
 
+if [ -f "$STORAGE/$BASE.pat" ]; then
+  ! setOwner "$STORAGE/$BASE.pat" && error "Failed to set the owner for \"$STORAGE/$BASE.pat\" !"
+fi
+
 mv -f "$BOOT" "$STORAGE/$BASE.boot.img"
+! setOwner "$STORAGE/$BASE.boot.img" && error "Failed to set the owner for \"$STORAGE/$BASE.boot.img\" !"
+
 rm -rf "$TMP"
 
-html "Booting DSM instance..."
-sleep 1.2
-
 return 0

src/memory.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+msg="Checking memory..."
+enabled "$DEBUG" && echo "$msg"
+
+RAM_AVAIL=$(free -b | grep -m 1 Mem: | awk '{print $7}')
+AVAIL_MEM=$(formatBytes "$RAM_AVAIL")
+
+if ! disabled "$RAM_CHECK" && [[ "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
+
+  wanted=$(numfmt --from=iec "$RAM_SIZE")
+
+  if (( (wanted + RAM_SPARE) > RAM_AVAIL )); then
+    msg="Your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is too high for the $AVAIL_MEM of free memory available,"
+    if [[ "${FS,,}" == "zfs" ]]; then
+      info "$msg but since ZFS is active this will be ignored."
+    else
+      RAM_SIZE="max"
+      warn "$msg it will automatically be adjusted to a lower amount."
+    fi
+  else
+    if (( (wanted + (RAM_SPARE * 3)) > RAM_AVAIL )); then
+      msg="your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is very close to the $AVAIL_MEM of free memory available,"
+      if [[ "${FS,,}" == "zfs" ]]; then
+        info "$msg but since ZFS is active this will be ignored."
+      else
+        warn "$msg please consider a lower amount."
+      fi
+    fi
+  fi
+
+fi
+
+if [[ "${RAM_SIZE,,}" == "half" ]]; then
+
+  if (( (RAM_AVAIL / 2) > RAM_SPARE )); then
+    wanted=$(( (RAM_AVAIL / 2) / 1048577 ))
+    RAM_SIZE="${wanted}M"
+    info "Allocated $wanted MB of RAM for the virtual machine."
+  else
+    RAM_SIZE="max"
+  fi
+
+fi
+
+if [[ "${RAM_SIZE,,}" == "max" ]]; then
+
+  if (( RAM_AVAIL < (RAM_SPARE * 2) )); then
+
+    wanted=$(( RAM_AVAIL / 2 ))
+
+  else
+
+    wanted=$(( RAM_AVAIL - (RAM_SPARE * 3) ))
+
+    if (( wanted < (RAM_SPARE * 6) )); then
+      wanted=$(( RAM_AVAIL - RAM_SPARE ))
+    fi
+
+  fi
+
+  wanted=$(( wanted / 1048577 ))
+  RAM_SIZE="${wanted}M"
+
+  info "Allocated $wanted MB of RAM for the virtual machine."
+
+fi
+
+wanted=$(numfmt --from=iec "$RAM_SIZE")
+
+if [ "$wanted" -lt "$RAM_MINIMUM" ]; then
+  wanted=$(( wanted / 1048577 ))
+  error "Not enough memory available, there is only $wanted MB left!"
+  exit 16
+fi
+
+return 0

src/network.sh

@@ -19,15 +19,28 @@ set -Eeuo pipefail
 : "${VM_NET_HOST:="VirtualDSM"}"
 : "${VM_NET_MASK:="255.255.255.0"}"
 
-: "${PASST:="passt"}"
+: "${PASST:="/run/passt"}"
+: "${PASST_MTU:=""}"
 : "${PASST_OPTS:=""}"
 : "${PASST_DEBUG:=""}"
+: "${PASST_PID:="/var/run/passt.pid"}"
+: "${PASST_SOCKET:="/tmp/passt.socket"}"
 
 : "${DNSMASQ_OPTS:=""}"
 : "${DNSMASQ_DEBUG:=""}"
 : "${DNSMASQ:="/usr/sbin/dnsmasq"}"
+: "${DNSMASQ_PID:="/var/run/dnsmasq.pid"}"
 : "${DNSMASQ_CONF_DIR:="/etc/dnsmasq.d"}"
 
+# Sanitize variables
+MAC=$(strip "$MAC")
+MTU=$(strip "$MTU")
+ADAPTER=$(strip "$ADAPTER")
+NETWORK=$(strip "$NETWORK")
+PASST_MTU=$(strip "$PASST_MTU")
+HOST_PORTS=$(strip "$HOST_PORTS")
+USER_PORTS=$(strip "$USER_PORTS")
+
 ADD_ERR="Please add the following setting to your container:"
 
 # ######################################
@@ -36,7 +49,7 @@ ADD_ERR="Please add the following setting to your container:"
 
 configureDHCP() {
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring MACVTAP networking..."
+  enabled "$DEBUG" && echo "Configuring MACVTAP networking..."
 
   # Create the necessary file structure for /dev/vhost-net
   if [ ! -c /dev/vhost-net ]; then
@@ -114,133 +127,173 @@ configureDHCP() {
 
 configureDNS() {
 
-  local if="$1"
+  local fa="$1"
   local ip="$2"
   local mac="$3"
   local host="$4"
   local mask="$5"
   local gateway="$6"
+  local arguments="$DNSMASQ_OPTS"
 
   echo "$gateway" > /run/shm/qemu.gw
-  
-  [[ "${DNSMASQ_DISABLE:-}" == [Yy1]* ]] && return 0
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Starting dnsmasq daemon..."
 
-  local log="/var/log/dnsmasq.log"
+  enabled "${DNSMASQ_DISABLE:-}" && return 0
-  rm -f "$log"
+  enabled "$DEBUG" && echo "Starting dnsmasq daemon..."
+
+  [ -s "$DNSMASQ_PID" ] && pKill "$(<"$DNSMASQ_PID")"
+  rm -f "$DNSMASQ_PID"
 
   case "${NETWORK,,}" in
-    "nat" | "tap" | "tun" | "tuntap" | "y" )
+    "tap" | "tun" | "tuntap" | "y" )
 
       # Create lease file for faster resolve
       echo "0 $mac $ip $host 01:$mac" > /var/lib/misc/dnsmasq.leases
       chmod 644 /var/lib/misc/dnsmasq.leases
 
       # dnsmasq configuration:
-      DNSMASQ_OPTS+=" --dhcp-authoritative"
+      arguments+=" --dhcp-authoritative"
 
       # Set DHCP range and host
-      DNSMASQ_OPTS+=" --dhcp-range=$ip,$ip"
+      arguments+=" --dhcp-range=$ip,$ip"
-      DNSMASQ_OPTS+=" --dhcp-host=$mac,,$ip,$host,infinite"
+      arguments+=" --dhcp-host=$mac,,$ip,$host,infinite"
 
       # Set DNS server and gateway
-      DNSMASQ_OPTS+=" --dhcp-option=option:netmask,$mask"
+      arguments+=" --dhcp-option=option:netmask,$mask"
-      DNSMASQ_OPTS+=" --dhcp-option=option:router,$gateway"
+      arguments+=" --dhcp-option=option:router,$gateway"
-      DNSMASQ_OPTS+=" --dhcp-option=option:dns-server,$gateway"
+      arguments+=" --dhcp-option=option:dns-server,$gateway"
 
   esac
 
   # Set interfaces
-  DNSMASQ_OPTS+=" --interface=$if"
+  arguments+=" --interface=$fa"
-  DNSMASQ_OPTS+=" --bind-interfaces"
+  arguments+=" --bind-interfaces"
+
+  # Workaround NET_RAW capability
+  arguments+=" --no-ping"
 
   # Add DNS entry for container
-  DNSMASQ_OPTS+=" --address=/host.lan/$gateway"
+  arguments+=" --address=/host.lan/$gateway"
 
   # Set local dns resolver to dnsmasq when needed
-  [ -f /etc/resolv.dnsmasq ] && DNSMASQ_OPTS+=" --resolv-file=/etc/resolv.dnsmasq"
+  [ -f /etc/resolv.dnsmasq ] && arguments+=" --resolv-file=/etc/resolv.dnsmasq"
 
   # Enable logging to file
-  DNSMASQ_OPTS+=" --log-facility=$log"
+  local log="/var/log/dnsmasq.log"
+  rm -f "$log"
+  arguments+=" --log-facility=$log"
 
-  DNSMASQ_OPTS=$(echo "$DNSMASQ_OPTS" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
+  arguments=$(echo "$arguments" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
-  [[ "$DEBUG" == [Yy1]* ]] && printf "Dnsmasq arguments:\n\n%s\n\n" "${DNSMASQ_OPTS// -/$'\n-'}"
+  enabled "$DEBUG" && printf "Dnsmasq arguments:\n\n%s\n\n" "${arguments// -/$'\n-'}"
 
-  if ! $DNSMASQ ${DNSMASQ_OPTS:+ $DNSMASQ_OPTS}; then
+  { $DNSMASQ ${arguments:+ $arguments}; rc=$?; } || :
 
-    local msg="Failed to start Dnsmasq, reason: $?"
+  if (( rc != 0 )); then
-    [ -f "$log" ] && cat "$log"
+
-    error "$msg"
+    local msg="Failed to start Dnsmasq, reason: $rc"
+
+    if [[ "${NETWORK,,}" == "slirp" || "${NETWORK,,}" == "passt" ]] || ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
+      [ -f "$log" ] && [ -s "$log" ] && cat "$log"
+      error "$msg"
+    fi
 
     return 1
   fi
 
-  if [[ "$DNSMASQ_DEBUG" == [Yy1]* ]]; then
+  if enabled "$DNSMASQ_DEBUG"; then
-    tail -fn +0 "$log" &
+    tail -fn +0 "$log" --pid=$$ &
   fi
 
   return 0
 }
 
-getUserPorts() {
-
-  local args=""
-  local list=$1
-  local ssh="22"
-  local dsm="5000"
-
-  [ -z "$list" ] && list="$ssh,$dsm" || list+=",$ssh,$dsm"
-
-  list="${list//,/ }"
-  list="${list## }"
-  list="${list%% }"
-
-  for port in $list; do
-    proto="tcp"
-    num="$port"
-
-    if [[ "$port" == */udp ]]; then
-      proto="udp"
-      num="${port%/udp}"
-    elif [[ "$port" == */tcp ]]; then
-      proto="tcp"
-      num="${port%/tcp}"
-    fi
-
-    args+="hostfwd=$proto::$num-$VM_NET_IP:$num,"
-  done
-
-  echo "${args%?}"
-  return 0
-}
-
 getHostPorts() {
 
-  local list="$1"
+  local list="${HOST_PORTS// /},"
-  list=$(echo "${list// /}" | sed 's/,*$//g')
 
