feat: Sanitize environment variables (#1192)

Added strip function to remove whitespace and quotes.

.github/workflows/build.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       -

.github/workflows/check.yml

@@ -7,9 +7,10 @@ jobs:
     name: shellcheck
     runs-on: ubuntu-latest
     steps:
-      - 
-        name: Checkout
-        uses: actions/checkout@v6
+    - 
+      name: Checkout
+      uses: actions/checkout@v7
+    - parallel:
       -
         name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master

.github/workflows/hub.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       -
         name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - 
         name: Docker Hub Description
         uses: peter-evans/dockerhub-description@v5

.github/workflows/review.yml

@@ -13,9 +13,10 @@ jobs:
     name: review
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
+    -
+      name: Checkout
+      uses: actions/checkout@v7
+    - parallel:
       -
         name: Spelling
         uses: reviewdog/action-misspell@v1
@@ -32,6 +33,7 @@ jobs:
         uses: reviewdog/action-hadolint@v1
         with:
           level: warning
+          fail_level: error
           reporter: github-pr-review
           hadolint_ignore: DL3008 DL3003 DL3006 DL3013
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -52,8 +54,10 @@ jobs:
       -
         name: Shellformat
         uses: reviewdog/action-shfmt@v1
+        if: false
         with:
           level: warning
+          fail_on_error: "true"
           shfmt_flags: "-i 2 -ci -bn"
           github_token: ${{ secrets.GITHUB_TOKEN }}
       -
@@ -61,6 +65,7 @@ jobs:
         uses: reviewdog/action-shellcheck@v1
         with:
           level: warning
+          fail_level: error
           reporter: github-pr-review
-          shellcheck_flags: -x -e SC2001 -e SC2034 -e SC2064 -e SC2317 -e SC2153 -e SC2028          
+          shellcheck_flags: -x -e SC1091 -e SC2001 -e SC2034 -e SC2064 -e SC2317 -e SC2153 -e SC2028
           github_token: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -1,20 +1,12 @@
 # syntax=docker/dockerfile:1
 
 FROM qemux/qemu-host:2.05 AS builder
-
-#  FROM golang as builder
-#  WORKDIR /
-#  RUN git clone https://github.com/qemus/qemu-host.git
-#  WORKDIR /qemu-host/src
-#  RUN go mod download
-#  RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o /qemu-host.bin .
-
 FROM debian:trixie-slim
 
 ARG TARGETARCH
 ARG TARGETPLATFORM
 ARG VERSION_ARG="0.0"
-ARG VERSION_PASST="2026_05_07"
+ARG VERSION_PASST="2026_06_11"
 
 ARG DEBCONF_NOWARNINGS="yes"
 ARG DEBIAN_FRONTEND="noninteractive"
@@ -59,7 +51,7 @@ RUN set -eu && \
     echo "allow br0" > /etc/qemu/bridge.conf && \
     unlink /etc/nginx/sites-enabled/default && \
     sed -i 's/^worker_processes.*/worker_processes 1;/' /etc/nginx/nginx.conf && \
-    echo "$VERSION_ARG" > /run/version && \
+    echo "$VERSION_ARG" > /etc/version && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 COPY --chmod=755 ./src /run/

readme.md

@@ -18,11 +18,11 @@ Virtual DSM in a Docker container.
 
  - Multiple disks
  - KVM acceleration
- - Upgrades supported
- 
+ - Automatic download
+
 ## Usage  🐳
 
-##### Via Docker Compose:
+##### Docker Compose:
 
 ```yaml
 services:
@@ -44,22 +44,31 @@ services:
     stop_grace_period: 2m
 ```
 
-##### Via Docker CLI:
+##### Docker CLI:
 
 ```bash
 docker run -it --rm --name dsm -e "DISK_SIZE=256G" -p 5000:5000 --device=/dev/kvm --device=/dev/net/tun --cap-add NET_ADMIN -v "${PWD:-.}/dsm:/storage" --stop-timeout 120 docker.io/vdsm/virtual-dsm
 ```
 
-##### Via Kubernetes:
+##### Kubernetes:
 
 ```shell
 kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/master/kubernetes.yml
 ```
 
-##### Via Github Codespaces:
+##### GitHub Codespaces:
 
 [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/vdsm/virtual-dsm)
 
+## Requirements ⚙️
+
+ - A Linux host with KVM support, or Docker Desktop / Podman on Windows 11 with nested virtualization enabled.
+ - At least 2 GB of RAM available.
+ - At least 32 GB of free disk space.
+
+> [!NOTE]
+> Docker Desktop on macOS and Windows 10 do not currently provide the required KVM support for this image.
+
 ## FAQ 💬
 
 ### How do I use it?
@@ -95,7 +104,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
   ```
   
 > [!TIP]
-> This can also be used to resize the existing disk to a larger capacity without any data loss.
+> This can also be used to resize an existing disk to a larger capacity without any data loss.
 
 ### How do I add multiple disks?
 
@@ -110,9 +119,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - ./example3:/storage3
   ```
 
-### How do I pass-through a disk?
+### How do I pass through a disk?
 
