feat: Sanitize environment variables (#1192)

Added strip function to remove whitespace and quotes.

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "Virtual DSM",
-  "service": "vdsm",
+  "service": "dsm",
   "forwardPorts": [5000],
   "portsAttributes": {
     "5000": {
@@ -11,7 +11,5 @@
   "otherPortsAttributes": {
     "onAutoForward": "ignore"
   }, 
-  "dockerComposeFile": "codespaces.yml",
-  "workspaceFolder": "/workspaces/vdsm",
-  "initializeCommand": "docker system prune --all --force"
+  "dockerComposeFile": "codespaces.yml"
 }

.github/workflows/build.yml

@@ -22,13 +22,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       -
         name: Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           context: git
           images: |
@@ -43,23 +43,23 @@ jobs:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       - 
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login into Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true

.github/workflows/check.yml

@@ -7,9 +7,10 @@ jobs:
     name: shellcheck
     runs-on: ubuntu-latest
     steps:
-      - 
-        name: Checkout
-        uses: actions/checkout@v5
+    - 
+      name: Checkout
+      uses: actions/checkout@v7
+    - parallel:
       -
         name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
@@ -24,6 +25,6 @@ jobs:
           failure-threshold: warning
       -
         name: Validate JSON and YML files
-        uses: GrantBirki/json-yaml-validate@v4
+        uses: GrantBirki/json-yaml-validate@v5.0.0
         with:
           yaml_exclude_regex: ".*\\kubernetes\\.yml$"

.github/workflows/hub.yml

@@ -12,13 +12,15 @@ jobs:
   dockerHubDescription:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
-    - 
-      name: Docker Hub Description
-      uses: peter-evans/dockerhub-description@v5
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-        repository: ${{ secrets.DOCKERHUB_REPO }}
-        short-description: ${{ github.event.repository.description }}
-        readme-filepath: ./readme.md
+      -
+        name: Checkout repo
+        uses: actions/checkout@v7
+      - 
+        name: Docker Hub Description
+        uses: peter-evans/dockerhub-description@v5
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: ${{ secrets.DOCKERHUB_REPO }}
+          short-description: ${{ github.event.repository.description }}
+          readme-filepath: ./readme.md

.github/workflows/review.yml

@@ -13,9 +13,10 @@ jobs:
     name: review
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v5
+    -
+      name: Checkout
+      uses: actions/checkout@v7
+    - parallel:
       -
         name: Spelling
         uses: reviewdog/action-misspell@v1
@@ -26,41 +27,45 @@ jobs:
             *.md
             *.sh
           reporter: github-pr-review
-          github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Hadolint
         uses: reviewdog/action-hadolint@v1
         with:
           level: warning
+          fail_level: error
           reporter: github-pr-review
           hadolint_ignore: DL3008 DL3003 DL3006 DL3013
-          github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       -
         name: YamlLint
         uses: reviewdog/action-yamllint@v1
         with:
           level: warning
           reporter: github-pr-review
-          github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       -
         name: ActionLint
         uses: reviewdog/action-actionlint@v1
         with:
           level: warning
           reporter: github-pr-review
-          github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Shellformat
         uses: reviewdog/action-shfmt@v1
+        if: false
         with:
           level: warning
+          fail_on_error: "true"
           shfmt_flags: "-i 2 -ci -bn"
-          github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Shellcheck
         uses: reviewdog/action-shellcheck@v1
         with:
           level: warning
+          fail_level: error
           reporter: github-pr-review
-          shellcheck_flags: -x -e SC2001 -e SC2034 -e SC2064 -e SC2317 -e SC2153 -e SC2028          
-          github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          shellcheck_flags: -x -e SC1091 -e SC2001 -e SC2034 -e SC2064 -e SC2317 -e SC2153 -e SC2028
+          github_token: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -1,19 +1,13 @@
 # syntax=docker/dockerfile:1
 
 FROM qemux/qemu-host:2.05 AS builder
-
-#  FROM golang as builder
-#  WORKDIR /
-#  RUN git clone https://github.com/qemus/qemu-host.git
-#  WORKDIR /qemu-host/src
-#  RUN go mod download
-#  RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o /qemu-host.bin .
-
 FROM debian:trixie-slim
 
 ARG TARGETARCH
 ARG TARGETPLATFORM
 ARG VERSION_ARG="0.0"
+ARG VERSION_PASST="2026_06_11"
+
 ARG DEBCONF_NOWARNINGS="yes"
 ARG DEBIAN_FRONTEND="noninteractive"
 ARG DEBCONF_NONINTERACTIVE_SEEN="true"
@@ -39,7 +33,7 @@ RUN set -eu && \
         iproute2 \
         dnsmasq \
         fakeroot \
-        apt-utils \        
+        apt-utils \
         net-tools \
         e2fsprogs \
         qemu-utils \
@@ -49,7 +43,7 @@ RUN set -eu && \
         ca-certificates \
         netcat-openbsd \
         qemu-system-x86 && \
-    wget "https://github.com/qemus/passt/releases/download/v2025_09_19/passt_2025_09_19_${TARGETARCH}.deb" -O /tmp/passt.deb -q && \
+    wget "https://github.com/qemus/passt/releases/download/v${VERSION_PASST}/passt_${VERSION_PASST}_${TARGETARCH}.deb" -O /tmp/passt.deb -q --timeout=10 && \
     dpkg -i /tmp/passt.deb && \
     apt-get clean && \
     pip3 install --no-cache-dir --break-system-packages --root-user-action=ignore dissect.cstruct && \
@@ -57,7 +51,7 @@ RUN set -eu && \
     echo "allow br0" > /etc/qemu/bridge.conf && \
     unlink /etc/nginx/sites-enabled/default && \
     sed -i 's/^worker_processes.*/worker_processes 1;/' /etc/nginx/nginx.conf && \
-    echo "$VERSION_ARG" > /run/version && \
+    echo "$VERSION_ARG" > /etc/version && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 COPY --chmod=755 ./src /run/

readme.md

@@ -18,11 +18,11 @@ Virtual DSM in a Docker container.
 
  - Multiple disks
  - KVM acceleration
- - Upgrades supported
- 
+ - Automatic download
+
 ## Usage  🐳
 
-##### Via Docker Compose:
+##### Docker Compose:
 
 ```yaml
 services:
@@ -44,22 +44,31 @@ services:
     stop_grace_period: 2m
 ```
 
-##### Via Docker CLI:
+##### Docker CLI:
 
 ```bash
 docker run -it --rm --name dsm -e "DISK_SIZE=256G" -p 5000:5000 --device=/dev/kvm --device=/dev/net/tun --cap-add NET_ADMIN -v "${PWD:-.}/dsm:/storage" --stop-timeout 120 docker.io/vdsm/virtual-dsm
 ```
 
-##### Via Kubernetes:
+##### Kubernetes:
 
 ```shell
 kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/master/kubernetes.yml
 ```
 
-##### Via Github Codespaces:
+##### GitHub Codespaces:
 
 [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/vdsm/virtual-dsm)
 
+## Requirements ⚙️
+
+ - A Linux host with KVM support, or Docker Desktop / Podman on Windows 11 with nested virtualization enabled.
+ - At least 2 GB of RAM available.
+ - At least 32 GB of free disk space.
+
+> [!NOTE]
+> Docker Desktop on macOS and Windows 10 do not currently provide the required KVM support for this image.
+
 ## FAQ 💬
 
 ### How do I use it?
@@ -95,7 +104,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
   ```
   
 > [!TIP]
-> This can also be used to resize the existing disk to a larger capacity without any data loss.
+> This can also be used to resize an existing disk to a larger capacity without any data loss.
 
 ### How do I add multiple disks?
 
@@ -110,9 +119,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - ./example3:/storage3
   ```
 
-### How do I pass-through a disk?
+### How do I pass through a disk?
 
-   It is possible to pass-through disk devices or partitions directly by adding them to your compose file in this way:
+   You can pass through disk devices or partitions directly by adding them to your compose file in this way:
 
   ```yaml
   devices:
@@ -158,7 +167,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
   - you enabled "nested virtualization" if you are running the container inside a virtual machine.
 
-  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPS's.
+  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPSs.
 
   If you did not receive any error from `kvm-ok` but the container still complains about a missing KVM device, it could help to add `privileged: true` to your compose file (or `sudo` to your `docker` command) to rule out any permission issue.
 
@@ -214,9 +223,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - 'c *:* rwm'
   ```
 
-### How do I pass-through the GPU?
+### How do I pass through the GPU?
 
-  To pass-through your Intel GPU, add the following lines to your compose file:
+  To pass through your Intel GPU, add the following lines to your compose file:
 