-  [ -z "$list" ] && list="$MON_PORT" || list+=",$MON_PORT"
+  # Remove duplicates
-
+  list=$(echo "${list//,,/,}," | awk 'BEGIN{RS=ORS=","} !seen[$0]++' | sed 's/,*$//g')
-  if [[ "${NETWORK,,}" == "passt" ]]; then
-
-    local DNS_PORT="53"
-
-    if [[ "${DNSMASQ_DISABLE:-}" != [Yy1]* ]]; then
-      [ -z "$list" ] && list="$DNS_PORT" || list+=",$DNS_PORT"
-    fi
-
-    [ -z "$list" ] && list="$COM_PORT" || list+=",$COM_PORT"
-    [ -z "$list" ] && list="$CHR_PORT" || list+=",$CHR_PORT"
-
-  fi
 
   echo "$list"
   return 0
 }
 
+getUserPorts() {
+
+  local ssh="22"
+  local dsm="5000,5001"
+
+  local list="$ssh,$dsm,"
+  list+="${USER_PORTS// /},"
+
+  local exclude
+  exclude=$(getHostPorts)
+
+  local ports=""
+  local userport=""
+  local hostport=""
+
+  for userport in ${list//,/ }; do
+
+    local num="${userport///tcp}"
+    num="${num///udp}"
+
+    for hostport in ${exclude//,/ }; do
+
+      local port="${hostport///tcp}"
+      port="${port///udp}"
+
+      if [[ "$num" == "$port" ]]; then
+        num=""
+        if [[ "$port" != "$WEB_PORT" ]]; then
+          warn "Could not assign port $port to \"USER_PORTS\" because it is already in \"HOST_PORTS\"!"
+        fi
+      fi
+
+    done
+
+    [ -n "$num" ] && ports+="$userport,"
+
+  done
+
+  # Remove duplicates
+  echo "${ports//,,/,}," | awk 'BEGIN{RS=ORS=","} !seen[$0]++' | sed 's/,*$//g'
+  return 0
+}
+
+getSlirp() {
+
+  local ip="$1"
+  local args=""
+  local list=""
+
+  list=$(getUserPorts)
+
+  for port in ${list//,/ }; do
+
+    local proto="tcp"
+    local num="${port%/tcp}"
+    [ -z "$num" ] && continue
+
+    if [[ "$port" == *"/udp" ]]; then
+      proto="udp"
+      num="${port%/udp}"
+    elif [[ "$port" != *"/tcp" ]]; then
+      args+="hostfwd=$proto::$num-$ip:$num,"
+      proto="udp"
+      num="${port%/udp}"
+    fi
+
+    args+="hostfwd=$proto::$num-$ip:$num,"
+  done
+
+  echo "$args" | sed 's/,*$//g'
+  return 0
+}
+
 configureSlirp() {
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring slirp networking..."
+  NETWORK="slirp"
+  enabled "$DEBUG" && echo "Configuring slirp networking..."
 
   local ip="$IP"
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
@@ -253,31 +306,33 @@ configureSlirp() {
 
   NET_OPTS="-netdev user,id=hostnet0,ipv4=on,host=$gateway,net=${gateway%.*}.0/24,dhcpstart=$ip,${ipv6}hostname=$VM_NET_HOST"
 
-  local forward
+  local forward=""
-  forward=$(getUserPorts "${USER_PORTS:-}")
+  forward=$(getSlirp "$ip")
   [ -n "$forward" ] && NET_OPTS+=",$forward"
 
-  if [[ "${DNSMASQ_DISABLE:-}" != [Yy1]* ]]; then
+  if enabled "${DNSMASQ_DISABLE:-}"; then
-    cp /etc/resolv.conf /etc/resolv.dnsmasq
+    echo "$gateway" > /run/shm/qemu.gw
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+  else
+    [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
+    configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
-  configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
-
   VM_NET_IP="$ip"
   return 0
 }
 
 configurePasst() {
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring user-mode networking..."
+  NETWORK="passt"
+  enabled "$DEBUG" && echo "Configuring user-mode networking..."
 
-  local log="/var/log/passt.log"
+  local log="/tmp/passt.log"
   rm -f "$log"
 
-  local pid="/var/run/dnsmasq.pid"
-  [ -s "$pid" ] && pKill "$(<"$pid")"
-
   local ip="$IP"
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
 
@@ -294,47 +349,65 @@ configurePasst() {
   PASST_OPTS+=" -a $ip"
   PASST_OPTS+=" -g $gateway"
   PASST_OPTS+=" -n $VM_NET_MASK"
+  [ -n "$PASST_MTU" ] && PASST_OPTS+=" -m $PASST_MTU"
 
-  exclude=$(getHostPorts "$HOST_PORTS")
+  local forward=""
+  forward=$(getUserPorts)
+  forward="${forward///tcp}"
+  forward="${forward///udp}"
 
-  if [ -z "$exclude" ]; then
+  if [ -n "$forward" ]; then
-    exclude="all"
+    forward="%${VM_NET_DEV}/$forward"
-  else
+    PASST_OPTS+=" -t $forward"
-    exclude="~${exclude//,/,~}"
+    PASST_OPTS+=" -u $forward"
   fi
 
-  PASST_OPTS+=" -t $exclude"
-  PASST_OPTS+=" -u $exclude"
   PASST_OPTS+=" -H $VM_NET_HOST"
   PASST_OPTS+=" -M $GATEWAY_MAC"
-  PASST_OPTS+=" -P /var/run/passt.pid"
+  PASST_OPTS+=" -P $PASST_PID"
+  PASST_OPTS+=" -s $PASST_SOCKET"
   PASST_OPTS+=" -l $log"
   PASST_OPTS+=" -q"
 
-  if [[ "${DNSMASQ_DISABLE:-}" != [Yy1]* ]]; then
+  if ! enabled "${DNSMASQ_DISABLE:-}"; then
-    cp /etc/resolv.conf /etc/resolv.dnsmasq
+    [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
   PASST_OPTS=$(echo "$PASST_OPTS" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
-  [[ "$DEBUG" == [Yy1]* ]] && printf "Passt arguments:\n\n%s\n\n" "${PASST_OPTS// -/$'\n-'}"
 
-  if ! $PASST ${PASST_OPTS:+ $PASST_OPTS} >/dev/null 2>&1; then
+  if enabled "$DEBUG" || enabled "$PASST_DEBUG"; then
-    local msg="Failed to start passt, reason: $?"
+    printf "Passt arguments:\n\n%s\n\n" "${PASST_OPTS// -/$'\n-'}"
-    [ -f "$log" ] && cat "$log"
-    error "$msg"
-    return 1
   fi
 
-  if [[ "$PASST_DEBUG" == [Yy1]* ]]; then
+  [ ! -f "$PASST" ] && cp /usr/bin/passt* /run
-    tail -fn +0 "$log" &
+
+  if ! "$PASST" ${PASST_OPTS:+$PASST_OPTS} >/dev/null 2>&1; then
+
+    rm -f "$log"
+    PASST_OPTS="${PASST_OPTS/ -q/}"
+    { "$PASST" ${PASST_OPTS:+$PASST_OPTS}; rc=$?; } || :
+
+    if (( rc != 0 )); then
+      [ -f "$log" ] && [ -s "$log" ] && cat "$log"
+      warn "failed to start passt ($rc), falling back to slirp networking!"
+      configureSlirp && return 0 || return 1
+    fi
+
+  fi
+
+  if enabled "$PASST_DEBUG"; then
+    tail -fn +0 "$log" --pid=$$ &
   else
-    if [[ "$DEBUG" == [Yy1]* ]]; then
+    if enabled "$DEBUG"; then
-      [ -f "$log" ] && cat "$log" && echo ""
+      [ -f "$log" ] && [ -s "$log" ] && cat "$log" && echo ""
     fi
   fi
 
-  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket"
+  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=$PASST_SOCKET"
 
   configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
 
@@ -342,16 +415,51 @@ configurePasst() {
   return 0
 }
 
+clearTables() {
+  local table="" line rules
+
+  # Choose between iptables or nftables
+  if command -v iptables-nft >/dev/null 2>&1 && iptables-nft -V >/dev/null 2>&1; then
+    update-alternatives --set iptables /usr/sbin/iptables-nft > /dev/null
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft > /dev/null
+  else
+    update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null
+  fi
+
+  # Store the current iptables ruleset
+  ! rules=$(iptables-save 2> /dev/null) && return 0
+  [ -z "$rules" ] && return 0
+
+  # Delete every rule tagged with our unique identifier, leaving all other rules intact.
+  while IFS= read -r line; do
+    case "$line" in
+      \*nat)    table="nat" ;;
+      \*filter) table="filter" ;;
+      \*mangle) table="mangle" ;;
+      \*raw)    table="raw" ;;
+    esac
+    if [[ "$line" == -A* ]]; then
+      local re="--comment[[:space:]]+\"?remove\"?([[:space:]]|\$)"
+      if [[ "$line" =~ $re ]]; then
+        read -ra args <<< "${line/-A /-D }"
+        iptables -t "$table" "${args[@]}" &> /dev/null || :
+      fi
+    fi
+  done <<< "$rules"
+
+  return 0
+}
+
 configureNAT() {
 
   local tuntap="TUN device is missing. $ADD_ERR --device /dev/net/tun"
   local tables="the 'ip_tables' kernel module is not loaded. Try this command: sudo modprobe ip_tables iptable_nat"
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring NAT networking..."
+  enabled "$DEBUG" && echo "Configuring NAT networking..."
 
   # Create the necessary file structure for /dev/net/tun
   if [ ! -c /dev/net/tun ]; then
-    [[ "$PODMAN" == [Yy1]* ]] && return 1
     [ ! -d /dev/net ] && mkdir -m 755 /dev/net
     if mknod /dev/net/tun c 10 200; then
       chmod 666 /dev/net/tun
@@ -359,6 +467,7 @@ configureNAT() {
   fi
 
   if [ ! -c /dev/net/tun ]; then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -366,13 +475,15 @@ configureNAT() {
   if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
     { sysctl -w net.ipv4.ip_forward=1 > /dev/null 2>&1; rc=$?; } || :
     if (( rc != 0 )) || [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
+      enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
       warn "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1"
       return 1
     fi
   fi
 
-  local ip base
+  local ip base gateway exclude
-  base=$(echo "$IP" | sed -r 's/([^.]*.){2}//')
+  base=$(cut -d. -f3,4 <<< "$IP")
+
   if [[ "$IP" != "172.30."* ]]; then
     ip="172.30.$base"
   else
@@ -381,21 +492,24 @@ configureNAT() {
 
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
 
-  local gateway=""
   if [[ "$ip" != *".1" ]]; then
     gateway="${ip%.*}.1"
   else
     gateway="${ip%.*}.2"
   fi
 
+  local subnet="${ip%.*}.0/24"
+  local broadcast="${ip%.*}.255"
+
   # Create a bridge with a static IP for the VM guest
   { ip link add dev "$VM_NET_BRIDGE" type bridge ; rc=$?; } || :
 
   if (( rc != 0 )); then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "failed to create bridge. $ADD_ERR --cap-add NET_ADMIN" && return 1
   fi
 
-  if ! ip address add "$gateway/24" broadcast "${ip%.*}.255" dev "$VM_NET_BRIDGE"; then
+  if ! ip address add "$gateway/24" broadcast "$broadcast" dev "$VM_NET_BRIDGE"; then
     warn "failed to add IP address pool!" && return 1
   fi
 
@@ -404,8 +518,9 @@ configureNAT() {
     sleep 2
   done
 
-  # QEMU Works with taps, set tap to the bridge created
+  # Set tap to the bridge created
   if ! ip tuntap add dev "$VM_NET_TAP" mode tap; then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -416,7 +531,7 @@ configureNAT() {
   fi
 
   if ! ip link set dev "$VM_NET_TAP" address "$GATEWAY_MAC"; then
-    warn "failed to set gateway MAC address.."
+    warn "failed to set gateway MAC address."
   fi
 
   while ! ip link set "$VM_NET_TAP" up promisc on; do
@@ -428,15 +543,10 @@ configureNAT() {
     warn "failed to set master bridge!" && return 1
   fi
 