-   It is possible to pass-through disk devices or partitions directly by adding them to your compose file in this way:
+   You can pass through disk devices or partitions directly by adding them to your compose file in this way:
 
   ```yaml
   devices:
@@ -158,7 +167,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
   - you enabled "nested virtualization" if you are running the container inside a virtual machine.
 
-  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPS's.
+  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPSs.
 
   If you did not receive any error from `kvm-ok` but the container still complains about a missing KVM device, it could help to add `privileged: true` to your compose file (or `sudo` to your `docker` command) to rule out any permission issue.
 
@@ -214,9 +223,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - 'c *:* rwm'
   ```
 
-### How do I pass-through the GPU?
+### How do I pass through the GPU?
 
-  To pass-through your Intel GPU, add the following lines to your compose file:
+  To pass through your Intel GPU, add the following lines to your compose file:
 
   ```yaml
   environment:
@@ -254,12 +263,12 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
 ### Is this project legal?
 
-  Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project will be considered legal. 
+  Yes, this project contains only open-source code and does not distribute any material owned by Synology. Neither does it try to circumvent any copyright protection measures.
   
   However, by installing Synology's Virtual DSM, you must accept their end-user license agreement, which does not permit installation on non-Synology hardware. So only run this container on an official Synology NAS, as any other use will be a violation of their terms and conditions.
 
 ## Stars 🌟
-[![Stars](https://starchart.cc/vdsm/virtual-dsm.svg?variant=adaptive)](https://starchart.cc/vdsm/virtual-dsm)
+[![Stargazers](https://raw.githubusercontent.com/star-stats/stars/refs/heads/data/charts/vdsm-virtual-dsm.svg)](https://github.com/vdsm/virtual-dsm/stargazers)
 
 ## Disclaimer ⚖️
 

src/check.sh

@@ -4,15 +4,15 @@ set -Eeuo pipefail
 : "${DHCP:="N"}"
 : "${NETWORK:="Y"}"
 
-[ -f "/run/shm/qemu.end" ] && echo "QEMU is shutting down.." && exit 1
-[ ! -s "/run/shm/qemu.pid" ] && echo "QEMU is not running yet.." && exit 0
-[[ "$NETWORK" == [Nn]* ]] && echo "Networking is disabled.." && exit 0
+[ -f "/run/shm/qemu.end" ] && echo "QEMU is shutting down..." && exit 1
+[ ! -s "/run/shm/qemu.pid" ] && echo "QEMU is not running yet..." && exit 0
+[[ "$NETWORK" == [Nn]* ]] && echo "Networking is disabled." && exit 0
 
 file="/run/shm/dsm.url"
 address="/run/shm/qemu.ip"
 gateway="/run/shm/qemu.gw"
 
-[ ! -s  "$file" ] && echo "DSM has not enabled networking yet.." && exit 1
+[ ! -s  "$file" ] && echo "DSM has not enabled networking yet..." && exit 1
 
 location=$(<"$file")
 

src/config.sh

@@ -3,6 +3,7 @@ set -Eeuo pipefail
 
 DEF_OPTS="-nodefaults -boot strict=on"
 RAM_OPTS=$(echo "-m ${RAM_SIZE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
+MON_OPTS="-name $PROCESS,process=$PROCESS,debug-threads=on -pidfile $QEMU_PID"
 CPU_OPTS="-cpu $CPU_FLAGS -smp $CPU_CORES,sockets=1,dies=1,cores=$CPU_CORES,threads=1"
 MAC_OPTS="-machine type=q35,smm=off,usb=off,vmport=off,dump-guest-core=off,hpet=off${KVM_OPTS}"
 DEV_OPTS="-device virtio-balloon-pci,id=balloon0,bus=pcie.0,addr=0x4"

src/disk.sh

@@ -11,6 +11,15 @@ set -Eeuo pipefail
 : "${DISK_DISCARD:="on"}"         # Controls whether unmap (TRIM) commands are passed to the host.
 : "${DISK_ROTATION:="1"}"         # Rotation rate, set to 1 for SSD storage and increase for HDD
 
+# Sanitize all variables
+DISK_IO=$(strip "$DISK_IO")