   ```yaml
   environment:
@@ -254,12 +263,12 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
 ### Is this project legal?
 
-  Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project will be considered legal. 
+  Yes, this project contains only open-source code and does not distribute any material owned by Synology. Neither does it try to circumvent any copyright protection measures.
   
   However, by installing Synology's Virtual DSM, you must accept their end-user license agreement, which does not permit installation on non-Synology hardware. So only run this container on an official Synology NAS, as any other use will be a violation of their terms and conditions.
 
 ## Stars 🌟
-[![Stars](https://starchart.cc/vdsm/virtual-dsm.svg?variant=adaptive)](https://starchart.cc/vdsm/virtual-dsm)
+[![Stargazers](https://raw.githubusercontent.com/star-stats/stars/refs/heads/data/charts/vdsm-virtual-dsm.svg)](https://github.com/vdsm/virtual-dsm/stargazers)
 
 ## Disclaimer ⚖️
 

src/check.sh

@@ -4,15 +4,15 @@ set -Eeuo pipefail
 : "${DHCP:="N"}"
 : "${NETWORK:="Y"}"
 
-[ -f "/run/shm/qemu.end" ] && echo "QEMU is shutting down.." && exit 1
-[ ! -s "/run/shm/qemu.pid" ] && echo "QEMU is not running yet.." && exit 0
-[[ "$NETWORK" == [Nn]* ]] && echo "Networking is disabled.." && exit 0
+[ -f "/run/shm/qemu.end" ] && echo "QEMU is shutting down..." && exit 1
+[ ! -s "/run/shm/qemu.pid" ] && echo "QEMU is not running yet..." && exit 0
+[[ "$NETWORK" == [Nn]* ]] && echo "Networking is disabled." && exit 0
 
 file="/run/shm/dsm.url"
 address="/run/shm/qemu.ip"
 gateway="/run/shm/qemu.gw"
 
-[ ! -s  "$file" ] && echo "DSM has not enabled networking yet.." && exit 1
+[ ! -s  "$file" ] && echo "DSM has not enabled networking yet..." && exit 1
 
 location=$(<"$file")
 

src/config.sh

@@ -3,6 +3,7 @@ set -Eeuo pipefail
 
 DEF_OPTS="-nodefaults -boot strict=on"
 RAM_OPTS=$(echo "-m ${RAM_SIZE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
+MON_OPTS="-name $PROCESS,process=$PROCESS,debug-threads=on -pidfile $QEMU_PID"
 CPU_OPTS="-cpu $CPU_FLAGS -smp $CPU_CORES,sockets=1,dies=1,cores=$CPU_CORES,threads=1"
 MAC_OPTS="-machine type=q35,smm=off,usb=off,vmport=off,dump-guest-core=off,hpet=off${KVM_OPTS}"
 DEV_OPTS="-device virtio-balloon-pci,id=balloon0,bus=pcie.0,addr=0x4"

src/disk.sh

@@ -11,6 +11,15 @@ set -Eeuo pipefail
 : "${DISK_DISCARD:="on"}"         # Controls whether unmap (TRIM) commands are passed to the host.
 : "${DISK_ROTATION:="1"}"         # Rotation rate, set to 1 for SSD storage and increase for HDD
 
+# Sanitize all variables
+DISK_IO=$(strip "$DISK_IO")
+DISK_FMT=$(strip "$DISK_FMT")
+DISK_TYPE=$(strip "$DISK_TYPE")
+DISK_FLAGS=$(strip "$DISK_FLAGS")
+DISK_CACHE=$(strip "$DISK_CACHE")
+DISK_DISCARD=$(strip "$DISK_DISCARD")
+DISK_ROTATION=$(strip "$DISK_ROTATION")
+
 BOOT="$STORAGE/$BASE.boot.img"
 SYSTEM="$STORAGE/$BASE.system.img"
 
@@ -110,7 +119,7 @@ createDisk() {
 
   DATA_SIZE=$(numfmt --from=iec "$DISK_SPACE")
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -139,7 +148,7 @@ createDisk() {
         { chattr +C "$DISK_FILE"; } || :
       fi
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Create an empty file
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -198,7 +207,7 @@ resizeDisk() {
   local REQ=$(( DATA_SIZE - CUR_SIZE ))
   (( REQ < 1 )) && error "Shrinking disks is not supported yet, please increase ${DISK_DESC^^}_SIZE." && exit 71
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -221,7 +230,7 @@ resizeDisk() {
   case "${DISK_FMT,,}" in
     raw)
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Resize file by changing its length
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -264,17 +273,19 @@ convertDisk() {
   local FS="$7"
 
   [ -f "$DST_FILE" ] && error "Conversion failed, destination file $DST_FILE already exists?" && exit 79
-  [ ! -f "$SOURCE_FILE" ] && error "Conversion failed, source file $SOURCE_FILE does not exists?" && exit 79
+  [ ! -f "$SOURCE_FILE" ] && error "Conversion failed, source file $SOURCE_FILE does not exist?" && exit 79
 
   local TMP_FILE="$DISK_BASE.tmp"
   rm -f "$TMP_FILE"
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  local DIR FA
+  DIR=$(dirname "$TMP_FILE")
 
-    local DIR CUR_SIZE SPACE GB
+  if ! disabled "$ALLOCATE"; then
+
+    local CUR_SIZE SPACE GB
 
     # Check free diskspace
-    DIR=$(dirname "$TMP_FILE")
     CUR_SIZE=$(getSize "$SOURCE_FILE")
     SPACE=$(df --output=avail -B 1 "$DIR" | tail -n 1)
 
@@ -295,7 +306,7 @@ convertDisk() {
   isCow "$FS" && DISK_PARAM+=",nocow=on"
 
   if [[ "$DST_FMT" != "raw" ]]; then
-    if [[ "$ALLOCATE" == [Nn]* ]]; then
+    if disabled "$ALLOCATE"; then
       CONV_FLAGS+=" -c"
     fi
     [ -n "$DISK_FLAGS" ] && DISK_PARAM+=",$DISK_FLAGS"
@@ -308,7 +319,7 @@ convertDisk() {
   fi
 
   if [[ "$DST_FMT" == "raw" ]]; then
-    if [[ "$ALLOCATE" != [Nn]* ]]; then
+    if ! disabled "$ALLOCATE"; then
       # Work around qemu-img bug
       CUR_SIZE=$(stat -c%s "$TMP_FILE")
       if ! fallocate -l "$CUR_SIZE" "$TMP_FILE" &>/dev/null; then
@@ -346,7 +357,7 @@ checkFS () {
   DIR=$(dirname "$DISK_FILE")
   [ ! -d "$DIR" ] && return 0
 
-  if [[ "${FS,,}" == "overlay"* && "$PODMAN" != [Yy1]* ]]; then
+  if [[ "${FS,,}" == "overlay"* && "${ENGINE,,}" == "docker" ]]; then
     warn "the filesystem of $DIR is OverlayFS, this usually means it was binded to an invalid path!"
   fi
 
@@ -424,6 +435,20 @@ createDevice () {
   return 0
 }
 
+finishDisks () {
+
+  case "${DISK_TYPE,,}" in
+    "blk" | "scsi" | "virtio-blk" | "virtio-scsi" )
+      DISK_OPTS+=" -object iothread,id=io2" ;;
+  esac
+
+  if ! enabled "$DISK_DISABLE"; then
+    html "Initialized disks successfully..."
+  fi
+
+  return 0
+}
+
 addDisk () {
 
   local DISK_BASE="$1"
@@ -524,7 +549,7 @@ addDisk () {
 
   fi
 
-  if [ -f "$DISK_FILE" ] && [[ "$ALLOCATE" == [Nn]* ]]; then
+  if [ -f "$DISK_FILE" ] && disabled "$ALLOCATE"; then
 
     CUR_SIZE=$(getSize "$DISK_FILE")
     USED=$(du -sB 1 "$DISK_FILE" | cut -f1)
@@ -536,16 +561,15 @@ addDisk () {
       GB=$(formatBytes "$FREE")
       LEFT=$(formatBytes "$LEFT")
       CUR_SIZE=$(formatBytes "$CUR_SIZE")
-      msg="the virtual size of the ${DISK_DESC,,} is $CUR_SIZE"
+      msg="The virtual size of the ${DISK_DESC,,} is $CUR_SIZE"
 
-      if [[ "$USED" == "0" ]]; then
-        msg+=","
-      else
+      if [ -n "$USED" ] && [[ "$USED" != "0" ]]; then
         USED=$(formatBytes "$USED")
-        msg+=" (of which $USED is used),"
+        msg+=" (of which $USED is used)"
       fi
 
-      warn "$msg but there is only $GB of free space left in $DIR, make at least $LEFT more room available!"
+      info "$msg, but there is only $GB of free space remaining in $DIR now."
+      info "Please consider making at least $LEFT more space available in $DIR for future expansions."
 
     fi
 
@@ -573,18 +597,25 @@ addDevice () {
   [ ! -b "$DISK_DEV" ] && error "Device $DISK_DEV cannot be found! Please add it to the 'devices' section of your compose file." && exit 55
 
   local sectors=""
-  local result logical physical
-  result=$(fdisk -l "$DISK_DEV" | grep -m 1 -o "(logical/physical): .*" | cut -c 21-)
-  logical="${result%% *}"
-  physical=$(echo "$result" | grep -m 1 -o "/ .*" | cut -c 3-)
-  physical="${physical%% *}"
+  local dev_type=""
+  dev_type=$(lsblk -no TYPE "$DISK_DEV" 2>/dev/null | head -n1)
 
- if [ -n "$physical" ]; then
-    if [[ "$physical" != "512" ]]; then
-      sectors=",logical_block_size=$logical,physical_block_size=$physical"
+  # Only detect and apply sector sizes for partitions, not whole disks
+  # Whole disk passthrough with explicit sector sizes causes DSM not to recognize the disk
+  if [[ "$dev_type" == "part" ]]; then
+    local result logical physical
+    result=$(fdisk -l "$DISK_DEV" | grep -m 1 -o "(logical/physical): .*" | cut -c 21-)
+    logical="${result%% *}"
+    physical=$(echo "$result" | grep -m 1 -o "/ .*" | cut -c 3-)
+    physical="${physical%% *}"
+
+    if [ -n "$physical" ]; then
+      if [[ "$physical" != "512" ]]; then
+        sectors=",logical_block_size=$logical,physical_block_size=$physical"
+      fi
+    else
+      warn "Failed to determine the sector size for $DISK_DEV"
     fi
-  else
-    warn "Failed to determine the sector size for $DISK_DEV"
   fi
 
   DISK_OPTS+=$(createDevice "$DISK_DEV" "$DISK_TYPE" "$DISK_INDEX" "$DISK_ADDRESS" "raw" "$DISK_IO" "$DISK_CACHE" "" "$sectors")
@@ -592,13 +623,16 @@ addDevice () {
   return 0
 }
 
-msg="Initializing disks..."
-html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
-
 [ -z "${DISK_OPTS:-}" ] && DISK_OPTS=""
 [ -z "${DISK_TYPE:-}" ] && DISK_TYPE="scsi"
 [ -z "${DISK_NAME:-}" ] && DISK_NAME="data"
+[ -z "${DISK_DISABLE:-}" ] && DISK_DISABLE=""
+
+if ! enabled "$DISK_DISABLE"; then
+  msg="Initializing disks..."
+  html "$msg"
+  enabled "$DEBUG" && echo "$msg"
+fi
 
 case "${DISK_TYPE,,}" in
   "ide" | "sata" | "nvme" | "usb" | "scsi" | "blk" | "auto" | "none" ) ;;