-  if grep -wq "nf_tables" /proc/modules; then
+  # Flush existing tables
-    update-alternatives --set iptables /usr/sbin/iptables-nft > /dev/null
+  clearTables
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft > /dev/null
-  else
-    update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null
-  fi
 
-  exclude=$(getHostPorts "$HOST_PORTS")
+  exclude=$(getHostPorts)
 
   if [ -n "$exclude" ]; then
     if [[ "$exclude" != *","* ]]; then
@@ -446,22 +556,36 @@ configureNAT() {
     fi
   fi
 
-  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE; then
+  # NAT traffic from bridge subnet to Docker uplink
-    warn "$tables" && return 1
+  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE > /dev/null 2>&1; then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
+    if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE; then
+      warn "$tables" && return 1
+    fi
   fi
 
   # shellcheck disable=SC2086
-  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -j DNAT --to "$ip"; then
+  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -m comment --comment "remove" -j DNAT --to "$ip"; then
     warn "failed to configure IP tables!" && return 1
   fi
 
-  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp -j DNAT --to "$ip"; then
+  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp -m comment --comment "remove" -j DNAT --to "$ip"; then
     warn "failed to configure IP tables!" && return 1
   fi
 
   if (( KERNEL > 4 )); then
     # Hack for guest VMs complaining about "bad udp checksums in 5 packets"
-    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true
+    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -m comment --comment "remove" -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true
+  fi
+
+  # Allow forwarding from bridge -> dev
+  if ! iptables -A FORWARD -i "$VM_NET_BRIDGE" -o "$VM_NET_DEV" -m comment --comment "remove" -j ACCEPT; then
+    warn "failed to configure IP tables!" && return 1
+  fi
+
+  # Allow return traffic
+  if ! iptables -A FORWARD -i "$VM_NET_DEV" -o "$VM_NET_BRIDGE" -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "remove" -j ACCEPT; then
+    warn "failed to configure IP tables!" && return 1
   fi
 
   NET_OPTS="-netdev tap,id=hostnet0,ifname=$VM_NET_TAP"
@@ -481,87 +605,72 @@ configureNAT() {
 
 closeBridge() {
 
-  local pid="/var/run/dnsmasq.pid"
+  local pids=( "$PASST_PID" "$DNSMASQ_PID" )
-  [ -s "$pid" ] && pKill "$(<"$pid")"
+  mKill "${pids[@]}"
-  rm -f "$pid"
 
-  pid="/var/run/passt.pid"
+  ip link set "$VM_NET_TAP" down promisc off &> /dev/null || :
-  [ -s "$pid" ] && pKill "$(<"$pid")"
+  ip link delete "$VM_NET_TAP" &> /dev/null || :
-  rm -f "$pid"
 
-  case "${NETWORK,,}" in
+  ip link set "$VM_NET_BRIDGE" down &> /dev/null || :
-    "user"* | "passt" | "slirp" ) return 0 ;;
+  ip link delete "$VM_NET_BRIDGE" &> /dev/null || :
-  esac
 
-  ip link set "$VM_NET_TAP" down promisc off &> null || true
+  clearTables
-  ip link delete "$VM_NET_TAP" &> null || true
+  return 0
+}
 
-  ip link set "$VM_NET_BRIDGE" down &> null || true
+closeWeb() {
-  ip link delete "$VM_NET_BRIDGE" &> null || true
+
+  local pids=( "$WEB_PID" "$WSD_PID" )
+  mKill "${pids[@]}"
 
   return 0
 }
 
 closeNetwork() {
 
-  if [[ "${WEB:-}" != [Nn]* && "$DHCP" == [Yy1]* ]]; then
+  if ! disabled "${WEB:-}" && enabled "$DHCP"; then
-
+    closeWeb
-    # Shutdown nginx
-    nginx -s stop 2> /dev/null
-    fWait "nginx"
-
   fi
 
-  [[ "$NETWORK" == [Nn]* ]] && return 0
+  disabled "$NETWORK" && return 0
 
   exec 30<&- || true
   exec 40<&- || true
 
-  if [[ "$DHCP" != [Yy1]* ]]; then
+  closeBridge
-
-    closeBridge
-    return 0
-
-  fi
-
-  ip link set "$VM_NET_TAP" down || true
-  ip link delete "$VM_NET_TAP" || true
 
   return 0
 }
 
 cleanUp() {
 
-  # Clean up old files
+  closeBridge
-  rm -f /etc/resolv.dnsmasq
-  rm -f /var/run/passt.pid
-  rm -f /var/run/dnsmasq.pid
 
-  if [[ -d "/sys/class/net/$VM_NET_TAP" ]]; then
+  # Clean up old files
-    info "Lingering interface will be removed..."
+  rm -f "$PASST_PID" "$PASST_SOCKET"
-    ip link delete "$VM_NET_TAP" || true
+  rm -f "$DNSMASQ_PID" /etc/resolv.dnsmasq
-  fi
 
   return 0
 }
 
 checkOS() {
 
-  local kernel
   local os=""
-  local if="macvlan"
+  local kernel=""
+  local iface="macvlan"
+
   kernel=$(uname -a)
 
-  [[ "${kernel,,}" == *"darwin"* ]] && os="Docker Desktop for macOS"
+  [[ "${kernel,,}" == *"darwin"* ]] && os="$ENGINE Desktop for macOS"
-  [[ "${kernel,,}" == *"microsoft"* ]] && os="Docker Desktop for Windows"
+  [[ "${kernel,,}" == *"microsoft"* ]] && os="$ENGINE Desktop for Windows"
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
+  if enabled "$DHCP"; then
-    if="macvtap"
+    iface="macvtap"
     [[ "${kernel,,}" == *"synology"* ]] && os="Synology Container Manager"
   fi
 
   if [ -n "$os" ]; then
-    warn "you are using $os which does not support $if, please revert to bridge networking!"
+    warn "you are using $os which does not support $iface, please revert to bridge networking!"
   fi
 
   return 0
@@ -575,8 +684,8 @@ getInfo() {
     [ -d "/sys/class/net/net1" ] && VM_NET_DEV="net1"
     [ -d "/sys/class/net/net2" ] && VM_NET_DEV="net2"
     [ -d "/sys/class/net/net3" ] && VM_NET_DEV="net3"
-    # Automaticly detect the default network interface
+    # Automatically detect the default network interface
-    [ -z "$VM_NET_DEV" ] && VM_NET_DEV=$(awk '$2 == 00000000 { print $1 }' /proc/net/route)
+    [ -z "$VM_NET_DEV" ] && VM_NET_DEV=$(awk '$2 == 00000000 { print $1; exit }' /proc/net/route)
     [ -z "$VM_NET_DEV" ] && VM_NET_DEV="eth0"
   fi
 
@@ -586,27 +695,29 @@ getInfo() {
   fi
 
   GATEWAY=$(ip route list dev "$VM_NET_DEV" | awk ' /^default/ {print $3}' | head -n 1)
-  IP=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/ | head -n 1)
+  { IP=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/ | head -n 1); } 2>/dev/null || :
-  IP6=""
+  [ -z "$IP" ] && ! enabled "$DHCP" && error "Could not determine container IPv4 address!" && exit 26
 
+  IP6=""
   # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
-    IP6=$(ip -6 addr show dev "$VM_NET_DEV" scope global up)
+    { IP6=$(ip -6 addr show dev "$VM_NET_DEV" scope global up); rc=$?; } 2>/dev/null || :
+    (( rc != 0 )) && IP6=""
     [ -n "$IP6" ] && IP6=$(echo "$IP6" | sed -e's/^.*inet6 \([^ ]*\)\/.*$/\1/;t;d' | head -n 1)
   fi
 
   local result nic bus
   result=$(ethtool -i "$VM_NET_DEV")
-  nic=$(grep -m 1 -i 'driver:' <<< "$result" | awk '{print $(2)}')
+  nic=$(grep -m 1 -i 'driver:' <<< "$result" | awk '{print $2}')
-  bus=$(grep -m 1 -i 'bus-info:' <<< "$result" | awk '{print $(2)}')
+  bus=$(grep -m 1 -i 'bus-info:' <<< "$result" | awk '{print $2}')
 
   if [[ "${bus,,}" != "" && "${bus,,}" != "n/a" && "${bus,,}" != "tap" ]]; then
-    [[ "$DEBUG" == [Yy1]* ]] && info "Detected BUS: $bus"
+    enabled "$DEBUG" && info "Detected BUS: $bus"
     error "This container does not support host mode networking!"
     exit 29
   fi
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
+  if enabled "$DHCP"; then
 
     checkOS
 
@@ -616,11 +727,25 @@ getInfo() {
     fi
 
     if [[ "${nic,,}" != "macvlan" ]]; then
-      [[ "$DEBUG" == [Yy1]* ]] && info "Detected NIC: $nic"
+      enabled "$DEBUG" && info "Detected NIC: $nic"
       error "The container needs to be in a MACVLAN network when DHCP=Y."
       exit 29
     fi
 
+    if uname -a | grep -Eqi 'unraid|truenas'; then
+
+      # Check if host exposes the bridge-nf sysctl
+      # (only visible if br_netfilter is loaded and /proc/sys is accessible)
+  
+      BNF="/proc/sys/net/bridge/bridge-nf-call-iptables"
+  
+      if [[ -r "$BNF" ]] && [[ "$(cat "$BNF")" != "0" ]]; then
+        warn "external LAN clients may not be able to reach this container, because net.bridge.bridge-nf-call-iptables=1."
+        warn "you can fix this issue by running 'sysctl -w net.bridge.bridge-nf-call-iptables=0' on the host system."
+      fi
+  
+    fi
+
   else
 
     if [[ "$IP" != "172."* && "$IP" != "10.8"* && "$IP" != "10.9"* ]]; then
@@ -638,13 +763,8 @@ getInfo() {
   [ -z "$MTU" ] && MTU="$mtu"
   [ -z "$MTU" ] && MTU="0"
 
-  if [ "$MTU" -gt "1500" ]; then
-    [[ "$DEBUG" == [Yy1]* ]] && echo "MTU size is too large: $MTU, ignoring..."
-    MTU="0"
-  fi
-
   if [[ "${ADAPTER,,}" != "virtio-net-pci" ]]; then
-    if [[ "$MTU" != "0" && "$MTU" != "1500" ]]; then
+    if [[ "$MTU" != "0" ]] && [ "$MTU" -lt "1500" ]; then
       warn "MTU size is $MTU, but cannot be set for $ADAPTER adapters!" && MTU="0"
     fi
   fi
@@ -657,6 +777,7 @@ getInfo() {
       # Generate MAC address based on Docker container ID in hostname
       VM_NET_MAC=$(echo "$HOST" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:11:32:\3:\4:\5/')
       echo "${VM_NET_MAC^^}" > "$file"
+      ! setOwner "$file" && error "Failed to set the owner for \"$file\" !"
     fi
   fi
 
@@ -674,26 +795,19 @@ getInfo() {
 
   GATEWAY_MAC=$(echo "$VM_NET_MAC" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/')
 