+DISK_FMT=$(strip "$DISK_FMT")
+DISK_TYPE=$(strip "$DISK_TYPE")
+DISK_FLAGS=$(strip "$DISK_FLAGS")
+DISK_CACHE=$(strip "$DISK_CACHE")
+DISK_DISCARD=$(strip "$DISK_DISCARD")
+DISK_ROTATION=$(strip "$DISK_ROTATION")
+
 BOOT="$STORAGE/$BASE.boot.img"
 SYSTEM="$STORAGE/$BASE.system.img"
 
@@ -110,7 +119,7 @@ createDisk() {
 
   DATA_SIZE=$(numfmt --from=iec "$DISK_SPACE")
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -139,7 +148,7 @@ createDisk() {
         { chattr +C "$DISK_FILE"; } || :
       fi
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Create an empty file
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -198,7 +207,7 @@ resizeDisk() {
   local REQ=$(( DATA_SIZE - CUR_SIZE ))
   (( REQ < 1 )) && error "Shrinking disks is not supported yet, please increase ${DISK_DESC^^}_SIZE." && exit 71
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -221,7 +230,7 @@ resizeDisk() {
   case "${DISK_FMT,,}" in
     raw)
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Resize file by changing its length
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -264,15 +273,15 @@ convertDisk() {
   local FS="$7"
 
   [ -f "$DST_FILE" ] && error "Conversion failed, destination file $DST_FILE already exists?" && exit 79
-  [ ! -f "$SOURCE_FILE" ] && error "Conversion failed, source file $SOURCE_FILE does not exists?" && exit 79
+  [ ! -f "$SOURCE_FILE" ] && error "Conversion failed, source file $SOURCE_FILE does not exist?" && exit 79
 
   local TMP_FILE="$DISK_BASE.tmp"
   rm -f "$TMP_FILE"
 
-  local DIR
+  local DIR FA
   DIR=$(dirname "$TMP_FILE")
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     local CUR_SIZE SPACE GB
 
@@ -297,7 +306,7 @@ convertDisk() {
   isCow "$FS" && DISK_PARAM+=",nocow=on"
 
   if [[ "$DST_FMT" != "raw" ]]; then
-    if [[ "$ALLOCATE" == [Nn]* ]]; then
+    if disabled "$ALLOCATE"; then
       CONV_FLAGS+=" -c"
     fi
     [ -n "$DISK_FLAGS" ] && DISK_PARAM+=",$DISK_FLAGS"
@@ -310,7 +319,7 @@ convertDisk() {
   fi
 
   if [[ "$DST_FMT" == "raw" ]]; then
-    if [[ "$ALLOCATE" != [Nn]* ]]; then
+    if ! disabled "$ALLOCATE"; then
       # Work around qemu-img bug
       CUR_SIZE=$(stat -c%s "$TMP_FILE")
       if ! fallocate -l "$CUR_SIZE" "$TMP_FILE" &>/dev/null; then
@@ -426,6 +435,20 @@ createDevice () {
   return 0
 }
 
+finishDisks () {
+
+  case "${DISK_TYPE,,}" in
+    "blk" | "scsi" | "virtio-blk" | "virtio-scsi" )
+      DISK_OPTS+=" -object iothread,id=io2" ;;
+  esac
+
+  if ! enabled "$DISK_DISABLE"; then
+    html "Initialized disks successfully..."
+  fi
+
+  return 0
+}
+
 addDisk () {
 
   local DISK_BASE="$1"
@@ -526,7 +549,7 @@ addDisk () {
 
   fi
 
-  if [ -f "$DISK_FILE" ] && [[ "$ALLOCATE" == [Nn]* ]]; then
+  if [ -f "$DISK_FILE" ] && disabled "$ALLOCATE"; then
 
     CUR_SIZE=$(getSize "$DISK_FILE")
     USED=$(du -sB 1 "$DISK_FILE" | cut -f1)
@@ -600,13 +623,16 @@ addDevice () {
   return 0
 }
 
-msg="Initializing disks..."
-html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
-
 [ -z "${DISK_OPTS:-}" ] && DISK_OPTS=""
 [ -z "${DISK_TYPE:-}" ] && DISK_TYPE="scsi"
 [ -z "${DISK_NAME:-}" ] && DISK_NAME="data"
+[ -z "${DISK_DISABLE:-}" ] && DISK_DISABLE=""
+
+if ! enabled "$DISK_DISABLE"; then
+  msg="Initializing disks..."
+  html "$msg"
+  enabled "$DEBUG" && echo "$msg"
+fi
 
 case "${DISK_TYPE,,}" in
   "ide" | "sata" | "nvme" | "usb" | "scsi" | "blk" | "auto" | "none" ) ;;
@@ -617,7 +643,7 @@ if [ -z "$ALLOCATE" ]; then
   ALLOCATE="N"
 fi
 
-if [[ "$ALLOCATE" == [Nn]* ]]; then
+if disabled "$ALLOCATE"; then
   DISK_STYLE="growable"
   DISK_ALLOC="preallocation=off"
 else
@@ -628,6 +654,11 @@ fi