@@ -609,7 +643,7 @@ if [ -z "$ALLOCATE" ]; then
   ALLOCATE="N"
 fi
 
-if [[ "$ALLOCATE" == [Nn]* ]]; then
+if disabled "$ALLOCATE"; then
   DISK_STYLE="growable"
   DISK_ALLOC="preallocation=off"
 else
@@ -620,38 +654,14 @@ fi
 DISK_OPTS+=$(createDevice "$BOOT" "$DISK_TYPE" "1" "0xa" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 DISK_OPTS+=$(createDevice "$SYSTEM" "$DISK_TYPE" "2" "0xb" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 
+if enabled "$DISK_DISABLE"; then
+  finishDisks
+  return 0
+fi
+
 DISK1_FILE="$STORAGE/${DISK_NAME}"
-if [ ! -f "$DISK1_FILE.img" ] && [ -f "$STORAGE/data${DISK_SIZE}.img" ]; then
-  # Fallback for legacy installs
-  mv "$STORAGE/data${DISK_SIZE}.img" "$DISK1_FILE.img"
-fi
-
 DISK2_FILE="/storage2/${DISK_NAME}2"
-if [ ! -f "$DISK2_FILE.img" ]; then
-  # Fallback for legacy installs
-  FALLBACK="/storage2/data.img"
-  if [[ -f "$DISK1_FILE.img" && -f "$FALLBACK" ]]; then
-    SIZE1=$(stat -c%s "$FALLBACK")
-    SIZE2=$(stat -c%s "$DISK1_FILE.img")
-    if [[ SIZE1 -ne SIZE2 ]]; then
-      mv "$FALLBACK" "$DISK2_FILE.img"
-    fi
-  fi
-fi
-
 DISK3_FILE="/storage3/${DISK_NAME}3"
-if [ ! -f "$DISK3_FILE.img" ]; then
-  # Fallback for legacy installs
-  FALLBACK="/storage3/data.img"
-  if [[ -f "$DISK1_FILE.img" && -f "$FALLBACK" ]]; then
-    SIZE1=$(stat -c%s "$FALLBACK")
-    SIZE2=$(stat -c%s "$DISK1_FILE.img")
-    if [[ SIZE1 -ne SIZE2 ]]; then
-      mv "$FALLBACK" "$DISK3_FILE.img"
-    fi
-  fi
-fi
-
 DISK4_FILE="/storage4/${DISK_NAME}4"
 
 : "${DISK2_SIZE:=""}"
@@ -698,7 +708,6 @@ else
   addDisk "$DISK4_FILE" "$DISK_TYPE" "disk4" "$DISK4_SIZE" "6" "0xf" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" || exit $?
 fi
 
-DISK_OPTS+=" -object iothread,id=io2"
+finishDisks
 
-html "Initialized disks successfully..."
 return 0

src/display.sh

@@ -8,9 +8,14 @@ set -Eeuo pipefail
 : "${DISPLAY:="none"}"  # Display type
 : "${RENDERNODE:="/dev/dri/renderD128"}"  # Render node
 
+# Sanitize variables
+VGA=$(strip "$VGA")
+DISPLAY=$(strip "$DISPLAY")
+RENDERNODE=$(strip "$RENDERNODE")
+
 CPU_VENDOR=$(lscpu | awk '/Vendor ID/{print $3}')
 
-if [[ "$GPU" != [Yy1]* || "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
+if ! enabled "$GPU" || [[ "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
 
   [[ "${DISPLAY,,}" == "none" ]] && VGA="none"
   DISPLAY_OPTS="-display $DISPLAY -vga $VGA"
@@ -20,7 +25,7 @@ fi
 
 msg="Configuring display drivers..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 DISPLAY_OPTS="-display egl-headless,rendernode=$RENDERNODE"
 DISPLAY_OPTS+=" -vga $VGA"

src/entry.sh

@@ -24,19 +24,23 @@ cd /run
 
 trap - ERR
 
-version=$(qemu-system-x86_64 --version | head -n 1 | cut -d '(' -f 1 | awk '{ print $NF }')
+cmd=(qemu-system-x86_64)
+version=$("${cmd[@]}" --version | awk 'NR==1 { print $4 }')
 info "Booting $APP using QEMU v$version..."
 
-if [[ "$CONSOLE" == [Yy]* ]]; then
-  exec qemu-system-x86_64 ${ARGS:+ $ARGS}
+if ! enabled "$SHUTDOWN"; then
+  exec "${cmd[@]}" ${ARGS:+ $ARGS}
 fi
 
-{ qemu-system-x86_64 ${ARGS:+ $ARGS} >"$QEMU_OUT" 2>"$QEMU_LOG"; rc=$?; } || :
-(( rc != 0 )) && error "$(<"$QEMU_LOG")" && exit 15
+if [ ! -t 1 ] || [ ! -c /dev/tty ]; then
+  "${cmd[@]}" ${ARGS:+ $ARGS} &
+else
+  "${cmd[@]}" ${ARGS:+ $ARGS} </dev/tty >/dev/tty &
+fi
 
-terminal
-tail -fn +0 "$QEMU_LOG" --pid=$$ 2>/dev/null &
-cat "$QEMU_TERM" 2>/dev/null & wait $! || :
+rc=0
+wait $! || rc=$?
+[ -f "$QEMU_END" ] && exit "$rc"
 
 sleep 1 & wait $!
-[ ! -f "$QEMU_END" ] && finish 0
+finish "$rc"

src/finish.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-if [[ "$DEBUG" == [Yy1]* ]]; then
+if enabled "$DEBUG"; then
   printf "QEMU arguments:\n\n%s\n\n" "${ARGS// -/$'\n-'}"
 fi
 

src/install.sh

@@ -27,11 +27,12 @@ FILE=$(find / -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ ! -s "$FILE" ] && FILE=$(find "$STORAGE" -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ -s "$FILE" ] && BASE="DSM_VirtualDSM" && URL="file://$FILE" 
 
+URL=$(strip "$URL")
+
 if [ -n "$URL" ] && [ ! -s "$FILE" ] && [ ! -d "$DIR" ]; then
   BASE=$(basename "$URL" .pat)
   if [ ! -s "$STORAGE/$BASE.system.img" ]; then
     BASE=$(basename "${URL%%\?*}" .pat)
-    BASE="${BASE//+/ }"
     printf -v BASE '%b' "${BASE//%/\\x}"
     BASE="${BASE//[!A-Za-z0-9._-]/_}"
   fi
@@ -66,7 +67,6 @@ fi
 
 if [ ! -s "$FILE" ]; then
   BASE=$(basename "${URL%%\?*}" .pat)
-  BASE="${BASE//+/ }"
   printf -v BASE '%b' "${BASE//%/\\x}"
   BASE="${BASE//[!A-Za-z0-9._-]/_}"
 fi
@@ -82,7 +82,7 @@ rm -f "$STORAGE/$BASE.system.img"
 # Check filesystem
 FS=$(stat -f -c %T "$STORAGE")
 
-if [[ "${FS,,}" == "overlay"* && "$PODMAN" != [Yy1]* ]]; then
+if [[ "${FS,,}" == "overlay"* && "${ENGINE,,}" == "docker" ]]; then
   warn "the filesystem of $STORAGE is OverlayFS, this usually means it was binded to an invalid path!"
 fi
 

src/memory.sh

@@ -1,14 +1,18 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+msg="Checking memory..."
+enabled "$DEBUG" && echo "$msg"
+
 RAM_AVAIL=$(free -b | grep -m 1 Mem: | awk '{print $7}')
+AVAIL_MEM=$(formatBytes "$RAM_AVAIL")
 
-if [[ "$RAM_CHECK" != [Nn]* && "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
+if ! disabled "$RAM_CHECK" && [[ "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
 
-  AVAIL_MEM=$(formatBytes "$RAM_AVAIL")
+  wanted=$(numfmt --from=iec "$RAM_SIZE")
 
-  if (( (RAM_WANTED + RAM_SPARE) > RAM_AVAIL )); then
-    msg="Your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is too high for the $AVAIL_MEM of memory available,"
+  if (( (wanted + RAM_SPARE) > RAM_AVAIL )); then
+    msg="Your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is too high for the $AVAIL_MEM of free memory available,"
     if [[ "${FS,,}" == "zfs" ]]; then
       info "$msg but since ZFS is active this will be ignored."
     else
@@ -16,8 +20,8 @@ if [[ "$RAM_CHECK" != [Nn]* && "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "h
       warn "$msg it will automatically be adjusted to a lower amount."
     fi
   else
-    if (( (RAM_WANTED + (RAM_SPARE * 3)) > RAM_AVAIL )); then
-      msg="your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is very close to the $AVAIL_MEM of memory available,"
+    if (( (wanted + (RAM_SPARE * 3)) > RAM_AVAIL )); then
+      msg="your configured RAM_SIZE of ${RAM_SIZE/G/ GB} is very close to the $AVAIL_MEM of free memory available,"
       if [[ "${FS,,}" == "zfs" ]]; then
         info "$msg but since ZFS is active this will be ignored."
       else
@@ -30,57 +34,45 @@ fi
 
 if [[ "${RAM_SIZE,,}" == "half" ]]; then
 
-  RAM_WANTED=$(( RAM_AVAIL / 2 ))
-  RAM_WANTED=$(( RAM_WANTED / 1073741825 ))
-
-  if (( "$RAM_WANTED" < 1 )); then
-    RAM_WANTED=$(( RAM_AVAIL / 2 ))
-    RAM_WANTED=$(( RAM_WANTED / 1048577 ))
-    RAM_SIZE="${RAM_WANTED}M"
+  if (( (RAM_AVAIL / 2) > RAM_SPARE )); then
+    wanted=$(( (RAM_AVAIL / 2) / 1048577 ))
+    RAM_SIZE="${wanted}M"
+    info "Allocated $wanted MB of RAM for the virtual machine."
   else
-    RAM_SIZE="${RAM_WANTED}G"
+    RAM_SIZE="max"
   fi
 
 fi
 
 if [[ "${RAM_SIZE,,}" == "max" ]]; then
 
-  RAM_WANTED=$(( RAM_AVAIL - (RAM_SPARE * 3) ))
-  RAM_WANTED=$(( RAM_WANTED / 1073741825 ))
+  if (( RAM_AVAIL < (RAM_SPARE * 2) )); then
 
-  if (( "$RAM_WANTED" < 1 )); then
+    wanted=$(( RAM_AVAIL / 2 ))
 
-    RAM_WANTED=$(( RAM_AVAIL - (RAM_SPARE * 2) ))
-    RAM_WANTED=$(( RAM_WANTED / 1073741825 ))
-
-    if (( "$RAM_WANTED" < 1 )); then
-
-      RAM_WANTED=$(( RAM_AVAIL - RAM_SPARE ))
-      RAM_WANTED=$(( RAM_WANTED / 1073741825 ))
-
-      if (( "$RAM_WANTED" < 1 )); then
-
-        RAM_WANTED=$(( RAM_AVAIL - RAM_SPARE ))
-        RAM_WANTED=$(( RAM_WANTED / 1048577 ))
-
-        if (( "$RAM_WANTED" < 1 )); then
-
-          RAM_WANTED=$(( RAM_AVAIL ))
-          RAM_WANTED=$(( RAM_WANTED / 1048577 ))
-
-        fi
-
-        RAM_SIZE="${RAM_WANTED}M"
-      else
-        RAM_SIZE="${RAM_WANTED}G"
-      fi
-    else
-      RAM_SIZE="${RAM_WANTED}G"
-    fi
   else
-    RAM_SIZE="${RAM_WANTED}G"
+
+    wanted=$(( RAM_AVAIL - (RAM_SPARE * 3) ))
+
+    if (( wanted < (RAM_SPARE * 6) )); then
+      wanted=$(( RAM_AVAIL - RAM_SPARE ))
+    fi
+
   fi
 
+  wanted=$(( wanted / 1048577 ))
+  RAM_SIZE="${wanted}M"
+
+  info "Allocated $wanted MB of RAM for the virtual machine."
+
+fi
+
+wanted=$(numfmt --from=iec "$RAM_SIZE")
+
+if [ "$wanted" -lt "$RAM_MINIMUM" ]; then
+  wanted=$(( wanted / 1048577 ))
+  error "Not enough memory available, there is only $wanted MB left!"
+  exit 16
 fi
 
 return 0

src/network.sh

@@ -19,16 +19,28 @@ set -Eeuo pipefail
 : "${VM_NET_HOST:="VirtualDSM"}"
 : "${VM_NET_MASK:="255.255.255.0"}"
 
-: "${PASST:="passt"}"
+: "${PASST:="/run/passt"}"
 : "${PASST_MTU:=""}"
 : "${PASST_OPTS:=""}"
 : "${PASST_DEBUG:=""}"
+: "${PASST_PID:="/var/run/passt.pid"}"
+: "${PASST_SOCKET:="/tmp/passt.socket"}"
 
 : "${DNSMASQ_OPTS:=""}"
 : "${DNSMASQ_DEBUG:=""}"
 : "${DNSMASQ:="/usr/sbin/dnsmasq"}"
+: "${DNSMASQ_PID:="/var/run/dnsmasq.pid"}"