-  if [[ "$PODMAN" == [Yy1]* && "$DHCP" != [Yy1]* ]]; then
+  if enabled "$DEBUG"; then
-    if [ -z "$NETWORK" ] || [[ "${NETWORK^^}" == "Y" ]]; then
-      # By default Podman has no permissions for NAT networking
-      NETWORK="user"
-    fi
-  fi
-
-  if [[ "$DEBUG" == [Yy1]* ]]; then
     line="Host: $HOST  IP: $IP  Gateway: $GATEWAY  Interface: $VM_NET_DEV  MAC: $VM_NET_MAC  MTU: $mtu"
     [[ "$MTU" != "0" && "$MTU" != "$mtu" ]] && line+=" ($MTU)"
     info "$line"
     if [ -f /etc/resolv.conf ]; then
-      nameservers=$(grep '^nameserver*' /etc/resolv.conf | head -c -1 | sed 's/nameserver //g;' | sed -z 's/\n/, /g')
+      nameservers=$(grep '^nameserver ' /etc/resolv.conf | sed 's/^nameserver //' | paste -sd ',' | sed 's/,/, /g')
       [ -n "$nameservers" ] && info "Nameservers: $nameservers"
     fi
     echo
   fi
 
-  echo "$IP" > /run/shm/qemu.ip
+  echo "$IP" > "$QEMU_DIR"/qemu.ip
-  echo "$nic" > /run/shm/qemu.nic
+  echo "$nic" > "$QEMU_DIR"//qemu.nic
 
   return 0
 }
@@ -702,14 +816,14 @@ getInfo() {
 #  Configure Network
 # ######################################
 
-if [[ "$NETWORK" == [Nn]* ]]; then
+if disabled "$NETWORK"; then
   NET_OPTS=""
   return 0
 fi
 
 msg="Initializing network..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 getInfo
 cleanUp
@@ -718,45 +832,44 @@ if [[ "$IP" == "172.17."* ]]; then
   warn "your container IP starts with 172.17.* which will cause conflicts when you install the Container Manager package inside DSM!"
 fi
 
-if [[ "$DHCP" == [Yy1]* ]]; then
+MSG="Booting DSM instance..."
+html "$MSG"
+
+if enabled "$DHCP"; then
 
   # Configure for macvtap interface
   configureDHCP || exit 20
 
-  MSG="Booting DSM instance..."
-  html "$MSG"
-
 else
 
-  if [[ "${WEB:-}" != [Nn]* ]]; then
+  if ! disabled "${WEB:-}"; then
-
+    sleep 1.2
-    # Shutdown nginx
+    closeWeb
-    nginx -s stop 2> /dev/null
-    fWait "nginx"
-
   fi
 
   case "${NETWORK,,}" in
-    "user"* | "passt" | "slirp" ) ;;
+    "passt" | "slirp" | "user"* ) ;;
-    "nat" | "tap" | "tun" | "tuntap" | "y" )
+    "tap" | "tun" | "tuntap" | "y" | "" )
 
       # Configure tap interface
       if ! configureNAT; then
 
         closeBridge
         NETWORK="user"
-        msg="falling back to user-mode networking!"
+
-        msg="failed to setup NAT networking, $msg"
+        if ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
+          msg="falling back to user-mode networking!"
+          msg="failed to setup NAT networking, $msg"
+          warn "$msg"
+        fi
 
       fi ;;
 
   esac
 
-  [[ "${NETWORK,,}" == "user"* ]] && NETWORK="passt"
-
   case "${NETWORK,,}" in
-    "nat" | "tap" | "tun" | "tuntap" | "y" ) ;;
+    "tap" | "tun" | "tuntap" | "y" | "" ) ;;
-    "passt" )
+    "passt" | "user"* )
 
       # Configure for user-mode networking (passt)
       if ! configurePasst; then
@@ -770,16 +883,21 @@ else
       if ! configureSlirp; then
         error "Failed to configure user-mode networking!"
         exit 24
-      fi
-
-      if [ -z "$USER_PORTS" ]; then
-        info "Notice: slirp networking is active, so when you want to expose ports, you will need to map them using this variable: \"USER_PORTS=5000,5001\"."
       fi ;;
 
     *)
       error "Unrecognized NETWORK value: \"$NETWORK\"" && exit 24 ;;
   esac
 
+  case "${NETWORK,,}" in
+    "passt" | "slirp" )
+
+      if [ -z "$USER_PORTS" ]; then
+        info "Notice: because user-mode networking is active, when you need to forward custom ports to DSM, add them to the \"USER_PORTS\" variable."
+      fi ;;
+
+  esac
+
 fi
 
 NET_OPTS+=" -device $ADAPTER,id=net0,netdev=hostnet0,romfile=,mac=$VM_NET_MAC"

src/power.sh

@@ -1,135 +1,115 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-: "${API_TIMEOUT:="50"}"   # API Call timeout
+: "${SHUTDOWN:="Y"}"        # Graceful ACPI shutdown
-: "${QEMU_TIMEOUT:="50"}"  # QEMU Termination timeout
+: "${TIMEOUT:="115"}"       # QEMU termination timeout
+: "${API_TIMEOUT:="90"}"    # External API call timeout
 
 # Configure QEMU for graceful shutdown
 
 API_CMD=6
 API_HOST="127.0.0.1:$COM_PORT"
 
-QEMU_TERM=""
+# Configure QEMU for graceful shutdown
-QEMU_DIR="/run/shm"
+
-QEMU_PID="$QEMU_DIR/qemu.pid"
-QEMU_LOG="$QEMU_DIR/qemu.log"
-QEMU_OUT="$QEMU_DIR/qemu.out"
 QEMU_END="$QEMU_DIR/qemu.end"
 
-if [[ "$KVM" == [Nn]* ]]; then
-  API_TIMEOUT=$(( API_TIMEOUT*2 ))
-  QEMU_TIMEOUT=$(( QEMU_TIMEOUT*2 ))
-fi
-
-touch "$QEMU_LOG"
-
 _trap() {
-  func="$1" ; shift
+  local func="$1"; shift
-  for sig ; do
+  local sig
+  TRAP_PID=$BASHPID
+
+  for sig; do
     trap "$func $sig" "$sig"
   done
 }
 
+app() {
+  echo "$APP" && return 0
+}
+
 finish() {
 
-  local pid
+  local i=0
+  local pid=""
   local reason=$1
+  local pids=( "${HOST_PID:-}" "${WSD_PID:-}" \
+               "${WEB_PID:-}" "${PASST_PID:-}" "${DNSMASQ_PID:-}" )
 
   touch "$QEMU_END"
 
   if [ -s "$QEMU_PID" ]; then
-
+    if read -r pid <"$QEMU_PID"; then
-    pid=$(<"$QEMU_PID")
+      if [ -n "$pid" ] && isAlive "$pid"; then
-    echo && error "Forcefully terminating QEMU process, reason: $reason..."
+        local display="$reason"
-    { kill -15 "$pid" || true; } 2>/dev/null
+        case "$reason" in
-
+          129 ) display="SIGHUP" ;;
-    while isAlive "$pid"; do
+          130 ) display="SIGINT" ;;
-      sleep 1
+          131 ) display="SIGQUIT" ;;
-      # Workaround for zombie pid
+          134 ) display="SIGABRT" ;;
-      [ ! -s "$QEMU_PID" ] && break
+          143 ) display="SIGTERM" ;;
-    done
+        esac
-  fi
+        error "Forcefully terminating $(app), reason: $display..."
-
+        { disown "$pid" || :; kill -9 -- "$pid" || :; } 2>/dev/null
-  fKill "print.sh"
-  fKill "host.bin"
-
-  closeNetwork
-
-  sleep 1
-  echo && echo "❯ Shutdown completed!"
-
-  exit "$reason"
-}
-
-terminal() {
-
-  local dev=""
-
-  if [ -s "$QEMU_OUT" ]; then
-
-    local msg
-    msg=$(<"$QEMU_OUT")
-
-    if [ -n "$msg" ]; then
-
-      if [[ "${msg,,}" != "char"* ||  "$msg" != *"serial0)" ]]; then
-        echo "$msg"
       fi
-
-      dev="${msg#*/dev/p}"
-      dev="/dev/p${dev%% *}"
-
     fi
   fi
 
-  if [ ! -c "$dev" ]; then
+  mKill "${pids[@]}"
-    dev=$(echo 'info chardev' | nc -q 1 -w 1 localhost "$MON_PORT" | tr -d '\000')
+  fKill "print.sh"
-    dev="${dev#*serial0}"
+
-    dev="${dev#*pty:}"
+  closeNetwork
-    dev="${dev%%$'\n'*}"
+
-    dev="${dev%%$'\r'*}"
+  if ! waitPidFile "$QEMU_PID" 10; then
+    warn "Timed out while waiting for $(app) to exit!"
   fi
 
-  if [ ! -c "$dev" ]; then
+  (( reason != 1 )) && echo && echo "❯ Shutdown completed!"
-    error "Device '$dev' not found!"
+  exit "$reason"
-    finish 34 && return 34
-  fi
-
-  QEMU_TERM="$dev"
-  return 0
 }
 
-_graceful_shutdown() {
+graceful_shutdown() {
 
-  local code=$?
+  local sig="$1"
-  local pid url response
+  local pid=""
+  local code=0
+  local start url response elapsed
 
-  set +e
+  [[ $BASHPID != "$TRAP_PID" ]] && return
+
+  case "$sig" in
+    SIGHUP)  code=129 ;;
+    SIGINT)  code=130 ;;
+    SIGQUIT) code=131 ;;
+    SIGABRT) code=134 ;;
+    SIGTERM) code=143 ;;
+  esac
 
   if [ -f "$QEMU_END" ]; then
     echo && info "Received $1 signal while already shutting down..."
     return
   fi
 
+  set +e
+  start=$SECONDS
   touch "$QEMU_END"
   echo && info "Received $1 signal, sending shutdown command..."
 