 DISK_OPTS+=$(createDevice "$BOOT" "$DISK_TYPE" "1" "0xa" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 DISK_OPTS+=$(createDevice "$SYSTEM" "$DISK_TYPE" "2" "0xb" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 
+if enabled "$DISK_DISABLE"; then
+  finishDisks
+  return 0
+fi
+
 DISK1_FILE="$STORAGE/${DISK_NAME}"
 DISK2_FILE="/storage2/${DISK_NAME}2"
 DISK3_FILE="/storage3/${DISK_NAME}3"
@@ -677,7 +708,6 @@ else
   addDisk "$DISK4_FILE" "$DISK_TYPE" "disk4" "$DISK4_SIZE" "6" "0xf" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" || exit $?
 fi
 
-DISK_OPTS+=" -object iothread,id=io2"
+finishDisks
 
-html "Initialized disks successfully..."
 return 0

src/display.sh

@@ -8,9 +8,14 @@ set -Eeuo pipefail
 : "${DISPLAY:="none"}"  # Display type
 : "${RENDERNODE:="/dev/dri/renderD128"}"  # Render node
 
+# Sanitize variables
+VGA=$(strip "$VGA")
+DISPLAY=$(strip "$DISPLAY")
+RENDERNODE=$(strip "$RENDERNODE")
+
 CPU_VENDOR=$(lscpu | awk '/Vendor ID/{print $3}')
 
-if [[ "$GPU" != [Yy1]* || "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
+if ! enabled "$GPU" || [[ "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
 
   [[ "${DISPLAY,,}" == "none" ]] && VGA="none"
   DISPLAY_OPTS="-display $DISPLAY -vga $VGA"
@@ -20,7 +25,7 @@ fi
 
 msg="Configuring display drivers..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 DISPLAY_OPTS="-display egl-headless,rendernode=$RENDERNODE"
 DISPLAY_OPTS+=" -vga $VGA"

src/entry.sh

@@ -24,19 +24,23 @@ cd /run
 
 trap - ERR
 
-version=$(qemu-system-x86_64 --version | head -n 1 | cut -d '(' -f 1 | awk '{ print $NF }')
+cmd=(qemu-system-x86_64)
+version=$("${cmd[@]}" --version | awk 'NR==1 { print $4 }')
 info "Booting $APP using QEMU v$version..."
 
-if [[ "$CONSOLE" == [Yy]* ]]; then
-  exec qemu-system-x86_64 ${ARGS:+ $ARGS}
+if ! enabled "$SHUTDOWN"; then
+  exec "${cmd[@]}" ${ARGS:+ $ARGS}
 fi
 
-{ qemu-system-x86_64 ${ARGS:+ $ARGS} >"$QEMU_OUT" 2>"$QEMU_LOG"; rc=$?; } || :
-(( rc != 0 )) && error "$(<"$QEMU_LOG")" && exit 15
+if [ ! -t 1 ] || [ ! -c /dev/tty ]; then
+  "${cmd[@]}" ${ARGS:+ $ARGS} &
+else
+  "${cmd[@]}" ${ARGS:+ $ARGS} </dev/tty >/dev/tty &
+fi
 
-terminal
-tail -fn +0 "$QEMU_LOG" --pid=$$ 2>/dev/null &
-cat "$QEMU_TERM" 2>/dev/null & wait $! || :
+rc=0
+wait $! || rc=$?
+[ -f "$QEMU_END" ] && exit "$rc"
 
 sleep 1 & wait $!
-[ ! -f "$QEMU_END" ] && finish 0
+finish "$rc"

src/finish.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-if [[ "$DEBUG" == [Yy1]* ]]; then
+if enabled "$DEBUG"; then
   printf "QEMU arguments:\n\n%s\n\n" "${ARGS// -/$'\n-'}"
 fi
 

src/install.sh

@@ -27,6 +27,8 @@ FILE=$(find / -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ ! -s "$FILE" ] && FILE=$(find "$STORAGE" -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ -s "$FILE" ] && BASE="DSM_VirtualDSM" && URL="file://$FILE" 
 
+URL=$(strip "$URL")
+
 if [ -n "$URL" ] && [ ! -s "$FILE" ] && [ ! -d "$DIR" ]; then
   BASE=$(basename "$URL" .pat)
   if [ ! -s "$STORAGE/$BASE.system.img" ]; then

src/memory.sh

@@ -2,12 +2,12 @@
 set -Eeuo pipefail
 
 msg="Checking memory..."
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 RAM_AVAIL=$(free -b | grep -m 1 Mem: | awk '{print $7}')
 AVAIL_MEM=$(formatBytes "$RAM_AVAIL")
 
-if [[ "$RAM_CHECK" != [Nn]* && "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
+if ! disabled "$RAM_CHECK" && [[ "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
 
   wanted=$(numfmt --from=iec "$RAM_SIZE")
 

src/network.sh

@@ -24,6 +24,7 @@ set -Eeuo pipefail
 : "${PASST_OPTS:=""}"
 : "${PASST_DEBUG:=""}"
 : "${PASST_PID:="/var/run/passt.pid"}"
+: "${PASST_SOCKET:="/tmp/passt.socket"}"
 
 : "${DNSMASQ_OPTS:=""}"
 : "${DNSMASQ_DEBUG:=""}"
@@ -31,6 +32,15 @@ set -Eeuo pipefail
 : "${DNSMASQ_PID:="/var/run/dnsmasq.pid"}"
 : "${DNSMASQ_CONF_DIR:="/etc/dnsmasq.d"}"
 
+# Sanitize variables