 : "${DNSMASQ_CONF_DIR:="/etc/dnsmasq.d"}"
 
+# Sanitize variables
+MAC=$(strip "$MAC")
+MTU=$(strip "$MTU")
+ADAPTER=$(strip "$ADAPTER")
+NETWORK=$(strip "$NETWORK")
+PASST_MTU=$(strip "$PASST_MTU")
+HOST_PORTS=$(strip "$HOST_PORTS")
+USER_PORTS=$(strip "$USER_PORTS")
+
 ADD_ERR="Please add the following setting to your container:"
 
 # ######################################
@@ -37,7 +49,7 @@ ADD_ERR="Please add the following setting to your container:"
 
 configureDHCP() {
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring MACVTAP networking..."
+  enabled "$DEBUG" && echo "Configuring MACVTAP networking..."
 
   # Create the necessary file structure for /dev/vhost-net
   if [ ! -c /dev/vhost-net ]; then
@@ -115,20 +127,21 @@ configureDHCP() {
 
 configureDNS() {
 
-  local if="$1"
+  local fa="$1"
   local ip="$2"
   local mac="$3"
   local host="$4"
   local mask="$5"
   local gateway="$6"
+  local arguments="$DNSMASQ_OPTS"
 
   echo "$gateway" > /run/shm/qemu.gw
-  
-  [[ "${DNSMASQ_DISABLE:-}" == [Yy1]* ]] && return 0
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Starting dnsmasq daemon..."
 
-  local log="/var/log/dnsmasq.log"
-  rm -f "$log"
+  enabled "${DNSMASQ_DISABLE:-}" && return 0
+  enabled "$DEBUG" && echo "Starting dnsmasq daemon..."
+
+  [ -s "$DNSMASQ_PID" ] && pKill "$(<"$DNSMASQ_PID")"
+  rm -f "$DNSMASQ_PID"
 
   case "${NETWORK,,}" in
     "tap" | "tun" | "tuntap" | "y" )
@@ -138,45 +151,55 @@ configureDNS() {
       chmod 644 /var/lib/misc/dnsmasq.leases
 
       # dnsmasq configuration:
-      DNSMASQ_OPTS+=" --dhcp-authoritative"
+      arguments+=" --dhcp-authoritative"
 
       # Set DHCP range and host
-      DNSMASQ_OPTS+=" --dhcp-range=$ip,$ip"
-      DNSMASQ_OPTS+=" --dhcp-host=$mac,,$ip,$host,infinite"
+      arguments+=" --dhcp-range=$ip,$ip"
+      arguments+=" --dhcp-host=$mac,,$ip,$host,infinite"
 
       # Set DNS server and gateway
-      DNSMASQ_OPTS+=" --dhcp-option=option:netmask,$mask"
-      DNSMASQ_OPTS+=" --dhcp-option=option:router,$gateway"
-      DNSMASQ_OPTS+=" --dhcp-option=option:dns-server,$gateway"
+      arguments+=" --dhcp-option=option:netmask,$mask"
+      arguments+=" --dhcp-option=option:router,$gateway"
+      arguments+=" --dhcp-option=option:dns-server,$gateway"
 
   esac
 
   # Set interfaces
-  DNSMASQ_OPTS+=" --interface=$if"
-  DNSMASQ_OPTS+=" --bind-interfaces"
+  arguments+=" --interface=$fa"
+  arguments+=" --bind-interfaces"
+
+  # Workaround NET_RAW capability
+  arguments+=" --no-ping"
 
   # Add DNS entry for container
-  DNSMASQ_OPTS+=" --address=/host.lan/$gateway"
+  arguments+=" --address=/host.lan/$gateway"
 
   # Set local dns resolver to dnsmasq when needed
-  [ -f /etc/resolv.dnsmasq ] && DNSMASQ_OPTS+=" --resolv-file=/etc/resolv.dnsmasq"
+  [ -f /etc/resolv.dnsmasq ] && arguments+=" --resolv-file=/etc/resolv.dnsmasq"
 
   # Enable logging to file
-  DNSMASQ_OPTS+=" --log-facility=$log"
+  local log="/var/log/dnsmasq.log"
+  rm -f "$log"
+  arguments+=" --log-facility=$log"
 
-  DNSMASQ_OPTS=$(echo "$DNSMASQ_OPTS" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
-  [[ "$DEBUG" == [Yy1]* ]] && printf "Dnsmasq arguments:\n\n%s\n\n" "${DNSMASQ_OPTS// -/$'\n-'}"
+  arguments=$(echo "$arguments" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
+  enabled "$DEBUG" && printf "Dnsmasq arguments:\n\n%s\n\n" "${arguments// -/$'\n-'}"
 
-  if ! $DNSMASQ ${DNSMASQ_OPTS:+ $DNSMASQ_OPTS}; then
+  { $DNSMASQ ${arguments:+ $arguments}; rc=$?; } || :
 
-    local msg="Failed to start Dnsmasq, reason: $?"
-    [ -f "$log" ] && cat "$log"
-    error "$msg"
+  if (( rc != 0 )); then
+
+    local msg="Failed to start Dnsmasq, reason: $rc"
+
+    if [[ "${NETWORK,,}" == "slirp" || "${NETWORK,,}" == "passt" ]] || ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
+      [ -f "$log" ] && [ -s "$log" ] && cat "$log"
+      error "$msg"
+    fi
 
     return 1
   fi
 
-  if [[ "$DNSMASQ_DEBUG" == [Yy1]* ]]; then
+  if enabled "$DNSMASQ_DEBUG"; then
     tail -fn +0 "$log" --pid=$$ &
   fi
 
@@ -185,9 +208,7 @@ configureDNS() {
 
 getHostPorts() {
 
-  local list=""
-  list+="$MON_PORT,"
-  list+="${HOST_PORTS// /},"
+  local list="${HOST_PORTS// /},"
 
   # Remove duplicates
   list=$(echo "${list//,,/,}," | awk 'BEGIN{RS=ORS=","} !seen[$0]++' | sed 's/,*$//g')
@@ -235,14 +256,13 @@ getUserPorts() {
   done
 
   # Remove duplicates
-  ports=$(echo "${ports//,,/,}," | awk 'BEGIN{RS=ORS=","} !seen[$0]++' | sed 's/,*$//g')
-
-  echo "$ports"
+  echo "${ports//,,/,}," | awk 'BEGIN{RS=ORS=","} !seen[$0]++' | sed 's/,*$//g'
   return 0
 }
 
 getSlirp() {
 
+  local ip="$1"
   local args=""
   local list=""
 
@@ -258,24 +278,22 @@ getSlirp() {
       proto="udp"
       num="${port%/udp}"
     elif [[ "$port" != *"/tcp" ]]; then
-      args+="hostfwd=$proto::$num-$VM_NET_IP:$num,"
+      args+="hostfwd=$proto::$num-$ip:$num,"
       proto="udp"
       num="${port%/udp}"
     fi
 
-    args+="hostfwd=$proto::$num-$VM_NET_IP:$num,"
+    args+="hostfwd=$proto::$num-$ip:$num,"
   done
 
-  args=$(echo "$args" | sed 's/,*$//g')
-
-  echo "${args%?}"
+  echo "$args" | sed 's/,*$//g'
   return 0
 }
 
 configureSlirp() {
 
   NETWORK="slirp"
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring slirp networking..."
+  enabled "$DEBUG" && echo "Configuring slirp networking..."
 
   local ip="$IP"
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
@@ -289,15 +307,18 @@ configureSlirp() {
   NET_OPTS="-netdev user,id=hostnet0,ipv4=on,host=$gateway,net=${gateway%.*}.0/24,dhcpstart=$ip,${ipv6}hostname=$VM_NET_HOST"
 
   local forward=""
-  forward=$(getSlirp)
+  forward=$(getSlirp "$ip")
   [ -n "$forward" ] && NET_OPTS+=",$forward"
 
-  if [[ "${DNSMASQ_DISABLE:-}" == [Yy1]* ]]; then
+  if enabled "${DNSMASQ_DISABLE:-}"; then
     echo "$gateway" > /run/shm/qemu.gw
   else
     [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
     configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
   VM_NET_IP="$ip"
@@ -307,14 +328,11 @@ configureSlirp() {
 configurePasst() {
 
   NETWORK="passt"
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring user-mode networking..."
+  enabled "$DEBUG" && echo "Configuring user-mode networking..."
 
-  local log="/var/log/passt.log"
+  local log="/tmp/passt.log"
   rm -f "$log"
 
-  local pid="/var/run/dnsmasq.pid"
-  [ -s "$pid" ] && pKill "$(<"$pid")"
-
   local ip="$IP"
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
 
@@ -346,47 +364,50 @@ configurePasst() {
 
   PASST_OPTS+=" -H $VM_NET_HOST"
   PASST_OPTS+=" -M $GATEWAY_MAC"
-
-  local uid gid
-  uid=$(id -u)
-  gid=$(id -g)
-  PASST_OPTS+=" --runas $uid:$gid"
-
-  PASST_OPTS+=" -P /var/run/passt.pid"
+  PASST_OPTS+=" -P $PASST_PID"
+  PASST_OPTS+=" -s $PASST_SOCKET"
   PASST_OPTS+=" -l $log"
   PASST_OPTS+=" -q"
 
-  if [[ "${DNSMASQ_DISABLE:-}" != [Yy1]* ]]; then
+  if ! enabled "${DNSMASQ_DISABLE:-}"; then
     [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
   PASST_OPTS=$(echo "$PASST_OPTS" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
-  [[ "$DEBUG" == [Yy1]* ]] && printf "Passt arguments:\n\n%s\n\n" "${PASST_OPTS// -/$'\n-'}"
 
-  if ! $PASST ${PASST_OPTS:+ $PASST_OPTS} >/dev/null 2>&1; then
+  if enabled "$DEBUG" || enabled "$PASST_DEBUG"; then
+    printf "Passt arguments:\n\n%s\n\n" "${PASST_OPTS// -/$'\n-'}"
+  fi
+
+  [ ! -f "$PASST" ] && cp /usr/bin/passt* /run
+
+  if ! "$PASST" ${PASST_OPTS:+$PASST_OPTS} >/dev/null 2>&1; then
 
     rm -f "$log"
     PASST_OPTS="${PASST_OPTS/ -q/}"
-    { $PASST ${PASST_OPTS:+ $PASST_OPTS}; rc=$?; } || :
+    { "$PASST" ${PASST_OPTS:+$PASST_OPTS}; rc=$?; } || :
 
     if (( rc != 0 )); then
-      [ -f "$log" ] && cat "$log"
+      [ -f "$log" ] && [ -s "$log" ] && cat "$log"
       warn "failed to start passt ($rc), falling back to slirp networking!"
       configureSlirp && return 0 || return 1
     fi
 
   fi
 
-  if [[ "$PASST_DEBUG" == [Yy1]* ]]; then
+  if enabled "$PASST_DEBUG"; then
     tail -fn +0 "$log" --pid=$$ &
   else
-    if [[ "$DEBUG" == [Yy1]* ]]; then
-      [ -f "$log" ] && cat "$log" && echo ""
+    if enabled "$DEBUG"; then
+      [ -f "$log" ] && [ -s "$log" ] && cat "$log" && echo ""
     fi
   fi
 
-  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket"
+  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=$PASST_SOCKET"
 
   configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
 
@@ -394,16 +415,51 @@ configurePasst() {
   return 0
 }
 
+clearTables() {
+  local table="" line rules
+
+  # Choose between iptables or nftables
+  if command -v iptables-nft >/dev/null 2>&1 && iptables-nft -V >/dev/null 2>&1; then
+    update-alternatives --set iptables /usr/sbin/iptables-nft > /dev/null
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft > /dev/null
+  else
+    update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null
+  fi
+
+  # Store the current iptables ruleset
+  ! rules=$(iptables-save 2> /dev/null) && return 0
+  [ -z "$rules" ] && return 0