-  if [ ! -s "$QEMU_PID" ]; then
+  if [ ! -s "$QEMU_PID" ] || ! read -r pid <"$QEMU_PID"; then
-    echo && error "QEMU PID file does not exist?"
+    warn "QEMU PID file ($QEMU_PID) does not exist?"
-    finish "$code" && return "$code"
+    finish "$code"
   fi
 
-  pid=$(<"$QEMU_PID")
+  if [ -z "$pid" ] || ! isAlive "$pid"; then
-
+    warn "QEMU process with PID $pid does not exist?"
-  if ! isAlive "$pid"; then
+    finish "$code"
-    echo && error "QEMU process does not exist?"
-    finish "$code" && return "$code"
   fi
 
   # Don't send the powerdown signal because vDSM ignores ACPI signals
-  # echo 'system_powerdown' | nc -q 1 -w 1 localhost "$MON_PORT" > /dev/null
+  # nc -q 1 -w 1 -U "$QEMU_DIR/monitor.sock" &> /dev/null <<<'system_powerdown' || :
 
   # Send shutdown command to guest agent via serial port
+  API_TIMEOUT=$(strip "$API_TIMEOUT")
   url="http://$API_HOST/read?command=$API_CMD&timeout=$API_TIMEOUT"
   response=$(curl -sk -m "$(( API_TIMEOUT+2 ))" -S "$url" 2>&1)
 
@@ -142,44 +122,69 @@ _graceful_shutdown() {
     response="${response#*message\"\: \"}"
     [ -z "$response" ] && response="second signal"
     echo && error "Forcefully terminating because of: ${response%%\"*}"
-    { kill -15 "$pid" || true; } 2>/dev/null
+    kill -15 -- "$pid" 2>/dev/null || :
 
   fi
 
-  local cnt=0
+  local name
+  name="$(app)"
 
-  while [ "$cnt" -lt "$QEMU_TIMEOUT" ]; do
+  local term_grace=3      # seconds before loop ends to send SIGTERM
+  local cleanup_grace=3   # seconds reserved after the loop for cleanup
 
+  TIMEOUT=$(strip "$TIMEOUT")
+  if [[ ! "$TIMEOUT" =~ ^[0-9]+$ ]]; then
+    TIMEOUT=115
+  fi
+
+  if (( TIMEOUT >= 30 )); then
+    term_grace=5
+    cleanup_grace=5
+  elif (( TIMEOUT >= 15 )); then
+    term_grace=4
+    cleanup_grace=4
+  fi
+
+  local cnt=0 sigterm_at=0 min wait_until elapsed timeout_left
+
+  elapsed=$((SECONDS - start))
+  timeout_left=$((TIMEOUT - elapsed))
+
+  min=$((term_grace + cleanup_grace + 1))
+  (( timeout_left < min )) && timeout_left=$min
+
+  wait_until=$((timeout_left - cleanup_grace))
+  sigterm_at=$((wait_until - term_grace))
+
+  while (( cnt <= wait_until )); do
+
+    sleep 1 &
+    local slp=$!
+
+    # Stop waiting if the process has exited
     ! isAlive "$pid" && break
 
-    sleep 1
+    # Workaround for stale/zombie QEMU pid file
-    cnt=$((cnt+1))
-
-    [[ "$DEBUG" == [Yy1]* ]] && info "Shutting down, waiting... ($cnt/$QEMU_TIMEOUT)"
-
-    # Workaround for zombie pid
     [ ! -s "$QEMU_PID" ] && break
 
+    if (( cnt == sigterm_at )); then
+      info "${name^} is still running, sending SIGTERM... ($cnt/$wait_until)"
+      kill -15 -- "$pid" 2>/dev/null || :
+    elif (( cnt > 0 )) && enabled "${DEBUG:-}"; then
+      info "Waiting for $name to shut down... ($cnt/$wait_until)"
+    fi
+
+    wait "$slp"
+    (( cnt++ ))
+
   done
 
-  if [ "$cnt" -ge "$QEMU_TIMEOUT" ]; then
+  finish "$code"
-    echo && error "Shutdown timeout reached, aborting..."
-  fi
-
-  finish "$code" && return "$code"
 }
 
-MON_OPTS="\
+! enabled "$SHUTDOWN" && return 0
-        -pidfile $QEMU_PID \
+[ -n "${QEMU_TIMEOUT:-}" ] && TIMEOUT="$QEMU_TIMEOUT"
-        -name $PROCESS,process=$PROCESS,debug-threads=on \
-        -monitor telnet:localhost:$MON_PORT,server,nowait,nodelay"
 
-if [[ "$CONSOLE" != [Yy]* ]]; then
+_trap graceful_shutdown SIGTERM SIGHUP SIGABRT SIGQUIT
-
-  MON_OPTS+=" -daemonize -D $QEMU_LOG"
-
-  _trap _graceful_shutdown SIGTERM SIGHUP SIGINT SIGABRT SIGQUIT
-
-fi
 
 return 0

src/proc.sh

@@ -3,17 +3,20 @@ set -Eeuo pipefail
 
 # Docker environment variables
 
-: "${KVM:="Y"}"
 : "${HOST_CPU:=""}"
 : "${CPU_FLAGS:=""}"
 : "${CPU_MODEL:=""}"
 
+HOST_CPU=$(strip "$HOST_CPU")
+CPU_FLAGS=$(strip "$CPU_FLAGS")
+CPU_MODEL=$(strip "$CPU_MODEL")
+
 CLOCKSOURCE="tsc"
 [[ "${ARCH,,}" == "arm64" ]] && CLOCKSOURCE="arch_sys_counter"
 CLOCK="/sys/devices/system/clocksource/clocksource0/current_clocksource"
 
 if [ ! -f "$CLOCK" ]; then
-  warn "file \"$CLOCK\" cannot not found?"
+  warn "file \"$CLOCK\" cannot be found?"
 else
   result=$(<"$CLOCK")
   result="${result//[![:print:]]/}"
@@ -26,62 +29,16 @@ else
   esac
 fi
 
-if [[ "$KVM" == [Nn]* ]]; then
+flags=$(sed -ne '/^flags/s/^.*: //p' /proc/cpuinfo)
-  warn "KVM acceleration is disabled, this will cause the machine to run about 10 times slower!"
-else
-  if [[ "${ARCH,,}" != "amd64" ]]; then
-    KVM="N"
-    warn "your CPU architecture is ${ARCH^^} and cannot provide KVM acceleration for x64 instructions, so the machine will run about 10 times slower."
-  fi
-fi
 
-if [[ "$KVM" != [Nn]* ]]; then
+if ! disabled "$KVM"; then
-
-  KVM_ERR=""
-
-  if [ ! -e /dev/kvm ]; then
-    KVM_ERR="(/dev/kvm is missing)"
-  else
-    if ! sh -c 'echo -n > /dev/kvm' &> /dev/null; then
-      KVM_ERR="(/dev/kvm is unwriteable)"
-    else
-      flags=$(sed -ne '/^flags/s/^.*: //p' /proc/cpuinfo)
-      if ! grep -qw "vmx\|svm" <<< "$flags"; then
-        KVM_ERR="(not enabled in BIOS)"
-      fi
-    fi
-  fi
-
-  if [ -n "$KVM_ERR" ]; then
-    KVM="N"
-    if [[ "$OSTYPE" =~ ^darwin ]]; then
-      warn "you are using macOS which has no KVM support, so the machine will run about 10 times slower."
-    else
-      kernel=$(uname -a)
-      case "${kernel,,}" in
-        *"microsoft"* )
-          error "Please bind '/dev/kvm' as a volume in the optional container settings when using Docker Desktop." ;;
-        *"synology"* )
-          error "Please make sure that Synology VMM (Virtual Machine Manager) is installed and that '/dev/kvm' is binded to this container." ;;
-        *)
-          error "KVM acceleration is not available $KVM_ERR, this will cause the machine to run about 10 times slower."
-          error "See the FAQ for possible causes, or disable acceleration by adding the \"KVM=N\" variable (not recommended)." ;;
-      esac
-      [[ "$DEBUG" != [Yy1]* ]] && exit 88
-    fi
-  fi
-
-fi
-
-if [[ "$KVM" != [Nn]* ]]; then
 
   CPU_FEATURES="kvm=on,l3-cache=on,+hypervisor"
   KVM_OPTS=",accel=kvm -enable-kvm -global kvm-pit.lost_tick_policy=discard"
 
   if ! grep -qw "sse4_2" <<< "$flags"; then
-    info "Your CPU does not have the SSE4 instruction set that Virtual DSM requires, it will be emulated..."
+    error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
-    [ -z "$CPU_MODEL" ] && CPU_MODEL="qemu64"
+    ! enabled "$DEBUG" && exit 88
-    CPU_FEATURES+=",+ssse3,+sse4.1,+sse4.2"
   fi
 
   if [ -z "$CPU_MODEL" ]; then

src/progress.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+info="/run/shm/msg.html"
+
 escape () {
     local s
     s=${1//&/\&}
@@ -11,28 +13,33 @@ escape () {
     return 0
 }
 
-file="$1"
+path="$1"
 total="$2"
 body=$(escape "$3")
-info="/run/shm/msg.html"
 
 if [[ "$body" == *"..." ]]; then
-  body="<p class=\"loading\">${body/.../}</p>"
+  body="<p class=\"loading\">${body::-3}</p>"
 fi
 
 while true
 do
-  if [ -s "$file" ]; then
+
-    bytes=$(du -sb "$file" | cut -f1)
+  if [ ! -s "$path" ] && [ ! -d "$path" ]; then
-    if (( bytes > 1000 )); then
+    bytes="0"
-      if [ -z "$total" ] || [[ "$total" == "0" ]]; then
+  else
-        size=$(numfmt --to=iec --suffix=B "$bytes" | sed -r 's/([A-Z])/ \1/')
+    bytes=$(du -sb "$path" | cut -f1)
-      else
-        size="$(echo "$bytes" "$total" | awk '{printf "%.1f", $1 * 100 / $2}')"
-        size="$size%"
-      fi
-      echo "${body//(\[P\])/($size)}"> "$info"
-    fi
   fi
+  
+  if (( bytes > 4096 )); then
+    if [ -z "$total" ] || [[ "$total" == "0" ]] || [ "$bytes" -gt "$total" ]; then
+      size=$(numfmt --to=iec --suffix=B "$bytes" | sed -r 's/([A-Z])/ \1/')
+    else
+      size="$(echo "$bytes" "$total" | awk '{printf "%.1f", $1 * 100 / $2}')"
+      size="$size%"
+    fi
+    [[ "$size" != "0.0%" ]] && echo "${body//(\[P\])/($size)}"> "$info"
+  fi
+
   sleep 1 & wait $!
+
 done

src/reset.sh

@@ -2,17 +2,17 @@
 set -Eeuo pipefail
 
 trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
-[[ "${TRACE:-}" == [Yy1]* ]] && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
+enabled "${TRACE:-}" && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
 
 [ ! -f "/run/entry.sh" ] && error "Script must be run inside the container!" && exit 11
 [ "$(id -u)" -ne "0" ] && error "Script must be executed with root privileges." && exit 12
 
 # Docker environment variables
 
-: "${TZ:=""}"              # System local timezone
+: "${TZ:=""}"              # System timezone
+: "${KVM:="Y"}"            # KVM acceleration
 : "${DEBUG:="N"}"          # Disable debugging mode
 : "${COUNTRY:=""}"         # Country code for mirror
-: "${CONSOLE:="N"}"        # Disable console mode
 : "${ALLOCATE:=""}"        # Preallocate diskspace
 : "${ARGUMENTS:=""}"       # Extra QEMU parameters
 : "${CPU_CORES:="2"}"      # Amount of CPU cores
@@ -21,27 +21,54 @@ trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
 : "${DISK_SIZE:="16G"}"    # Initial data disk size
 : "${STORAGE:="/storage"}" # Storage folder location
 
-# Helper variables
+# Sanitize variables
+TZ=$(strip "$TZ")
+STORAGE=$(strip "$STORAGE")
+COUNTRY=$(strip "$COUNTRY")
+DISK_SIZE=$(strip "$DISK_SIZE")
 
-PODMAN="N"
+# Helper variables
+ROOTLESS="N"
+PRIVILEGED="N"
 ENGINE="Docker"
 PROCESS="${APP,,}"
 PROCESS="${PROCESS// /-}"
 
 if [ -f "/run/.containerenv" ]; then
-  PODMAN="Y"
+  ENGINE="${container:-}"
-  ENGINE="Podman"
+  if [[ "${ENGINE,,}" == *"podman"* ]]; then
+    ROOTLESS="Y"
+    ENGINE="Podman"
+  else
+    [ -z "$ENGINE" ] && ENGINE="Kubernetes"
+  fi
 fi
 
-echo "❯ Starting $APP for $ENGINE v$(</run/version)..."
+echo "❯ Starting $APP for $ENGINE v$(</etc/version)..."
 echo "❯ For support visit $SUPPORT"
 