+MAC=$(strip "$MAC")
+MTU=$(strip "$MTU")
+ADAPTER=$(strip "$ADAPTER")
+NETWORK=$(strip "$NETWORK")
+PASST_MTU=$(strip "$PASST_MTU")
+HOST_PORTS=$(strip "$HOST_PORTS")
+USER_PORTS=$(strip "$USER_PORTS")
+
 ADD_ERR="Please add the following setting to your container:"
 
 # ######################################
@@ -39,7 +49,7 @@ ADD_ERR="Please add the following setting to your container:"
 
 configureDHCP() {
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring MACVTAP networking..."
+  enabled "$DEBUG" && echo "Configuring MACVTAP networking..."
 
   # Create the necessary file structure for /dev/vhost-net
   if [ ! -c /dev/vhost-net ]; then
@@ -127,8 +137,8 @@ configureDNS() {
 
   echo "$gateway" > /run/shm/qemu.gw
 
-  [[ "${DNSMASQ_DISABLE:-}" == [Yy1]* ]] && return 0
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Starting dnsmasq daemon..."
+  enabled "${DNSMASQ_DISABLE:-}" && return 0
+  enabled "$DEBUG" && echo "Starting dnsmasq daemon..."
 
   [ -s "$DNSMASQ_PID" ] && pKill "$(<"$DNSMASQ_PID")"
   rm -f "$DNSMASQ_PID"
@@ -173,7 +183,7 @@ configureDNS() {
   arguments+=" --log-facility=$log"
 
   arguments=$(echo "$arguments" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
-  [[ "$DEBUG" == [Yy1]* ]] && printf "Dnsmasq arguments:\n\n%s\n\n" "${arguments// -/$'\n-'}"
+  enabled "$DEBUG" && printf "Dnsmasq arguments:\n\n%s\n\n" "${arguments// -/$'\n-'}"
 
   { $DNSMASQ ${arguments:+ $arguments}; rc=$?; } || :
 
@@ -181,7 +191,7 @@ configureDNS() {
 
     local msg="Failed to start Dnsmasq, reason: $rc"
 
-    if [[ "${NETWORK,,}" == "slirp" || "${NETWORK,,}" == "passt" || "$ROOTLESS" != [Yy1]* || "$DEBUG" == [Yy1]* ]]; then
+    if [[ "${NETWORK,,}" == "slirp" || "${NETWORK,,}" == "passt" ]] || ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
       [ -f "$log" ] && [ -s "$log" ] && cat "$log"
       error "$msg"
     fi
@@ -189,7 +199,7 @@ configureDNS() {
     return 1
   fi
 
-  if [[ "$DNSMASQ_DEBUG" == [Yy1]* ]]; then
+  if enabled "$DNSMASQ_DEBUG"; then
     tail -fn +0 "$log" --pid=$$ &
   fi
 
@@ -198,9 +208,7 @@ configureDNS() {
 
 getHostPorts() {
 
-  local list=""
-  list+="$MON_PORT,"
-  list+="${HOST_PORTS// /},"
+  local list="${HOST_PORTS// /},"
 
   # Remove duplicates
   list=$(echo "${list//,,/,}," | awk 'BEGIN{RS=ORS=","} !seen[$0]++' | sed 's/,*$//g')
@@ -285,7 +293,7 @@ getSlirp() {
 configureSlirp() {
 
   NETWORK="slirp"
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring slirp networking..."
+  enabled "$DEBUG" && echo "Configuring slirp networking..."
 
   local ip="$IP"
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
@@ -302,12 +310,15 @@ configureSlirp() {
   forward=$(getSlirp "$ip")
   [ -n "$forward" ] && NET_OPTS+=",$forward"
 
-  if [[ "${DNSMASQ_DISABLE:-}" == [Yy1]* ]]; then
+  if enabled "${DNSMASQ_DISABLE:-}"; then
     echo "$gateway" > /run/shm/qemu.gw
   else
     [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
     configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
   VM_NET_IP="$ip"
@@ -317,7 +328,7 @@ configureSlirp() {
 configurePasst() {
 
   NETWORK="passt"
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring user-mode networking..."
+  enabled "$DEBUG" && echo "Configuring user-mode networking..."
 
   local log="/tmp/passt.log"
   rm -f "$log"
@@ -354,27 +365,31 @@ configurePasst() {
   PASST_OPTS+=" -H $VM_NET_HOST"
   PASST_OPTS+=" -M $GATEWAY_MAC"
   PASST_OPTS+=" -P $PASST_PID"
+  PASST_OPTS+=" -s $PASST_SOCKET"
   PASST_OPTS+=" -l $log"
   PASST_OPTS+=" -q"
 
-  if [[ "${DNSMASQ_DISABLE:-}" != [Yy1]* ]]; then
+  if ! enabled "${DNSMASQ_DISABLE:-}"; then
     [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