+
+  # Delete every rule tagged with our unique identifier, leaving all other rules intact.
+  while IFS= read -r line; do
+    case "$line" in
+      \*nat)    table="nat" ;;
+      \*filter) table="filter" ;;
+      \*mangle) table="mangle" ;;
+      \*raw)    table="raw" ;;
+    esac
+    if [[ "$line" == -A* ]]; then
+      local re="--comment[[:space:]]+\"?remove\"?([[:space:]]|\$)"
+      if [[ "$line" =~ $re ]]; then
+        read -ra args <<< "${line/-A /-D }"
+        iptables -t "$table" "${args[@]}" &> /dev/null || :
+      fi
+    fi
+  done <<< "$rules"
+
+  return 0
+}
+
 configureNAT() {
 
   local tuntap="TUN device is missing. $ADD_ERR --device /dev/net/tun"
   local tables="the 'ip_tables' kernel module is not loaded. Try this command: sudo modprobe ip_tables iptable_nat"
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring NAT networking..."
+  enabled "$DEBUG" && echo "Configuring NAT networking..."
 
   # Create the necessary file structure for /dev/net/tun
   if [ ! -c /dev/net/tun ]; then
-    [[ "$PODMAN" == [Yy1]* ]] && return 1
     [ ! -d /dev/net ] && mkdir -m 755 /dev/net
     if mknod /dev/net/tun c 10 200; then
       chmod 666 /dev/net/tun
@@ -411,6 +467,7 @@ configureNAT() {
   fi
 
   if [ ! -c /dev/net/tun ]; then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -418,13 +475,15 @@ configureNAT() {
   if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
     { sysctl -w net.ipv4.ip_forward=1 > /dev/null 2>&1; rc=$?; } || :
     if (( rc != 0 )) || [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
+      enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
       warn "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1"
       return 1
     fi
   fi
 
-  local ip base
-  base=$(echo "$IP" | sed -r 's/([^.]*.){2}//')
+  local ip base gateway exclude
+  base=$(cut -d. -f3,4 <<< "$IP")
+
   if [[ "$IP" != "172.30."* ]]; then
     ip="172.30.$base"
   else
@@ -433,21 +492,24 @@ configureNAT() {
 
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
 
-  local gateway=""
   if [[ "$ip" != *".1" ]]; then
     gateway="${ip%.*}.1"
   else
     gateway="${ip%.*}.2"
   fi
 
+  local subnet="${ip%.*}.0/24"
+  local broadcast="${ip%.*}.255"
+
   # Create a bridge with a static IP for the VM guest
   { ip link add dev "$VM_NET_BRIDGE" type bridge ; rc=$?; } || :
 
   if (( rc != 0 )); then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "failed to create bridge. $ADD_ERR --cap-add NET_ADMIN" && return 1
   fi
 
-  if ! ip address add "$gateway/24" broadcast "${ip%.*}.255" dev "$VM_NET_BRIDGE"; then
+  if ! ip address add "$gateway/24" broadcast "$broadcast" dev "$VM_NET_BRIDGE"; then
     warn "failed to add IP address pool!" && return 1
   fi
 
@@ -456,8 +518,9 @@ configureNAT() {
     sleep 2
   done
 
-  # QEMU Works with taps, set tap to the bridge created
+  # Set tap to the bridge created
   if ! ip tuntap add dev "$VM_NET_TAP" mode tap; then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -468,7 +531,7 @@ configureNAT() {
   fi
 
   if ! ip link set dev "$VM_NET_TAP" address "$GATEWAY_MAC"; then
-    warn "failed to set gateway MAC address.."
+    warn "failed to set gateway MAC address."
   fi
 
   while ! ip link set "$VM_NET_TAP" up promisc on; do
@@ -480,13 +543,8 @@ configureNAT() {
     warn "failed to set master bridge!" && return 1
   fi
 
-  if grep -wq "nf_tables" /proc/modules; then
-    update-alternatives --set iptables /usr/sbin/iptables-nft > /dev/null
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft > /dev/null
-  else
-    update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null
-  fi
+  # Flush existing tables
+  clearTables
 
   exclude=$(getHostPorts)
 
@@ -498,22 +556,36 @@ configureNAT() {
     fi
   fi
 
-  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE; then
-    warn "$tables" && return 1
+  # NAT traffic from bridge subnet to Docker uplink
+  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE > /dev/null 2>&1; then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
+    if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE; then
+      warn "$tables" && return 1
+    fi
   fi
 
   # shellcheck disable=SC2086
-  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -j DNAT --to "$ip"; then
+  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -m comment --comment "remove" -j DNAT --to "$ip"; then
     warn "failed to configure IP tables!" && return 1
   fi
 
-  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp -j DNAT --to "$ip"; then
+  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp -m comment --comment "remove" -j DNAT --to "$ip"; then
     warn "failed to configure IP tables!" && return 1
   fi
 
   if (( KERNEL > 4 )); then
     # Hack for guest VMs complaining about "bad udp checksums in 5 packets"
-    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true
+    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -m comment --comment "remove" -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true
+  fi
+
+  # Allow forwarding from bridge -> dev
+  if ! iptables -A FORWARD -i "$VM_NET_BRIDGE" -o "$VM_NET_DEV" -m comment --comment "remove" -j ACCEPT; then
+    warn "failed to configure IP tables!" && return 1
+  fi
+
+  # Allow return traffic
+  if ! iptables -A FORWARD -i "$VM_NET_DEV" -o "$VM_NET_BRIDGE" -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "remove" -j ACCEPT; then
+    warn "failed to configure IP tables!" && return 1
   fi
 
   NET_OPTS="-netdev tap,id=hostnet0,ifname=$VM_NET_TAP"
@@ -533,97 +605,72 @@ configureNAT() {
 
 closeBridge() {
 
-  local pid="/var/run/dnsmasq.pid"
-  [ -s "$pid" ] && pKill "$(<"$pid")"
-  rm -f "$pid"
+  local pids=( "$PASST_PID" "$DNSMASQ_PID" )
+  mKill "${pids[@]}"
 
-  pid="/var/run/passt.pid"
-  [ -s "$pid" ] && pKill "$(<"$pid")"
-  rm -f "$pid"
+  ip link set "$VM_NET_TAP" down promisc off &> /dev/null || :
+  ip link delete "$VM_NET_TAP" &> /dev/null || :
 
-  case "${NETWORK,,}" in
-    "user"* | "passt" | "slirp" ) return 0 ;;
-  esac
-
-  ip link set "$VM_NET_TAP" down promisc off &> null || true
-  ip link delete "$VM_NET_TAP" &> null || true
-
-  ip link set "$VM_NET_BRIDGE" down &> null || true
-  ip link delete "$VM_NET_BRIDGE" &> null || true
+  ip link set "$VM_NET_BRIDGE" down &> /dev/null || :
+  ip link delete "$VM_NET_BRIDGE" &> /dev/null || :
 
+  clearTables
   return 0
 }
 
 closeWeb() {
 
-  # Shutdown nginx
-  nginx -s stop 2> /dev/null
-  fWait "nginx"
-
-  # Shutdown websocket
-  local pid="/var/run/websocketd.pid"
-  [ -s "$pid" ] && pKill "$(<"$pid")"
-  rm -f "$pid"
+  local pids=( "$WEB_PID" "$WSD_PID" )
+  mKill "${pids[@]}"
 
   return 0
 }
 
 closeNetwork() {
 
-  if [[ "${WEB:-}" != [Nn]* && "$DHCP" == [Yy1]* ]]; then
+  if ! disabled "${WEB:-}" && enabled "$DHCP"; then
     closeWeb
   fi
 
-  [[ "$NETWORK" == [Nn]* ]] && return 0
+  disabled "$NETWORK" && return 0
 
   exec 30<&- || true
   exec 40<&- || true
 
-  if [[ "$DHCP" != [Yy1]* ]]; then
-
-    closeBridge
-    return 0
-
-  fi
-
-  ip link set "$VM_NET_TAP" down || true
-  ip link delete "$VM_NET_TAP" || true
+  closeBridge
 
   return 0
 }
 
 cleanUp() {
 
-  # Clean up old files
-  rm -f /etc/resolv.dnsmasq
-  rm -f /var/run/passt.pid
-  rm -f /var/run/dnsmasq.pid
+  closeBridge
 
-  if [[ -d "/sys/class/net/$VM_NET_TAP" ]]; then
-    info "Lingering interface will be removed..."
-    ip link delete "$VM_NET_TAP" || true
-  fi
+  # Clean up old files
+  rm -f "$PASST_PID" "$PASST_SOCKET"
+  rm -f "$DNSMASQ_PID" /etc/resolv.dnsmasq
 
   return 0
 }
 
 checkOS() {
 
-  local kernel
   local os=""
-  local if="macvlan"
+  local kernel=""
+  local iface="macvlan"
+
   kernel=$(uname -a)
 
   [[ "${kernel,,}" == *"darwin"* ]] && os="$ENGINE Desktop for macOS"
   [[ "${kernel,,}" == *"microsoft"* ]] && os="$ENGINE Desktop for Windows"
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
-    if="macvtap"
+  if enabled "$DHCP"; then
+    iface="macvtap"
     [[ "${kernel,,}" == *"synology"* ]] && os="Synology Container Manager"
   fi
 
   if [ -n "$os" ]; then
-    warn "you are using $os which does not support $if, please revert to bridge networking!"
+    warn "you are using $os which does not support $iface, please revert to bridge networking!"
   fi
 
   return 0
@@ -637,8 +684,8 @@ getInfo() {
     [ -d "/sys/class/net/net1" ] && VM_NET_DEV="net1"
     [ -d "/sys/class/net/net2" ] && VM_NET_DEV="net2"
     [ -d "/sys/class/net/net3" ] && VM_NET_DEV="net3"
-    # Automaticly detect the default network interface
-    [ -z "$VM_NET_DEV" ] && VM_NET_DEV=$(awk '$2 == 00000000 { print $1 }' /proc/net/route)
+    # Automatically detect the default network interface
+    [ -z "$VM_NET_DEV" ] && VM_NET_DEV=$(awk '$2 == 00000000 { print $1; exit }' /proc/net/route)
     [ -z "$VM_NET_DEV" ] && VM_NET_DEV="eth0"
   fi
 
@@ -648,15 +695,12 @@ getInfo() {
   fi
 
   GATEWAY=$(ip route list dev "$VM_NET_DEV" | awk ' /^default/ {print $3}' | head -n 1)