+# Get the capability bounding set
+CAP_BND=$(grep '^CapBnd:' /proc/$$/status | awk '{print $2}')
+CAP_BND=$(printf "%d" "0x${CAP_BND}")
+
+# Get the last capability number
+LAST_CAP=$(cat /proc/sys/kernel/cap_last_cap)
+
+# Calculate the maximum capability value
+MAX_CAP=$(((1 << (LAST_CAP + 1)) - 1))
+
+if [ "${CAP_BND}" -eq "${MAX_CAP}" ]; then
+  ROOTLESS="N"
+  PRIVILEGED="Y"
+fi
+
 INFO="/run/shm/msg.html"
 PAGE="/run/shm/index.html"
 TEMPLATE="/var/www/index.html"
-FOOTER1="$APP for $ENGINE v$(</run/version)"
+FOOTER1="$APP for $ENGINE v$(</etc/version)"
 FOOTER2="<a href='$SUPPORT'>$SUPPORT</a>"
 
+SOCKETS=1
 CPU=$(cpu)
 SYS=$(uname -r)
 HOST=$(hostname -s)
@@ -50,33 +77,39 @@ MINOR=$(echo "$SYS" | cut -d '.' -f2)
 ARCH=$(dpkg --print-architecture)
 CORES=$(grep -c '^processor' /proc/cpuinfo)
 
-if ! grep -qi "socket(s)" <<< "$(lscpu)"; then
+if grep -qi "socket(s)" <<< "$(lscpu)"; then
-  SOCKETS=1
+  SOCKETS=$(lscpu | grep -m 1 -i 'socket(s)' | awk '{print $2}')
-else
+  [ -z "${SOCKETS##*[!0-9]*}" ] && SOCKETS=1
-  SOCKETS=$(lscpu | grep -m 1 -i 'socket(s)' | awk '{print $(2)}')
+  [ "$SOCKETS" -lt "1" ] && SOCKETS=1
 fi
 
-CPU_CORES="${CPU_CORES// /}"
+CPU_CORES=$(strip "$CPU_CORES")
+[ -z "$CPU_CORES" ] && CPU_CORES=2
 [[ "${CPU_CORES,,}" == "max" ]] && CPU_CORES="$CORES"
-[ -n "${CPU_CORES//[0-9 ]}" ] && error "Invalid amount of CPU_CORES: $CPU_CORES" && exit 15
+[[ "${CPU_CORES,,}" == "half" ]] && CPU_CORES=$(( CORES / 2 ))
+[ -z "${CPU_CORES##*[!0-9]*}" ] && error "Invalid amount of CPU_CORES: $CPU_CORES" && exit 15
 
+[ "$CPU_CORES" -lt "1" ] && CPU_CORES=1
 if [ "$CPU_CORES" -gt "$CORES" ]; then
-  warn "The amount for CPU_CORES (${CPU_CORES}) exceeds the amount of physical cores, so will be limited to ${CORES}."
+  warn "The amount for CPU_CORES (${CPU_CORES}) exceeds the amount of logical cores available (${CORES}) and will be limited."
   CPU_CORES="$CORES"
 fi
 
 # Check system
 
+QEMU_DIR="/run/shm"
+
 if [ ! -d "/dev/shm" ]; then
   error "Directory /dev/shm not found!" && exit 14
 else
-  [ ! -d "/run/shm" ] && ln -s /dev/shm /run/shm
+  [ ! -d "$QEMU_DIR" ] && ln -s /dev/shm "$QEMU_DIR"
 fi
 
+QEMU_PID="$QEMU_DIR/qemu.pid"
+
 # Check folder
 
-if [[ "${COMMIT:-}" == [Yy1]* ]]; then
+if [[ "${STORAGE,,}" != "/storage" ]]; then
-  STORAGE="/local"
   mkdir -p "$STORAGE"
 fi
 
@@ -85,7 +118,9 @@ if [ ! -d "$STORAGE" ]; then
 fi
 
 if [ ! -w "$STORAGE" ]; then
-  error "Storage folder ($STORAGE) is not writeable!" && exit 13
+  msg="Storage folder ($STORAGE) is not writeable!"
+  msg+=" If SELinux is active, you need to add the \":Z\" flag to the bind mount."
+  error "$msg" && exit 13
 fi
 
 # Check filesystem
@@ -97,28 +132,29 @@ if [[ "${FS,,}" == "ecryptfs" || "${FS,,}" == "tmpfs" ]]; then
 fi
 
 # Read memory
-RAM_SPARE=500000000
 RAM_AVAIL=$(free -b | grep -m 1 Mem: | awk '{print $7}')
 RAM_TOTAL=$(free -b | grep -m 1 Mem: | awk '{print $2}')
 
+RAM_SPARE=500000000
+RAM_MINIMUM=136314880
+
+RAM_SIZE=$(strip "$RAM_SIZE")
 RAM_SIZE="${RAM_SIZE// /}"
-[ -z "$RAM_SIZE" ] && error "RAM_SIZE not specified!" && exit 16
+[ -z "$RAM_SIZE" ] && RAM_SIZE="2G"
+
+if [[ "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
+
+  if [ -z "${RAM_SIZE//[0-9. ]}" ]; then
+    [ "${RAM_SIZE%%.*}" -lt "130" ] && RAM_SIZE="${RAM_SIZE}G" || RAM_SIZE="${RAM_SIZE}M"
+  fi
+
+  RAM_SIZE=$(echo "${RAM_SIZE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
+  ! numfmt --from=iec "$RAM_SIZE" &>/dev/null && error "Invalid RAM_SIZE: $RAM_SIZE" && exit 16
+  wanted=$(numfmt --from=iec "$RAM_SIZE")
+  [ "$wanted" -lt "$RAM_MINIMUM" ] && error "RAM_SIZE is too low: $RAM_SIZE" && exit 16
 
-if [[ "${RAM_SIZE,,}" == "max" ]]; then
-  RAM_WANTED=$(( RAM_AVAIL - RAM_SPARE - RAM_SPARE ))
-  RAM_WANTED=$(( RAM_WANTED / 1073741825 ))
-  RAM_SIZE="${RAM_WANTED}G"
 fi
 
-if [ -z "${RAM_SIZE//[0-9. ]}" ]; then
-  [ "${RAM_SIZE%%.*}" -lt "130" ] && RAM_SIZE="${RAM_SIZE}G" || RAM_SIZE="${RAM_SIZE}M"
-fi
-
-RAM_SIZE=$(echo "${RAM_SIZE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
-! numfmt --from=iec "$RAM_SIZE" &>/dev/null && error "Invalid RAM_SIZE: $RAM_SIZE" && exit 16
-RAM_WANTED=$(numfmt --from=iec "$RAM_SIZE")
-[ "$RAM_WANTED" -lt "136314880 " ] && error "RAM_SIZE is too low: $RAM_SIZE" && exit 16
-
 # Print system info
 SYS="${SYS/-generic/}"
 FS="${FS/UNKNOWN //}"
@@ -132,109 +168,73 @@ TOTAL_MEM=$(formatBytes "$RAM_TOTAL" "up")
 echo "❯ CPU: ${CPU} | RAM: ${AVAIL_MEM/ GB/}/$TOTAL_MEM | DISK: $SPACE_GB (${FS}) | KERNEL: ${SYS}..."
 echo
 
-# Check available memory
+# Check KVM support
+
+if [[ "${PLATFORM,,}" == "x64" ]]; then
+  TARGET="amd64"
+else
+  TARGET="arm64"
+fi
+
+if disabled "$KVM"; then
+  warn "KVM acceleration is disabled, this will cause the machine to run about 10 times slower!"
+else
+  if [[ "${ARCH,,}" != "$TARGET" ]]; then
+    KVM="N"
+    warn "your CPU architecture is ${ARCH^^} and cannot provide KVM acceleration for ${PLATFORM^^} instructions, so the machine will run about 10 times slower."
+  fi
+fi
+
+if ! disabled "$KVM"; then
+
+  KVM_ERR=""
+
+  if [ ! -e /dev/kvm ]; then
+    KVM_ERR="(/dev/kvm is missing)"
+  else
+    if ! sh -c 'echo -n > /dev/kvm' &> /dev/null; then
+      KVM_ERR="(/dev/kvm is unwriteable)"
+    else
+      if [[ "${PLATFORM,,}" == "x64" ]]; then
+        flags=$(sed -ne '/^flags/s/^.*: //p' /proc/cpuinfo)
+        if ! grep -qw "vmx\|svm" <<< "$flags"; then
+          KVM_ERR="(not enabled in BIOS)"
+        fi
+        if ! grep -qw "sse4_2" <<< "$flags"; then
+          error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
+          ! enabled "$DEBUG" && exit 88
+        fi
+      fi
+    fi
+  fi
+
+  if [ -n "$KVM_ERR" ]; then
+    KVM="N"
+    if [[ "$OSTYPE" =~ ^darwin ]]; then
+      warn "you are using macOS which has no KVM support, so the machine will run about 10 times slower."
+    else
+      kernel=$(uname -a)
+      case "${kernel,,}" in
+        *"microsoft"* )
+          error "Please bind '/dev/kvm' as a volume in the optional container settings when using Docker Desktop." ;;
+        *"synology"* )
+          error "Please make sure that Synology VMM (Virtual Machine Manager) is installed and that '/dev/kvm' is binded to this container." ;;
+        *)
+          error "KVM acceleration is not available $KVM_ERR, this will cause the machine to run about 10 times slower."
+          error "See the FAQ for possible causes, or disable acceleration by adding the \"KVM=N\" variable (not recommended)." ;;
+      esac
+      ! enabled "$DEBUG" && exit 88
+    fi
+  fi
 
-if [[ "$RAM_CHECK" != [Nn]* ]] && (( (RAM_WANTED + RAM_SPARE) > RAM_AVAIL )); then
-  AVAIL_MEM=$(formatBytes "$RAM_AVAIL")
-  msg="Your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is too high for the $AVAIL_MEM of memory available, please set a lower value."
-  [[ "${FS,,}" != "zfs" ]] && error "$msg" && exit 17
-  info "$msg"
 fi
 
 # Cleanup files
-rm -f /run/shm/qemu.*
+rm -f "$QEMU_DIR"/dsm.url
-rm -f /run/shm/dsm.url
+rm -f "$QEMU_DIR"/qemu.* "$QEMU_DIR"/*.pid "$QEMU_DIR"/*.sock
 