   PASST_OPTS=$(echo "$PASST_OPTS" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
 
-  if [[ "$DEBUG" == [Yy1]* || "$PASST_DEBUG" == [Yy1]* ]]; then
+  if enabled "$DEBUG" || enabled "$PASST_DEBUG"; then
     printf "Passt arguments:\n\n%s\n\n" "${PASST_OPTS// -/$'\n-'}"
   fi
 
   [ ! -f "$PASST" ] && cp /usr/bin/passt* /run
 
-  if ! $PASST ${PASST_OPTS:+ $PASST_OPTS} >/dev/null 2>&1; then
+  if ! "$PASST" ${PASST_OPTS:+$PASST_OPTS} >/dev/null 2>&1; then
 
     rm -f "$log"
     PASST_OPTS="${PASST_OPTS/ -q/}"
-    { $PASST ${PASST_OPTS:+ $PASST_OPTS}; rc=$?; } || :
+    { "$PASST" ${PASST_OPTS:+$PASST_OPTS}; rc=$?; } || :
 
     if (( rc != 0 )); then
       [ -f "$log" ] && [ -s "$log" ] && cat "$log"
@@ -384,15 +399,15 @@ configurePasst() {
 
   fi
 
-  if [[ "$PASST_DEBUG" == [Yy1]* ]]; then
+  if enabled "$PASST_DEBUG"; then
     tail -fn +0 "$log" --pid=$$ &
   else
-    if [[ "$DEBUG" == [Yy1]* ]]; then
+    if enabled "$DEBUG"; then
       [ -f "$log" ] && [ -s "$log" ] && cat "$log" && echo ""
     fi
   fi
 
-  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket"
+  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=$PASST_SOCKET"
 
   configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
 
@@ -400,12 +415,48 @@ configurePasst() {
   return 0
 }
 
+clearTables() {
+  local table="" line rules
+
+  # Choose between iptables or nftables
+  if command -v iptables-nft >/dev/null 2>&1 && iptables-nft -V >/dev/null 2>&1; then
+    update-alternatives --set iptables /usr/sbin/iptables-nft > /dev/null
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft > /dev/null
+  else
+    update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null
+  fi
+
+  # Store the current iptables ruleset
+  ! rules=$(iptables-save 2> /dev/null) && return 0
+  [ -z "$rules" ] && return 0
+
+  # Delete every rule tagged with our unique identifier, leaving all other rules intact.
+  while IFS= read -r line; do
+    case "$line" in
+      \*nat)    table="nat" ;;
+      \*filter) table="filter" ;;
+      \*mangle) table="mangle" ;;
+      \*raw)    table="raw" ;;
+    esac
+    if [[ "$line" == -A* ]]; then
+      local re="--comment[[:space:]]+\"?remove\"?([[:space:]]|\$)"
+      if [[ "$line" =~ $re ]]; then
+        read -ra args <<< "${line/-A /-D }"
+        iptables -t "$table" "${args[@]}" &> /dev/null || :
+      fi
+    fi
+  done <<< "$rules"
+
+  return 0
+}
+
 configureNAT() {
 
   local tuntap="TUN device is missing. $ADD_ERR --device /dev/net/tun"
   local tables="the 'ip_tables' kernel module is not loaded. Try this command: sudo modprobe ip_tables iptable_nat"
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring NAT networking..."
+  enabled "$DEBUG" && echo "Configuring NAT networking..."
 
   # Create the necessary file structure for /dev/net/tun
   if [ ! -c /dev/net/tun ]; then
@@ -416,7 +467,7 @@ configureNAT() {
   fi
 
   if [ ! -c /dev/net/tun ]; then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -424,14 +475,15 @@ configureNAT() {
   if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
     { sysctl -w net.ipv4.ip_forward=1 > /dev/null 2>&1; rc=$?; } || :
     if (( rc != 0 )) || [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
-      [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+      enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
       warn "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1"
       return 1
     fi
   fi
 
-  local ip base
-  base=$(echo "$IP" | sed -r 's/([^.]*.){2}//')
+  local ip base gateway exclude
+  base=$(cut -d. -f3,4 <<< "$IP")
+
   if [[ "$IP" != "172.30."* ]]; then
     ip="172.30.$base"
   else
@@ -440,22 +492,24 @@ configureNAT() {
 
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
 
-  local gateway=""