-  { IP=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/ | head -n 1); rc=$?; } 2>/dev/null || :
-
-  if (( rc != 0 )); then
-    error "Could not determine container IP address!" && exit 26
-  fi
+  { IP=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/ | head -n 1); } 2>/dev/null || :
+  [ -z "$IP" ] && ! enabled "$DHCP" && error "Could not determine container IPv4 address!" && exit 26
 
   IP6=""
   # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
     { IP6=$(ip -6 addr show dev "$VM_NET_DEV" scope global up); rc=$?; } 2>/dev/null || :
     (( rc != 0 )) && IP6=""
     [ -n "$IP6" ] && IP6=$(echo "$IP6" | sed -e's/^.*inet6 \([^ ]*\)\/.*$/\1/;t;d' | head -n 1)
@@ -664,16 +708,16 @@ getInfo() {
 
   local result nic bus
   result=$(ethtool -i "$VM_NET_DEV")
-  nic=$(grep -m 1 -i 'driver:' <<< "$result" | awk '{print $(2)}')
-  bus=$(grep -m 1 -i 'bus-info:' <<< "$result" | awk '{print $(2)}')
+  nic=$(grep -m 1 -i 'driver:' <<< "$result" | awk '{print $2}')
+  bus=$(grep -m 1 -i 'bus-info:' <<< "$result" | awk '{print $2}')
 
   if [[ "${bus,,}" != "" && "${bus,,}" != "n/a" && "${bus,,}" != "tap" ]]; then
-    [[ "$DEBUG" == [Yy1]* ]] && info "Detected BUS: $bus"
+    enabled "$DEBUG" && info "Detected BUS: $bus"
     error "This container does not support host mode networking!"
     exit 29
   fi
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
+  if enabled "$DHCP"; then
 
     checkOS
 
@@ -683,11 +727,25 @@ getInfo() {
     fi
 
     if [[ "${nic,,}" != "macvlan" ]]; then
-      [[ "$DEBUG" == [Yy1]* ]] && info "Detected NIC: $nic"
+      enabled "$DEBUG" && info "Detected NIC: $nic"
       error "The container needs to be in a MACVLAN network when DHCP=Y."
       exit 29
     fi
 
+    if uname -a | grep -Eqi 'unraid|truenas'; then
+
+      # Check if host exposes the bridge-nf sysctl
+      # (only visible if br_netfilter is loaded and /proc/sys is accessible)
+  
+      BNF="/proc/sys/net/bridge/bridge-nf-call-iptables"
+  
+      if [[ -r "$BNF" ]] && [[ "$(cat "$BNF")" != "0" ]]; then
+        warn "external LAN clients may not be able to reach this container, because net.bridge.bridge-nf-call-iptables=1."
+        warn "you can fix this issue by running 'sysctl -w net.bridge.bridge-nf-call-iptables=0' on the host system."
+      fi
+  
+    fi
+
   else
 
     if [[ "$IP" != "172."* && "$IP" != "10.8"* && "$IP" != "10.9"* ]]; then
@@ -737,26 +795,19 @@ getInfo() {
 
   GATEWAY_MAC=$(echo "$VM_NET_MAC" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/')
 
-  if [[ "$PODMAN" == [Yy1]* && "$DHCP" != [Yy1]* ]]; then
-    if [ -z "$NETWORK" ] || [[ "${NETWORK^^}" == "Y" ]]; then
-      # By default Podman has no permissions for NAT networking
-      NETWORK="user"
-    fi
-  fi
-
-  if [[ "$DEBUG" == [Yy1]* ]]; then
+  if enabled "$DEBUG"; then
     line="Host: $HOST  IP: $IP  Gateway: $GATEWAY  Interface: $VM_NET_DEV  MAC: $VM_NET_MAC  MTU: $mtu"
     [[ "$MTU" != "0" && "$MTU" != "$mtu" ]] && line+=" ($MTU)"
     info "$line"
     if [ -f /etc/resolv.conf ]; then
-      nameservers=$(grep '^nameserver*' /etc/resolv.conf | head -c -1 | sed 's/nameserver //g;' | sed -z 's/\n/, /g')
+      nameservers=$(grep '^nameserver ' /etc/resolv.conf | sed 's/^nameserver //' | paste -sd ',' | sed 's/,/, /g')
       [ -n "$nameservers" ] && info "Nameservers: $nameservers"
     fi
     echo
   fi
 
-  echo "$IP" > /run/shm/qemu.ip
-  echo "$nic" > /run/shm/qemu.nic
+  echo "$IP" > "$QEMU_DIR"/qemu.ip
+  echo "$nic" > "$QEMU_DIR"//qemu.nic
 
   return 0
 }
@@ -765,14 +816,14 @@ getInfo() {
 #  Configure Network
 # ######################################
 
-if [[ "$NETWORK" == [Nn]* ]]; then
+if disabled "$NETWORK"; then
   NET_OPTS=""
   return 0
 fi
 
 msg="Initializing network..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 getInfo
 cleanUp
@@ -784,36 +835,40 @@ fi
 MSG="Booting DSM instance..."
 html "$MSG"
 
-if [[ "$DHCP" == [Yy1]* ]]; then
+if enabled "$DHCP"; then
 
   # Configure for macvtap interface
   configureDHCP || exit 20
 
 else
 
-  if [[ "${WEB:-}" != [Nn]* ]]; then
+  if ! disabled "${WEB:-}"; then
     sleep 1.2
     closeWeb
   fi
 
   case "${NETWORK,,}" in
     "passt" | "slirp" | "user"* ) ;;
-    "tap" | "tun" | "tuntap" | "y" )
+    "tap" | "tun" | "tuntap" | "y" | "" )
 
       # Configure tap interface
       if ! configureNAT; then
 
         closeBridge
         NETWORK="user"
-        msg="falling back to user-mode networking!"
-        msg="failed to setup NAT networking, $msg"
+
+        if ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
+          msg="falling back to user-mode networking!"
+          msg="failed to setup NAT networking, $msg"
+          warn "$msg"
+        fi
 
       fi ;;
 
   esac
 
   case "${NETWORK,,}" in
-    "tap" | "tun" | "tuntap" | "y" ) ;;
+    "tap" | "tun" | "tuntap" | "y" | "" ) ;;
     "passt" | "user"* )
 
       # Configure for user-mode networking (passt)

src/power.sh

@@ -1,146 +1,115 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-: "${API_TIMEOUT:="50"}"   # API Call timeout
-: "${QEMU_TIMEOUT:="50"}"  # QEMU Termination timeout
+: "${SHUTDOWN:="Y"}"        # Graceful ACPI shutdown
+: "${TIMEOUT:="115"}"       # QEMU termination timeout
+: "${API_TIMEOUT:="90"}"    # External API call timeout
 
 # Configure QEMU for graceful shutdown
 
 API_CMD=6
 API_HOST="127.0.0.1:$COM_PORT"
 
-QEMU_TERM=""
-QEMU_DIR="/run/shm"
-QEMU_PID="$QEMU_DIR/qemu.pid"
-QEMU_LOG="$QEMU_DIR/qemu.log"
-QEMU_OUT="$QEMU_DIR/qemu.out"
+# Configure QEMU for graceful shutdown
+
 QEMU_END="$QEMU_DIR/qemu.end"
 
-if [[ "$KVM" == [Nn]* ]]; then
-  API_TIMEOUT=$(( API_TIMEOUT*2 ))
-  QEMU_TIMEOUT=$(( QEMU_TIMEOUT*2 ))
-fi
-
-touch "$QEMU_LOG"
-
 _trap() {
-  func="$1" ; shift
-  for sig ; do
+  local func="$1"; shift
+  local sig
+  TRAP_PID=$BASHPID
+
+  for sig; do
     trap "$func $sig" "$sig"
   done
 }
 
+app() {
+  echo "$APP" && return 0
+}
+
 finish() {
 
-  local pid
-  local cnt=0
+  local i=0
+  local pid=""
   local reason=$1
+  local pids=( "${HOST_PID:-}" "${WSD_PID:-}" \
+               "${WEB_PID:-}" "${PASST_PID:-}" "${DNSMASQ_PID:-}" )
 
   touch "$QEMU_END"
 
   if [ -s "$QEMU_PID" ]; then
-
-    pid=$(<"$QEMU_PID")
-    echo && error "Forcefully terminating Virtual DSM, reason: $reason..."
-    { kill -15 "$pid" || true; } 2>/dev/null
-
-    while isAlive "$pid"; do
-
-      sleep 1
-      cnt=$((cnt+1))
-
-      # Workaround for zombie pid
-      [ ! -s "$QEMU_PID" ] && break
-
-      if [ "$cnt" == "5" ]; then
-        echo && error "QEMU did not terminate itself, forcefully killing process..."
-        { kill -9 "$pid" || true; } 2>/dev/null
+    if read -r pid <"$QEMU_PID"; then
+      if [ -n "$pid" ] && isAlive "$pid"; then
+        local display="$reason"
+        case "$reason" in
+          129 ) display="SIGHUP" ;;
+          130 ) display="SIGINT" ;;
+          131 ) display="SIGQUIT" ;;
+          134 ) display="SIGABRT" ;;
+          143 ) display="SIGTERM" ;;
+        esac
+        error "Forcefully terminating $(app), reason: $display..."
+        { disown "$pid" || :; kill -9 -- "$pid" || :; } 2>/dev/null
       fi
-
-    done
-
-  fi
-
-  fKill "print.sh"
-  fKill "host.bin"
-
-  closeNetwork
-
-  sleep 1
-  echo && echo "❯ Shutdown completed!"
-
-  exit "$reason"
-}
-
-terminal() {
-
-  local dev=""
-
-  if [ -s "$QEMU_OUT" ]; then
-
-    local msg
-    msg=$(<"$QEMU_OUT")
-
-    if [ -n "$msg" ]; then
-
-      if [[ "${msg,,}" != "char"* ||  "$msg" != *"serial0)" ]]; then
-        echo "$msg"
-      fi
-
-      dev="${msg#*/dev/p}"
-      dev="/dev/p${dev%% *}"
-
     fi
   fi
 
-  if [ ! -c "$dev" ]; then
-    dev=$(echo 'info chardev' | nc -q 1 -w 1 localhost "$MON_PORT" | tr -d '\000')
-    dev="${dev#*serial0}"
-    dev="${dev#*pty:}"
-    dev="${dev%%$'\n'*}"
-    dev="${dev%%$'\r'*}"
+  mKill "${pids[@]}"
+  fKill "print.sh"
+
+  closeNetwork
+
+  if ! waitPidFile "$QEMU_PID" 10; then
+    warn "Timed out while waiting for $(app) to exit!"
   fi
 
-  if [ ! -c "$dev" ]; then
-    error "Device '$dev' not found!"
-    finish 34 && return 34
-  fi
-
-  QEMU_TERM="$dev"
-  return 0
+  (( reason != 1 )) && echo && echo "❯ Shutdown completed!"
+  exit "$reason"
 }
 
-_graceful_shutdown() {
+graceful_shutdown() {
 
-  local code=$?
-  local pid url response
+  local sig="$1"
+  local pid=""
+  local code=0
+  local start url response elapsed
 
-  set +e
+  [[ $BASHPID != "$TRAP_PID" ]] && return
+
+  case "$sig" in
+    SIGHUP)  code=129 ;;
+    SIGINT)  code=130 ;;
+    SIGQUIT) code=131 ;;
+    SIGABRT) code=134 ;;
+    SIGTERM) code=143 ;;
+  esac
 
   if [ -f "$QEMU_END" ]; then
     echo && info "Received $1 signal while already shutting down..."
     return
   fi
 
+  set +e
+  start=$SECONDS
   touch "$QEMU_END"
   echo && info "Received $1 signal, sending shutdown command..."
 
-  if [ ! -s "$QEMU_PID" ]; then
-    echo && error "QEMU PID file does not exist?"
-    finish "$code" && return "$code"