 # Cleanup dirs
 rm -rf /tmp/dsm
 rm -rf "$STORAGE/tmp"
 
-getCountry() {
-  local url=$1
-  local query=$2
-  local rc json result
-
-  { json=$(curl -m 5 -H "Accept: application/json" -sfk "$url"); rc=$?; } || :
-  (( rc != 0 )) && return 0
-
-  { result=$(echo "$json" | jq -r "$query" 2> /dev/null); rc=$?; } || :
-  (( rc != 0 )) && return 0
-
-  [[ ${#result} -ne 2 ]] && return 0
-  [[ "${result^^}" == "XX" ]] && return 0
-
-  COUNTRY="${result^^}"
-
-  return 0
-}
-
-setCountry() {
-
-  [[ "${TZ,,}" == "asia/harbin" ]] && COUNTRY="CN"
-  [[ "${TZ,,}" == "asia/beijing" ]] && COUNTRY="CN"
-  [[ "${TZ,,}" == "asia/urumqi" ]] && COUNTRY="CN"
-  [[ "${TZ,,}" == "asia/kashgar" ]] && COUNTRY="CN"
-  [[ "${TZ,,}" == "asia/shanghai" ]] && COUNTRY="CN"
-  [[ "${TZ,,}" == "asia/chongqing" ]] && COUNTRY="CN"
-
-  [ -z "$COUNTRY" ] && getCountry "https://api.ipapi.is" ".location.country_code"
-  [ -z "$COUNTRY" ] && getCountry "https://ifconfig.co/json" ".country_iso"
-  [ -z "$COUNTRY" ] && getCountry "https://api.ip2location.io" ".country_code"
-  [ -z "$COUNTRY" ] && getCountry "https://ipinfo.io/json" ".country"
-  [ -z "$COUNTRY" ] && getCountry "https://api.ipquery.io/?format=json" ".location.country_code" 
-  [ -z "$COUNTRY" ] && getCountry "https://api.myip.com" ".cc"
-
-  return 0
-}
-
-addPackage() {
-  local pkg=$1
-  local desc=$2
-
-  if apt-mark showinstall | grep -qx "$pkg"; then
-    return 0
-  fi
-
-  MSG="Installing $desc..."
-  info "$MSG" && html "$MSG"
-
-  [ -z "$COUNTRY" ] && setCountry
-
-  if [[ "${COUNTRY^^}" == "CN" ]]; then
-    sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list.d/debian.sources
-  fi
-
-  DEBIAN_FRONTEND=noninteractive apt-get -qq update
-  DEBIAN_FRONTEND=noninteractive apt-get -qq --no-install-recommends -y install "$pkg" > /dev/null
-
-  return 0
-}
-
-: "${COM_PORT:="2210"}"    # Comm port
-: "${MON_PORT:="7100"}"    # Monitor port
-: "${WEB_PORT:="5000"}"    # Webserver port
-: "${CHR_PORT:="12345"}"   # Character port
-
-cp -r /var/www/* /run/shm
-html "Starting $APP for $ENGINE..."
-
-if [[ "${WEB:-}" != [Nn]* ]]; then
-
-  mkdir -p /etc/nginx/sites-enabled
-  cp /etc/nginx/default.conf /etc/nginx/sites-enabled/web.conf
-
-  sed -i "s/listen 5000 default_server;/listen $WEB_PORT default_server;/g" /etc/nginx/sites-enabled/web.conf
-  
-  # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
-
-    sed -i "s/listen $WEB_PORT default_server;/listen [::]:$WEB_PORT default_server ipv6only=off;/g" /etc/nginx/sites-enabled/web.conf
-
-  fi
-  
-  # Start webserver
-  nginx -e stderr
-
-fi
-
 return 0

src/serial.sh

@@ -5,10 +5,16 @@ set -Eeuo pipefail
 
 : "${HOST_MAC:=""}"
 : "${HOST_DEBUG:=""}"
-: "${HOST_SERIAL:=""}"
 : "${HOST_MODEL:=""}"
+: "${HOST_SERIAL:=""}"
 : "${GUEST_SERIAL:=""}"
 
+# Sanitize variables
+HOST_MAC=$(strip "$HOST_MAC")
+HOST_MODEL=$(strip "$HOST_MODEL")
+HOST_SERIAL=$(strip "$HOST_SERIAL")
+GUEST_SERIAL=$(strip "$GUEST_SERIAL")
+
 if [ -n "$HOST_MAC" ]; then
 
   HOST_MAC="${HOST_MAC//-/:}"
@@ -24,6 +30,8 @@ if [ -n "$HOST_MAC" ]; then
 
 fi
 
+HOST_PID="$QEMU_DIR/host.pid"
+
 HOST_ARGS=()
 HOST_ARGS+=("-cpu=$CPU_CORES")
 HOST_ARGS+=("-cpu_arch=$HOST_CPU")
@@ -33,13 +41,15 @@ HOST_ARGS+=("-cpu_arch=$HOST_CPU")
 [ -n "$HOST_SERIAL" ] && HOST_ARGS+=("-hostsn=$HOST_SERIAL")
 [ -n "$GUEST_SERIAL" ] && HOST_ARGS+=("-guestsn=$GUEST_SERIAL")
 
-if [[ "$HOST_DEBUG" == [Yy1]* ]]; then
+if enabled "$HOST_DEBUG"; then
   set -x
   ./host.bin "${HOST_ARGS[@]}" &
   { set +x; } 2>/dev/null
+  echo "$!" > "$HOST_PID"
   echo
 else
   ./host.bin "${HOST_ARGS[@]}" >/dev/null &
+  echo "$!" > "$HOST_PID"
 fi
 
 cnt=0
@@ -60,14 +70,7 @@ while ! nc -z -w2 127.0.0.1 "$CHR_PORT" > /dev/null 2>&1; do
 done
 
 # Configure serial ports
-
+SERIAL_OPTS="-serial mon:stdio \
-if [[ "$CONSOLE" != [Yy]* ]]; then
-  SERIAL_OPTS="-serial pty"
-else
-  SERIAL_OPTS="-serial mon:stdio"
-fi
-
-SERIAL_OPTS+=" \
         -device virtio-serial-pci,id=virtio-serial0,bus=pcie.0,addr=0x3 \
         -chardev socket,id=charchannel0,host=127.0.0.1,port=$CHR_PORT,reconnect=10 \
         -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=vchannel"

src/server.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+: "${COM_PORT:="2210"}"    # Comm port
+: "${WEB_PORT:="5000"}"    # Webserver port
+: "${CHR_PORT:="12345"}"   # Character port
+: "${WSD_PORT:="8004"}"    # Websockets port
+
+# Sanitize port variables
+COM_PORT=$(strip "$COM_PORT")
+WEB_PORT=$(strip "$WEB_PORT")
+CHR_PORT=$(strip "$CHR_PORT")
+WSD_PORT=$(strip "$WSD_PORT")
+
+WEB_PID="/run/nginx.pid"
+WSD_PID="$QEMU_DIR/websocketd.pid"
+
+cp -r /var/www/* "$QEMU_DIR"
+rm -f "$WSD_PID" "$WEB_PID"
+
+html "Starting $APP for $ENGINE..."
+
+if ! disabled "${WEB:-}"; then
+
+  mkdir -p /etc/nginx/sites-enabled
+  cp /etc/nginx/default.conf /etc/nginx/sites-enabled/web.conf
+
+  sed -i "s/listen 5000 default_server;/listen $WEB_PORT default_server;/g" /etc/nginx/sites-enabled/web.conf
+  sed -i "s/proxy_pass http:\/\/127.0.0.1:8004\/;/proxy_pass http:\/\/127.0.0.1:$WSD_PORT\/;/g" /etc/nginx/sites-enabled/web.conf
+
+  # shellcheck disable=SC2143
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+
+    sed -i "s/listen $WEB_PORT default_server;/listen [::]:$WEB_PORT default_server ipv6only=off;/g" /etc/nginx/sites-enabled/web.conf
+
+  fi
+
+  # Start webserver
+  nginx -e stderr
+
+  # Start websocket server
+  websocketd --address 127.0.0.1 --port="$WSD_PORT" /run/socket.sh >/var/log/websocketd.log &
+  echo "$!" > "$WSD_PID"
+
+fi
+
+return 0

src/socket.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+lastmsg=""
+path="/run/shm/msg.html"
+
+refresh() {
+
+  [ ! -f "$path" ] && return 0
+  [ ! -s "$path" ] && return 0
+
+  msg=$(< "$path")
+  msg="${msg%$'\n'}"
+
+  [ -z "$msg" ] && return 0
+  [[ "$msg" == "$lastmsg" ]] && return 0
+
+  lastmsg="$msg"
+  echo "s: $msg"
+  return 0
+}
+
+refresh
+
+inotifywait -m "$path" |
+  while read -r fp event fn; do
+    case "${event,,}" in
+      "modify"* ) refresh ;;
+      "delete_self" ) echo "c: vnc" ;;
+    esac    
+  done

src/start.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-# Override this placeholder file using a Docker bind to execute a script during startup!
+# You can override this hook to execute a script before startup!
+
+return 0

src/utils.sh

@@ -7,6 +7,40 @@ info () { printf "%b%s%b" "\E[1;34m❯ \E[1;36m" "${1:-}" "\E[0m\n"; }
 error () { printf "%b%s%b" "\E[1;31m❯ " "ERROR: ${1:-}" "\E[0m\n" >&2; }
 warn () { printf "%b%s%b" "\E[1;31m❯ " "Warning: ${1:-}" "\E[0m\n" >&2; }
 
+strip() {
+  local value="${1:-}"
+
+  # Remove surrounding whitespace
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  # Remove leading/trailing single/double quotes
+  value="${value%\"}"
+  value="${value#\"}"
+  value="${value%\'}"
+  value="${value#\'}"
+
+  # Remove surrounding whitespace again
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  printf '%s' "$value"
+}
+
+enabled() {
+  case "$(strip "${1:-}")" in
+    Y|y|YES|Yes|yes|TRUE|True|true|1|ON|On|on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+disabled() {
+  case "$(strip "${1:-}")" in
+    N|n|NO|No|no|FALSE|False|false|0|OFF|Off|off) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 formatBytes() {
   local result
   result=$(numfmt --to=iec --suffix=B "$1" | sed -r 's/([A-Z])/ \1/' | sed 's/ B/ bytes/g;')
@@ -28,6 +62,7 @@ formatBytes() {
 
 isAlive() {
   local pid="$1"
+  [ -z "$pid" ] && return 1
 
   if kill -0 "$pid" 2>/dev/null; then
     return 0
@@ -36,23 +71,67 @@ isAlive() {
   return 1
 }
 
-pKill() {
+waitPid() {
+  local i=0
   local pid="$1"
+  local timeout="${2:-10}"
 
-  { kill -15 "$pid" || true; } 2>/dev/null
+  while [ -n "$pid" ] && isAlive "$pid"; do
-
-  while isAlive "$pid"; do
     sleep 0.2
+    i=$((i + 1))
+    (( i >= timeout * 5 )) && return 1
   done
 
   return 0
 }
 
+waitPidFile() {
+  local i=0
+  local pid=""
+  local file="$1"
+  local timeout="${2:-10}"
+
+  [ ! -s "$file" ] && return 0
+  ! read -r pid <"$file" && return 0
+  [ -z "$pid" ] && return 0
+
+  while [ -s "$file" ] && isAlive "$pid"; do
+    sleep 0.2
+    i=$((i + 1))
+    (( i >= timeout * 5 )) && return 1
+  done
+
+  rm -f -- "$file"
+  return 0
+}
+
+pKill() {
+  local pid="$1"
+  local timeout="${2:-10}"
+
+  { kill -15 -- "$pid" || :; } 2>/dev/null
+
+  if ! waitPid "$pid" "$timeout"; then
+    warn "Timed out while waiting for PID $pid"
+  fi
+
+  return 0
+}
+
 fWait() {
+  local i=0
   local name="$1"
+  local timeout="${2:-10}"
+
+  [ -z "$name" ] && return 0
 
   while pgrep -f -l "$name" >/dev/null; do
     sleep 0.2
+    i=$((i + 1))
+    if (( i >= timeout * 5 )); then
+      warn "Timed out while waiting for process: $name"
+      break
+    fi
   done
 
   return 0
@@ -60,9 +139,75 @@ fWait() {
 
 fKill() {
   local name="$1"
+  local timeout="${2:-10}"
 