   if [[ "$ip" != *".1" ]]; then
     gateway="${ip%.*}.1"
   else
     gateway="${ip%.*}.2"
   fi
 
+  local subnet="${ip%.*}.0/24"
+  local broadcast="${ip%.*}.255"
+
   # Create a bridge with a static IP for the VM guest
   { ip link add dev "$VM_NET_BRIDGE" type bridge ; rc=$?; } || :
 
   if (( rc != 0 )); then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "failed to create bridge. $ADD_ERR --cap-add NET_ADMIN" && return 1
   fi
 
-  if ! ip address add "$gateway/24" broadcast "${ip%.*}.255" dev "$VM_NET_BRIDGE"; then
+  if ! ip address add "$gateway/24" broadcast "$broadcast" dev "$VM_NET_BRIDGE"; then
     warn "failed to add IP address pool!" && return 1
   fi
 
@@ -464,9 +518,9 @@ configureNAT() {
     sleep 2
   done
 
-  # QEMU Works with taps, set tap to the bridge created
+  # Set tap to the bridge created
   if ! ip tuntap add dev "$VM_NET_TAP" mode tap; then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -477,7 +531,7 @@ configureNAT() {
   fi
 
   if ! ip link set dev "$VM_NET_TAP" address "$GATEWAY_MAC"; then
-    warn "failed to set gateway MAC address.."
+    warn "failed to set gateway MAC address."
   fi
 
   while ! ip link set "$VM_NET_TAP" up promisc on; do
@@ -489,13 +543,8 @@ configureNAT() {
     warn "failed to set master bridge!" && return 1
   fi
 
-  if command -v iptables-nft >/dev/null 2>&1 && iptables-nft -V >/dev/null 2>&1; then
-    update-alternatives --set iptables /usr/sbin/iptables-nft > /dev/null
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft > /dev/null
-  else
-    update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null
-  fi
+  # Flush existing tables
+  clearTables
 
   exclude=$(getHostPorts)
 
@@ -507,25 +556,36 @@ configureNAT() {
     fi
   fi
 
-  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE > /dev/null 2>&1; then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
-    if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE; then
+  # NAT traffic from bridge subnet to Docker uplink
+  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE > /dev/null 2>&1; then
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
+    if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE; then
       warn "$tables" && return 1
     fi
   fi
 
   # shellcheck disable=SC2086
-  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -j DNAT --to "$ip"; then
+  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -m comment --comment "remove" -j DNAT --to "$ip"; then
     warn "failed to configure IP tables!" && return 1
   fi
 
-  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp -j DNAT --to "$ip"; then
+  if ! iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp -m comment --comment "remove" -j DNAT --to "$ip"; then
     warn "failed to configure IP tables!" && return 1
   fi
 
   if (( KERNEL > 4 )); then
     # Hack for guest VMs complaining about "bad udp checksums in 5 packets"
-    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true
+    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -m comment --comment "remove" -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true
+  fi
+
+  # Allow forwarding from bridge -> dev
+  if ! iptables -A FORWARD -i "$VM_NET_BRIDGE" -o "$VM_NET_DEV" -m comment --comment "remove" -j ACCEPT; then
+    warn "failed to configure IP tables!" && return 1
+  fi
+
+  # Allow return traffic
+  if ! iptables -A FORWARD -i "$VM_NET_DEV" -o "$VM_NET_BRIDGE" -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "remove" -j ACCEPT; then
+    warn "failed to configure IP tables!" && return 1
   fi
 
   NET_OPTS="-netdev tap,id=hostnet0,ifname=$VM_NET_TAP"
@@ -545,74 +605,50 @@ configureNAT() {
 
 closeBridge() {
 
-  [ -s "$PASST_PID" ] && pKill "$(<"$PASST_PID")"