+  if [ ! -s "$QEMU_PID" ] || ! read -r pid <"$QEMU_PID"; then
+    warn "QEMU PID file ($QEMU_PID) does not exist?"
+    finish "$code"
   fi
 
-  pid=$(<"$QEMU_PID")
-
-  if ! isAlive "$pid"; then
-    echo && error "QEMU process does not exist?"
-    finish "$code" && return "$code"
+  if [ -z "$pid" ] || ! isAlive "$pid"; then
+    warn "QEMU process with PID $pid does not exist?"
+    finish "$code"
   fi
 
   # Don't send the powerdown signal because vDSM ignores ACPI signals
-  # echo 'system_powerdown' | nc -q 1 -w 1 localhost "$MON_PORT" > /dev/null
+  # nc -q 1 -w 1 -U "$QEMU_DIR/monitor.sock" &> /dev/null <<<'system_powerdown' || :
 
   # Send shutdown command to guest agent via serial port
+  API_TIMEOUT=$(strip "$API_TIMEOUT")
   url="http://$API_HOST/read?command=$API_CMD&timeout=$API_TIMEOUT"
   response=$(curl -sk -m "$(( API_TIMEOUT+2 ))" -S "$url" 2>&1)
 
@@ -153,44 +122,69 @@ _graceful_shutdown() {
     response="${response#*message\"\: \"}"
     [ -z "$response" ] && response="second signal"
     echo && error "Forcefully terminating because of: ${response%%\"*}"
-    { kill -15 "$pid" || true; } 2>/dev/null
+    kill -15 -- "$pid" 2>/dev/null || :
 
   fi
 
-  local cnt=0
+  local name
+  name="$(app)"
 
-  while [ "$cnt" -lt "$QEMU_TIMEOUT" ]; do
+  local term_grace=3      # seconds before loop ends to send SIGTERM
+  local cleanup_grace=3   # seconds reserved after the loop for cleanup
 
+  TIMEOUT=$(strip "$TIMEOUT")
+  if [[ ! "$TIMEOUT" =~ ^[0-9]+$ ]]; then
+    TIMEOUT=115
+  fi
+
+  if (( TIMEOUT >= 30 )); then
+    term_grace=5
+    cleanup_grace=5
+  elif (( TIMEOUT >= 15 )); then
+    term_grace=4
+    cleanup_grace=4
+  fi
+
+  local cnt=0 sigterm_at=0 min wait_until elapsed timeout_left
+
+  elapsed=$((SECONDS - start))
+  timeout_left=$((TIMEOUT - elapsed))
+
+  min=$((term_grace + cleanup_grace + 1))
+  (( timeout_left < min )) && timeout_left=$min
+
+  wait_until=$((timeout_left - cleanup_grace))
+  sigterm_at=$((wait_until - term_grace))
+
+  while (( cnt <= wait_until )); do
+
+    sleep 1 &
+    local slp=$!
+
+    # Stop waiting if the process has exited
     ! isAlive "$pid" && break
 
-    sleep 1
-    cnt=$((cnt+1))
-
-    [[ "$DEBUG" == [Yy1]* ]] && info "Shutting down, waiting... ($cnt/$QEMU_TIMEOUT)"
-
-    # Workaround for zombie pid
+    # Workaround for stale/zombie QEMU pid file
     [ ! -s "$QEMU_PID" ] && break
 
+    if (( cnt == sigterm_at )); then
+      info "${name^} is still running, sending SIGTERM... ($cnt/$wait_until)"
+      kill -15 -- "$pid" 2>/dev/null || :
+    elif (( cnt > 0 )) && enabled "${DEBUG:-}"; then
+      info "Waiting for $name to shut down... ($cnt/$wait_until)"
+    fi
+
+    wait "$slp"
+    (( cnt++ ))
+
   done
 
-  if [ "$cnt" -ge "$QEMU_TIMEOUT" ]; then
-    echo && error "Shutdown timeout reached, aborting..."
-  fi
-
-  finish "$code" && return "$code"
+  finish "$code"
 }
 
-MON_OPTS="\
-        -pidfile $QEMU_PID \
-        -name $PROCESS,process=$PROCESS,debug-threads=on \
-        -monitor telnet:localhost:$MON_PORT,server,nowait,nodelay"
+! enabled "$SHUTDOWN" && return 0
+[ -n "${QEMU_TIMEOUT:-}" ] && TIMEOUT="$QEMU_TIMEOUT"
 
-if [[ "$CONSOLE" != [Yy]* ]]; then
-
-  MON_OPTS+=" -daemonize -D $QEMU_LOG"
-
-  _trap _graceful_shutdown SIGTERM SIGHUP SIGINT SIGABRT SIGQUIT
-
-fi
+_trap graceful_shutdown SIGTERM SIGHUP SIGABRT SIGQUIT
 
 return 0

src/proc.sh

@@ -7,12 +7,16 @@ set -Eeuo pipefail
 : "${CPU_FLAGS:=""}"
 : "${CPU_MODEL:=""}"
 
+HOST_CPU=$(strip "$HOST_CPU")
+CPU_FLAGS=$(strip "$CPU_FLAGS")
+CPU_MODEL=$(strip "$CPU_MODEL")
+
 CLOCKSOURCE="tsc"
 [[ "${ARCH,,}" == "arm64" ]] && CLOCKSOURCE="arch_sys_counter"
 CLOCK="/sys/devices/system/clocksource/clocksource0/current_clocksource"
 
 if [ ! -f "$CLOCK" ]; then
-  warn "file \"$CLOCK\" cannot not found?"
+  warn "file \"$CLOCK\" cannot be found?"
 else
   result=$(<"$CLOCK")
   result="${result//[![:print:]]/}"
@@ -27,15 +31,14 @@ fi
 
 flags=$(sed -ne '/^flags/s/^.*: //p' /proc/cpuinfo)
 
-if [[ "$KVM" != [Nn]* ]]; then
+if ! disabled "$KVM"; then
 
   CPU_FEATURES="kvm=on,l3-cache=on,+hypervisor"
   KVM_OPTS=",accel=kvm -enable-kvm -global kvm-pit.lost_tick_policy=discard"
 
   if ! grep -qw "sse4_2" <<< "$flags"; then
-    info "Your CPU does not have the SSE4 instruction set that Virtual DSM requires, it will be emulated..."
-    [ -z "$CPU_MODEL" ] && CPU_MODEL="qemu64"
-    CPU_FEATURES+=",+ssse3,+sse4.1,+sse4.2"
+    error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
+    ! enabled "$DEBUG" && exit 88
   fi
 
   if [ -z "$CPU_MODEL" ]; then

src/reset.sh

@@ -2,7 +2,7 @@
 set -Eeuo pipefail
 
 trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
-[[ "${TRACE:-}" == [Yy1]* ]] && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
+enabled "${TRACE:-}" && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
 
 [ ! -f "/run/entry.sh" ] && error "Script must be run inside the container!" && exit 11
 [ "$(id -u)" -ne "0" ] && error "Script must be executed with root privileges." && exit 12
@@ -13,7 +13,6 @@ trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
 : "${KVM:="Y"}"            # KVM acceleration
 : "${DEBUG:="N"}"          # Disable debugging mode
 : "${COUNTRY:=""}"         # Country code for mirror
-: "${CONSOLE:="N"}"        # Disable console mode
 : "${ALLOCATE:=""}"        # Preallocate diskspace
 : "${ARGUMENTS:=""}"       # Extra QEMU parameters
 : "${CPU_CORES:="2"}"      # Amount of CPU cores
@@ -22,27 +21,54 @@ trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
 : "${DISK_SIZE:="16G"}"    # Initial data disk size
 : "${STORAGE:="/storage"}" # Storage folder location
 
-# Helper variables
+# Sanitize variables
+TZ=$(strip "$TZ")
+STORAGE=$(strip "$STORAGE")
+COUNTRY=$(strip "$COUNTRY")
+DISK_SIZE=$(strip "$DISK_SIZE")
 
-PODMAN="N"
+# Helper variables
+ROOTLESS="N"
+PRIVILEGED="N"
 ENGINE="Docker"
 PROCESS="${APP,,}"
 PROCESS="${PROCESS// /-}"
 
 if [ -f "/run/.containerenv" ]; then
-  PODMAN="Y"
-  ENGINE="Podman"
+  ENGINE="${container:-}"
+  if [[ "${ENGINE,,}" == *"podman"* ]]; then
+    ROOTLESS="Y"
+    ENGINE="Podman"
+  else
+    [ -z "$ENGINE" ] && ENGINE="Kubernetes"
+  fi
 fi
 
-echo "❯ Starting $APP for $ENGINE v$(</run/version)..."
+echo "❯ Starting $APP for $ENGINE v$(</etc/version)..."
 echo "❯ For support visit $SUPPORT"
 
+# Get the capability bounding set
+CAP_BND=$(grep '^CapBnd:' /proc/$$/status | awk '{print $2}')
+CAP_BND=$(printf "%d" "0x${CAP_BND}")
+
+# Get the last capability number
+LAST_CAP=$(cat /proc/sys/kernel/cap_last_cap)
+
+# Calculate the maximum capability value
+MAX_CAP=$(((1 << (LAST_CAP + 1)) - 1))
+
+if [ "${CAP_BND}" -eq "${MAX_CAP}" ]; then
+  ROOTLESS="N"
+  PRIVILEGED="Y"
+fi
+
 INFO="/run/shm/msg.html"
 PAGE="/run/shm/index.html"
 TEMPLATE="/var/www/index.html"
-FOOTER1="$APP for $ENGINE v$(</run/version)"
+FOOTER1="$APP for $ENGINE v$(</etc/version)"
 FOOTER2="<a href='$SUPPORT'>$SUPPORT</a>"
 
+SOCKETS=1
 CPU=$(cpu)
 SYS=$(uname -r)
 HOST=$(hostname -s)
@@ -51,31 +77,36 @@ MINOR=$(echo "$SYS" | cut -d '.' -f2)
 ARCH=$(dpkg --print-architecture)
 CORES=$(grep -c '^processor' /proc/cpuinfo)
 
-if ! grep -qi "socket(s)" <<< "$(lscpu)"; then
-  SOCKETS=1
-else
-  SOCKETS=$(lscpu | grep -m 1 -i 'socket(s)' | awk '{print $(2)}')
+if grep -qi "socket(s)" <<< "$(lscpu)"; then
+  SOCKETS=$(lscpu | grep -m 1 -i 'socket(s)' | awk '{print $2}')
+  [ -z "${SOCKETS##*[!0-9]*}" ] && SOCKETS=1
+  [ "$SOCKETS" -lt "1" ] && SOCKETS=1
 fi
 
-CPU_CORES="${CPU_CORES// /}"
+CPU_CORES=$(strip "$CPU_CORES")
+[ -z "$CPU_CORES" ] && CPU_CORES=2
 [[ "${CPU_CORES,,}" == "max" ]] && CPU_CORES="$CORES"
 [[ "${CPU_CORES,,}" == "half" ]] && CPU_CORES=$(( CORES / 2 ))
-[[ "${CPU_CORES,,}" == "0" ]] && CPU_CORES="1"
-[ -n "${CPU_CORES//[0-9 ]}" ] && error "Invalid amount of CPU_CORES: $CPU_CORES" && exit 15
+[ -z "${CPU_CORES##*[!0-9]*}" ] && error "Invalid amount of CPU_CORES: $CPU_CORES" && exit 15
 
+[ "$CPU_CORES" -lt "1" ] && CPU_CORES=1
 if [ "$CPU_CORES" -gt "$CORES" ]; then
-  warn "The amount for CPU_CORES (${CPU_CORES}) exceeds the amount of logical cores available, so will be limited to ${CORES}."
+  warn "The amount for CPU_CORES (${CPU_CORES}) exceeds the amount of logical cores available (${CORES}) and will be limited."
   CPU_CORES="$CORES"
 fi
 
 # Check system
 
+QEMU_DIR="/run/shm"
+
 if [ ! -d "/dev/shm" ]; then
   error "Directory /dev/shm not found!" && exit 14
 else
-  [ ! -d "/run/shm" ] && ln -s /dev/shm /run/shm
+  [ ! -d "$QEMU_DIR" ] && ln -s /dev/shm "$QEMU_DIR"
 fi
 
+QEMU_PID="$QEMU_DIR/qemu.pid"
+
 # Check folder
 
 if [[ "${STORAGE,,}" != "/storage" ]]; then
@@ -101,12 +132,15 @@ if [[ "${FS,,}" == "ecryptfs" || "${FS,,}" == "tmpfs" ]]; then
 fi
 
 # Read memory
-RAM_SPARE=500000000
 RAM_AVAIL=$(free -b | grep -m 1 Mem: | awk '{print $7}')
 RAM_TOTAL=$(free -b | grep -m 1 Mem: | awk '{print $2}')
 
+RAM_SPARE=500000000
+RAM_MINIMUM=136314880
+
+RAM_SIZE=$(strip "$RAM_SIZE")