-  { pkill -f "$name" || true; } 2>/dev/null
+  [ -z "$name" ] && return 0
-  fWait "$name"
+
+  { pkill -f "$name" || :; } 2>/dev/null
+  fWait "$name" "$timeout"
+
+  return 0
+}
+
+sKill() {
+  local pid=""
+  local file="$1"
+
+  [ ! -s "$file" ] && return 0
+  ! read -r pid <"$file" && return 0
+  [ -z "$pid" ] && return 0
+
+  if isAlive "$pid"; then
+    { kill -15 -- "$pid" || :; } 2>/dev/null
+  fi
+
+  return 0
+}
+
+mKill() {
+  local timeout=10
+  local files=("$@")
+
+  for file in "${files[@]}"; do
+    sKill "$file"
+  done
+
+  for file in "${files[@]}"; do
+    if ! waitPidFile "$file" "$timeout"; then
+      warn "Timed out while waiting for PID file: $file"
+    fi
+  done
+
+  return 0
+}
+
+setOwner() {
+  local file="$1"
+  local dir uid gid
+
+  [ ! -f "$file" ] && return 1
+
+  dir=$(dirname -- "$file")
+  uid=$(stat -c '%u' "$dir")
+  gid=$(stat -c '%g' "$dir")
+
+  ! chown "$uid:$gid" "$file" && return 1
+
+  return 0
+}
+
+makeDir() {
+  local path="$1"
+  local dir uid gid
+
+  [ -d "$path" ] && return 0
+  ! mkdir -p "$path" && return 1
+
+  dir=$(dirname -- "$path")
+  uid=$(stat -c '%u' "$dir")
+  gid=$(stat -c '%g' "$dir")
+
+  ! chown "$uid:$gid" "$path" && return 1
 
   return 0
 }
@@ -123,11 +268,11 @@ cpu() {
   fi
 
   cpu="${cpu// CPU/}"
-  cpu="${cpu// [0-9] Core}"
-  cpu="${cpu// [0-9][0-9] Core}"
   cpu="${cpu// [0-9][0-9][0-9] Core}"
-  cpu="${cpu//[0-9]th Gen }"
+  cpu="${cpu// [0-9][0-9] Core}"
+  cpu="${cpu// [0-9] Core}"
   cpu="${cpu//[0-9][0-9]th Gen }"
+  cpu="${cpu//[0-9]th Gen }"
   cpu="${cpu// Processor/}"
   cpu="${cpu// Quad core/}"
   cpu="${cpu// Dual core/}"
@@ -147,6 +292,8 @@ cpu() {
 
 hasDisk() {
 
+  enabled "${DISK_DISABLE:-}" && return 1
+
   [ -b "/disk" ] && return 0
   [ -b "/disk1" ] && return 0
   [ -b "/dev/disk1" ] && return 0
@@ -159,4 +306,65 @@ hasDisk() {
   return 1
 }
 
+getCountry() {
+  local url=$1
+  local query=$2
+  local rc json result
+
+  { json=$(curl -m 5 -H "Accept: application/json" -sfk "$url"); rc=$?; } || :
+  (( rc != 0 )) && return 0
+
+  { result=$(echo "$json" | jq -r "$query" 2> /dev/null); rc=$?; } || :
+  (( rc != 0 )) && return 0
+
+  [[ ${#result} -ne 2 ]] && return 0
+  [[ "${result^^}" == "XX" ]] && return 0
+
+  COUNTRY="${result^^}"
+
+  return 0
+}
+
+setCountry() {
+
+  [[ "${TZ,,}" == "asia/harbin" ]] && COUNTRY="CN"
+  [[ "${TZ,,}" == "asia/beijing" ]] && COUNTRY="CN"
+  [[ "${TZ,,}" == "asia/urumqi" ]] && COUNTRY="CN"
+  [[ "${TZ,,}" == "asia/kashgar" ]] && COUNTRY="CN"
+  [[ "${TZ,,}" == "asia/shanghai" ]] && COUNTRY="CN"
+  [[ "${TZ,,}" == "asia/chongqing" ]] && COUNTRY="CN"
+
+  [ -z "$COUNTRY" ] && getCountry "https://api.ipapi.is" ".location.country_code"
+  [ -z "$COUNTRY" ] && getCountry "https://ifconfig.co/json" ".country_iso"
+  [ -z "$COUNTRY" ] && getCountry "https://api.ip2location.io" ".country_code"
+  [ -z "$COUNTRY" ] && getCountry "https://ipinfo.io/json" ".country"
+  [ -z "$COUNTRY" ] && getCountry "https://api.ipquery.io/?format=json" ".location.country_code" 
+  [ -z "$COUNTRY" ] && getCountry "https://api.myip.com" ".cc"
+
+  return 0
+}
+
+addPackage() {
+  local pkg=$1
+  local desc=$2
+
+  if apt-mark showinstall | grep -qx "$pkg"; then
+    return 0
+  fi
+
+  MSG="Installing $desc..."
+  info "$MSG" && html "$MSG"
+
+  [ -z "$COUNTRY" ] && setCountry
+
+  if [[ "${COUNTRY^^}" == "CN" ]]; then
+    sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list.d/debian.sources
+  fi
+
+  DEBIAN_FRONTEND=noninteractive apt-get -qq update
+  DEBIAN_FRONTEND=noninteractive apt-get -qq --no-install-recommends -y install "$pkg" > /dev/null
+
+  return 0
+}
+
 return 0

web/conf/nginx.conf

@@ -27,4 +27,18 @@ server {
       index index.html;
 
     }
+
+    location /status {
+
+      proxy_http_version 1.1;
+
+      proxy_set_header Connection 'upgrade';
+      proxy_set_header Upgrade $http_upgrade;
+
+      proxy_buffering off;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+
+      proxy_pass http://127.0.0.1:8004/;
+    }    
 }

web/js/script.js

@@ -1,4 +1,5 @@
 var request;
+var booting = false;
 var interval = 1000;
 
 function getInfo() {
@@ -6,11 +7,14 @@ function getInfo() {
     var url = "msg.html";
 
     try {
+        if (request) {
+            request.abort();
+        }
 
         if (window.XMLHttpRequest) {
             request = new XMLHttpRequest();
         } else {
-            throw "XMLHttpRequest not available!";
+            throw new Error("XMLHttpRequest not available!");
         }
 
         request.onreadystatechange = processInfo;
@@ -18,22 +22,49 @@ function getInfo() {
         request.send();
 
     } catch (e) {
-        var err = "Error: " + e.message;
+        setError("Error: " + e.message);
-        console.log(err);
-        setError(err);
     }
 }
 
+function getURL() {
+
+    var protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
+    var path = window.location.pathname.replace(/[^/]*$/, '').replace(/\/$/, '');
+
+    return protocol + "//" + window.location.host + path;
+}
+
+function processMsg(msg) {
+
+    if (msg.toLowerCase().indexOf("href=") !== -1) {
+        var div = document.createElement("div");
+        div.innerHTML = msg;
+        var url = div.querySelector("a").href;
+        setTimeout(() => {
+            window.location.assign(url);
+        }, 3000);
+    }
+
+    setInfo(msg);
+    return true;
+}
+
 function processInfo() {
     try {
+
         if (request.readyState != 4) {
             return true;
         }
 
         var msg = request.responseText;
         if (msg == null || msg.length == 0) {
-            setInfo("Booting DSM instance", true);
+
-            schedule();
+            if (booting) {
+                schedule();
+                return true;
+            }
+
+            window.location.reload();
             return false;
         }
 
@@ -43,20 +74,11 @@ function processInfo() {
             if (msg.toLowerCase().indexOf("<html>") !== -1) {
                 notFound = true;
             } else {
-                if (msg.toLowerCase().indexOf("href=") !== -1) {
+                processMsg(msg);
-                    var div = document.createElement("div");
+                if (msg.toLowerCase().indexOf("href=") == -1) {
-                    div.innerHTML = msg;
-                    var url = div.querySelector("a").href;
-                    setTimeout(() => {
-                        window.location.assign(url);
-                    }, 3000);
-                    setInfo(msg);
-                    return true;
-                } else {
-                    setInfo(msg);
                     schedule();
-                    return true;
                 }
+                return true;
             }
         }
 
@@ -67,44 +89,60 @@ function processInfo() {
         }
 
         setError("Error: Received statuscode " + request.status);
-        schedule();
         return false;
 
     } catch (e) {
-        var err = "Error: " + e.message;
+        setError("Error: " + e.message);
-        console.log(err);
-        setError(err);
         return false;
     }
 }
 
-function setInfo(msg, loading, error) {
+function extractContent(s) {
+    var span = document.createElement('span');
+    span.innerHTML = s;
+    return span.textContent || span.innerText;
+};
 
+function setInfo(msg, loading, error) {
     try {
+
         if (msg == null || msg.length == 0) {
             return false;
         }
 
-        var el = document.getElementById("spinner");
+        if (msg.includes("Booting ")) {
+            booting = true;
+        }
+
+        var el = document.getElementById("info");
+
+        if (el.innerText == msg || el.innerHTML == msg) {
+            return true;
+        }
+
+        var spin = document.getElementById("spinner");
 
         error = !!error;
         if (!error) {
-            el.style.visibility = 'visible';
+            spin.style.visibility = 'visible';
         } else {
-            el.style.visibility = 'hidden';
+            spin.style.visibility = 'hidden';
         }
 
+        var p = "<p class=\"loading\">";
         loading = !!loading;
         if (loading) {
-            msg = "<p class=\"loading\">" + msg + "</p>";
+            msg = p + msg + "</p>";
         }
 
-        el = document.getElementById("info");
+        if (msg.includes(p)) {
-
+            if (el.innerHTML.includes(p)) {
-        if (el.innerHTML != msg) {
+                el.getElementsByClassName('loading')[0].textContent = extractContent(msg);
-            el.innerHTML = msg;
+                return true;
+            }
         }
 
+        el.innerHTML = msg;
         return true;
 
     } catch (e) {
@@ -114,6 +152,7 @@ function setInfo(msg, loading, error) {
 }
 
 function setError(text) {
+    console.warn(text);
     return setInfo(text, false, true);
 }
 
@@ -123,8 +162,47 @@ function schedule() {
 
 function reload() {
     setTimeout(() => {
-        document.location.reload();
+        window.location.reload();
     }, 3000);
 }
 
+function connect() {
+
+    var wsUrl = getURL() + "/status";
+    var ws = new WebSocket(wsUrl);
+
+    ws.onmessage = function(e) {
+
+        var pos = e.data.indexOf(":");
+        var cmd = e.data.substring(0, pos);
+        var msg = e.data.substring(pos + 2);
+
+        switch (cmd) {
+            case "s":
+                processMsg(msg);
+                break;
+            case "e":
+                setError(msg);
+                break;
+            default:
+                console.warn("Unknown event: " + cmd);
+                break;
+        }
+    };
+
+    ws.onclose = function(e) {
+        setTimeout(function() {
+            connect();
+        }, interval);
+    };
+
+    ws.onerror = function(e) {
+        ws.close();
+        if (!booting) {
+            window.location.reload();
+        }
+    };
+}
+
 schedule();
+connect();