 RAM_SIZE="${RAM_SIZE// /}"
-[ -z "$RAM_SIZE" ] && error "RAM_SIZE not specified!" && exit 16
+[ -z "$RAM_SIZE" ] && RAM_SIZE="2G"
 
 if [[ "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
 
@@ -116,8 +150,8 @@ if [[ "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
 
   RAM_SIZE=$(echo "${RAM_SIZE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
   ! numfmt --from=iec "$RAM_SIZE" &>/dev/null && error "Invalid RAM_SIZE: $RAM_SIZE" && exit 16
-  RAM_WANTED=$(numfmt --from=iec "$RAM_SIZE")
-  [ "$RAM_WANTED" -lt "136314880 " ] && error "RAM_SIZE is too low: $RAM_SIZE" && exit 16
+  wanted=$(numfmt --from=iec "$RAM_SIZE")
+  [ "$wanted" -lt "$RAM_MINIMUM" ] && error "RAM_SIZE is too low: $RAM_SIZE" && exit 16
 
 fi
 
@@ -142,7 +176,7 @@ else
   TARGET="arm64"
 fi
 
-if [[ "$KVM" == [Nn]* ]]; then
+if disabled "$KVM"; then
   warn "KVM acceleration is disabled, this will cause the machine to run about 10 times slower!"
 else
   if [[ "${ARCH,,}" != "$TARGET" ]]; then
@@ -151,7 +185,7 @@ else
   fi
 fi
 
-if [[ "$KVM" != [Nn]* ]]; then
+if ! disabled "$KVM"; then
 
   KVM_ERR=""
 
@@ -166,6 +200,10 @@ if [[ "$KVM" != [Nn]* ]]; then
         if ! grep -qw "vmx\|svm" <<< "$flags"; then
           KVM_ERR="(not enabled in BIOS)"
         fi
+        if ! grep -qw "sse4_2" <<< "$flags"; then
+          error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
+          ! enabled "$DEBUG" && exit 88
+        fi
       fi
     fi
   fi
@@ -185,15 +223,15 @@ if [[ "$KVM" != [Nn]* ]]; then
           error "KVM acceleration is not available $KVM_ERR, this will cause the machine to run about 10 times slower."
           error "See the FAQ for possible causes, or disable acceleration by adding the \"KVM=N\" variable (not recommended)." ;;
       esac
-      [[ "$DEBUG" != [Yy1]* ]] && exit 88
+      ! enabled "$DEBUG" && exit 88
     fi
   fi
 
 fi
 
 # Cleanup files
-rm -f /run/shm/qemu.*
-rm -f /run/shm/dsm.url
+rm -f "$QEMU_DIR"/dsm.url
+rm -f "$QEMU_DIR"/qemu.* "$QEMU_DIR"/*.pid "$QEMU_DIR"/*.sock
 
 # Cleanup dirs
 rm -rf /tmp/dsm

src/serial.sh

@@ -5,10 +5,16 @@ set -Eeuo pipefail
 
 : "${HOST_MAC:=""}"
 : "${HOST_DEBUG:=""}"
-: "${HOST_SERIAL:=""}"
 : "${HOST_MODEL:=""}"
+: "${HOST_SERIAL:=""}"
 : "${GUEST_SERIAL:=""}"
 
+# Sanitize variables
+HOST_MAC=$(strip "$HOST_MAC")
+HOST_MODEL=$(strip "$HOST_MODEL")
+HOST_SERIAL=$(strip "$HOST_SERIAL")
+GUEST_SERIAL=$(strip "$GUEST_SERIAL")
+
 if [ -n "$HOST_MAC" ]; then
 
   HOST_MAC="${HOST_MAC//-/:}"
@@ -24,6 +30,8 @@ if [ -n "$HOST_MAC" ]; then
 
 fi
 
+HOST_PID="$QEMU_DIR/host.pid"
+
 HOST_ARGS=()
 HOST_ARGS+=("-cpu=$CPU_CORES")
 HOST_ARGS+=("-cpu_arch=$HOST_CPU")
@@ -33,13 +41,15 @@ HOST_ARGS+=("-cpu_arch=$HOST_CPU")
 [ -n "$HOST_SERIAL" ] && HOST_ARGS+=("-hostsn=$HOST_SERIAL")
 [ -n "$GUEST_SERIAL" ] && HOST_ARGS+=("-guestsn=$GUEST_SERIAL")
 
-if [[ "$HOST_DEBUG" == [Yy1]* ]]; then
+if enabled "$HOST_DEBUG"; then
   set -x
   ./host.bin "${HOST_ARGS[@]}" &
   { set +x; } 2>/dev/null
+  echo "$!" > "$HOST_PID"
   echo
 else
   ./host.bin "${HOST_ARGS[@]}" >/dev/null &
+  echo "$!" > "$HOST_PID"
 fi
 
 cnt=0
@@ -60,14 +70,7 @@ while ! nc -z -w2 127.0.0.1 "$CHR_PORT" > /dev/null 2>&1; do
 done
 
 # Configure serial ports
-
-if [[ "$CONSOLE" != [Yy]* ]]; then
-  SERIAL_OPTS="-serial pty"
-else
-  SERIAL_OPTS="-serial mon:stdio"
-fi
-
-SERIAL_OPTS+=" \
+SERIAL_OPTS="-serial mon:stdio \
         -device virtio-serial-pci,id=virtio-serial0,bus=pcie.0,addr=0x3 \
         -chardev socket,id=charchannel0,host=127.0.0.1,port=$CHR_PORT,reconnect=10 \
         -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=vchannel"

src/server.sh

@@ -2,17 +2,25 @@
 set -Eeuo pipefail
 
 : "${COM_PORT:="2210"}"    # Comm port
-: "${MON_PORT:="7100"}"    # Monitor port
 : "${WEB_PORT:="5000"}"    # Webserver port
 : "${CHR_PORT:="12345"}"   # Character port
 : "${WSD_PORT:="8004"}"    # Websockets port
 
-cp -r /var/www/* /run/shm
-rm -f /var/run/websocketd.pid
+# Sanitize port variables
+COM_PORT=$(strip "$COM_PORT")
+WEB_PORT=$(strip "$WEB_PORT")
+CHR_PORT=$(strip "$CHR_PORT")
+WSD_PORT=$(strip "$WSD_PORT")
+
+WEB_PID="/run/nginx.pid"
+WSD_PID="$QEMU_DIR/websocketd.pid"
+
+cp -r /var/www/* "$QEMU_DIR"
+rm -f "$WSD_PID" "$WEB_PID"
 
 html "Starting $APP for $ENGINE..."
 
-if [[ "${WEB:-}" != [Nn]* ]]; then
+if ! disabled "${WEB:-}"; then
 
   mkdir -p /etc/nginx/sites-enabled
   cp /etc/nginx/default.conf /etc/nginx/sites-enabled/web.conf
@@ -21,7 +29,7 @@ if [[ "${WEB:-}" != [Nn]* ]]; then
   sed -i "s/proxy_pass http:\/\/127.0.0.1:8004\/;/proxy_pass http:\/\/127.0.0.1:$WSD_PORT\/;/g" /etc/nginx/sites-enabled/web.conf
 
   # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
 
     sed -i "s/listen $WEB_PORT default_server;/listen [::]:$WEB_PORT default_server ipv6only=off;/g" /etc/nginx/sites-enabled/web.conf
 
@@ -32,7 +40,7 @@ if [[ "${WEB:-}" != [Nn]* ]]; then
 
   # Start websocket server
   websocketd --address 127.0.0.1 --port="$WSD_PORT" /run/socket.sh >/var/log/websocketd.log &
-  echo "$!" > /var/run/websocketd.pid
+  echo "$!" > "$WSD_PID"
 
 fi
 

src/utils.sh

@@ -7,6 +7,40 @@ info () { printf "%b%s%b" "\E[1;34m❯ \E[1;36m" "${1:-}" "\E[0m\n"; }
 error () { printf "%b%s%b" "\E[1;31m❯ " "ERROR: ${1:-}" "\E[0m\n" >&2; }
 warn () { printf "%b%s%b" "\E[1;31m❯ " "Warning: ${1:-}" "\E[0m\n" >&2; }
 
+strip() {
+  local value="${1:-}"
+
+  # Remove surrounding whitespace
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  # Remove leading/trailing single/double quotes
+  value="${value%\"}"
+  value="${value#\"}"
+  value="${value%\'}"
+  value="${value#\'}"
+
+  # Remove surrounding whitespace again
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  printf '%s' "$value"
+}
+
+enabled() {
+  case "$(strip "${1:-}")" in
+    Y|y|YES|Yes|yes|TRUE|True|true|1|ON|On|on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+disabled() {
+  case "$(strip "${1:-}")" in
+    N|n|NO|No|no|FALSE|False|false|0|OFF|Off|off) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 formatBytes() {
   local result
   result=$(numfmt --to=iec --suffix=B "$1" | sed -r 's/([A-Z])/ \1/' | sed 's/ B/ bytes/g;')
@@ -28,6 +62,7 @@ formatBytes() {
 
 isAlive() {
   local pid="$1"
+  [ -z "$pid" ] && return 1
 
   if kill -0 "$pid" 2>/dev/null; then
     return 0
@@ -36,23 +71,67 @@ isAlive() {
   return 1
 }
 
-pKill() {
+waitPid() {
+  local i=0
   local pid="$1"
+  local timeout="${2:-10}"
 
-  { kill -15 "$pid" || true; } 2>/dev/null
-
-  while isAlive "$pid"; do
+  while [ -n "$pid" ] && isAlive "$pid"; do
     sleep 0.2
+    i=$((i + 1))
+    (( i >= timeout * 5 )) && return 1
   done
 
   return 0
 }
 
+waitPidFile() {
+  local i=0
+  local pid=""
+  local file="$1"
+  local timeout="${2:-10}"
+
+  [ ! -s "$file" ] && return 0
+  ! read -r pid <"$file" && return 0
+  [ -z "$pid" ] && return 0
+
+  while [ -s "$file" ] && isAlive "$pid"; do
+    sleep 0.2
+    i=$((i + 1))
+    (( i >= timeout * 5 )) && return 1
+  done
+
+  rm -f -- "$file"
+  return 0
+}
+
+pKill() {
+  local pid="$1"
+  local timeout="${2:-10}"
+
+  { kill -15 -- "$pid" || :; } 2>/dev/null
+
+  if ! waitPid "$pid" "$timeout"; then
+    warn "Timed out while waiting for PID $pid"
+  fi
+
+  return 0
+}
+
 fWait() {
+  local i=0
   local name="$1"
+  local timeout="${2:-10}"
+
+  [ -z "$name" ] && return 0
 
   while pgrep -f -l "$name" >/dev/null; do
     sleep 0.2
+    i=$((i + 1))
+    if (( i >= timeout * 5 )); then
+      warn "Timed out while waiting for process: $name"
+      break
+    fi
   done
 
   return 0
@@ -60,9 +139,44 @@ fWait() {
 
 fKill() {
   local name="$1"
+  local timeout="${2:-10}"
 
-  { pkill -f "$name" || true; } 2>/dev/null
-  fWait "$name"
+  [ -z "$name" ] && return 0
+
+  { pkill -f "$name" || :; } 2>/dev/null
+  fWait "$name" "$timeout"
+
+  return 0
+}
+
+sKill() {
+  local pid=""
+  local file="$1"
+
+  [ ! -s "$file" ] && return 0
+  ! read -r pid <"$file" && return 0
+  [ -z "$pid" ] && return 0
+
+  if isAlive "$pid"; then
+    { kill -15 -- "$pid" || :; } 2>/dev/null
+  fi
+
+  return 0
+}
+
+mKill() {
+  local timeout=10
+  local files=("$@")
+
+  for file in "${files[@]}"; do
+    sKill "$file"
+  done
+
+  for file in "${files[@]}"; do
+    if ! waitPidFile "$file" "$timeout"; then
+      warn "Timed out while waiting for PID file: $file"
+    fi
+  done
 
   return 0
 }
@@ -178,6 +292,8 @@ cpu() {
 
 hasDisk() {
 
+  enabled "${DISK_DISABLE:-}" && return 1
+
   [ -b "/disk" ] && return 0
   [ -b "/disk1" ] && return 0
   [ -b "/dev/disk1" ] && return 0

web/js/script.js

@@ -7,10 +7,14 @@ function getInfo() {
     var url = "msg.html";
 
     try {
+        if (request) {
+            request.abort();
+        }
+
         if (window.XMLHttpRequest) {
             request = new XMLHttpRequest();
         } else {
-            throw "XMLHttpRequest not available!";
+            throw new Error("XMLHttpRequest not available!");
         }
 
         request.onreadystatechange = processInfo;