-  rm -f "$PASST_PID"
+  local pids=( "$PASST_PID" "$DNSMASQ_PID" )
+  mKill "${pids[@]}"
 
-  [ -s "$DNSMASQ_PID" ] && pKill "$(<"$DNSMASQ_PID")"
-  rm -f "$DNSMASQ_PID"
+  ip link set "$VM_NET_TAP" down promisc off &> /dev/null || :
+  ip link delete "$VM_NET_TAP" &> /dev/null || :
 
-  case "${NETWORK,,}" in
-    "user"* | "passt" | "slirp" ) return 0 ;;
-  esac
-
-  ip link set "$VM_NET_TAP" down promisc off &> /dev/null || true
-  ip link delete "$VM_NET_TAP" &> /dev/null || true
-
-  ip link set "$VM_NET_BRIDGE" down &> /dev/null || true
-  ip link delete "$VM_NET_BRIDGE" &> /dev/null || true
+  ip link set "$VM_NET_BRIDGE" down &> /dev/null || :
+  ip link delete "$VM_NET_BRIDGE" &> /dev/null || :
 
+  clearTables
   return 0
 }
 
 closeWeb() {
 
-  # Shutdown nginx
-  nginx -s stop 2> /dev/null
-  fWait "nginx"
-
-  # Shutdown websocket
-  local pid="/var/run/websocketd.pid"
-  [ -s "$pid" ] && pKill "$(<"$pid")"
-  rm -f "$pid"
+  local pids=( "$WEB_PID" "$WSD_PID" )
+  mKill "${pids[@]}"
 
   return 0
 }
 
 closeNetwork() {
 
-  if [[ "${WEB:-}" != [Nn]* && "$DHCP" == [Yy1]* ]]; then
+  if ! disabled "${WEB:-}" && enabled "$DHCP"; then
     closeWeb
   fi
 
-  [[ "$NETWORK" == [Nn]* ]] && return 0
+  disabled "$NETWORK" && return 0
 
   exec 30<&- || true
   exec 40<&- || true
 
-  if [[ "$DHCP" != [Yy1]* ]]; then
-
-    closeBridge
-    return 0
-
-  fi
-
-  ip link set "$VM_NET_TAP" down || true
-  ip link delete "$VM_NET_TAP" || true
+  closeBridge
 
   return 0
 }
 
 cleanUp() {
 
-  # Clean up old files
-  rm -f "$PASST_PID"
-  rm -f "$DNSMASQ_PID"
-  rm -f /etc/resolv.dnsmasq
+  closeBridge
 
-  if [[ -d "/sys/class/net/$VM_NET_TAP" ]]; then
-    info "Lingering interface will be removed..."
-    ip link delete "$VM_NET_TAP" || true
-  fi
+  # Clean up old files
+  rm -f "$PASST_PID" "$PASST_SOCKET"
+  rm -f "$DNSMASQ_PID" /etc/resolv.dnsmasq
 
   return 0
 }
@@ -628,7 +664,7 @@ checkOS() {
   [[ "${kernel,,}" == *"darwin"* ]] && os="$ENGINE Desktop for macOS"
   [[ "${kernel,,}" == *"microsoft"* ]] && os="$ENGINE Desktop for Windows"
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
+  if enabled "$DHCP"; then
     iface="macvtap"
     [[ "${kernel,,}" == *"synology"* ]] && os="Synology Container Manager"
   fi
@@ -649,7 +685,7 @@ getInfo() {
     [ -d "/sys/class/net/net2" ] && VM_NET_DEV="net2"
     [ -d "/sys/class/net/net3" ] && VM_NET_DEV="net3"
     # Automatically detect the default network interface
-    [ -z "$VM_NET_DEV" ] && VM_NET_DEV=$(awk '$2 == 00000000 { print $1 }' /proc/net/route)
+    [ -z "$VM_NET_DEV" ] && VM_NET_DEV=$(awk '$2 == 00000000 { print $1; exit }' /proc/net/route)
     [ -z "$VM_NET_DEV" ] && VM_NET_DEV="eth0"
   fi
 
@@ -659,15 +695,12 @@ getInfo() {
   fi
 
   GATEWAY=$(ip route list dev "$VM_NET_DEV" | awk ' /^default/ {print $3}' | head -n 1)
-  { IP=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/ | head -n 1); rc=$?; } 2>/dev/null || :
-
-  if (( rc != 0 )); then
-    error "Could not determine container IP address!" && exit 26
-  fi
+  { IP=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/ | head -n 1); } 2>/dev/null || :
+  [ -z "$IP" ] && ! enabled "$DHCP" && error "Could not determine container IPv4 address!" && exit 26
 
   IP6=""
   # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
     { IP6=$(ip -6 addr show dev "$VM_NET_DEV" scope global up); rc=$?; } 2>/dev/null || :
     (( rc != 0 )) && IP6=""
     [ -n "$IP6" ] && IP6=$(echo "$IP6" | sed -e's/^.*inet6 \([^ ]*\)\/.*$/\1/;t;d' | head -n 1)
@@ -675,16 +708,16 @@ getInfo() {
 
   local result nic bus
   result=$(ethtool -i "$VM_NET_DEV")
-  nic=$(grep -m 1 -i 'driver:' <<< "$result" | awk '{print $(2)}')
-  bus=$(grep -m 1 -i 'bus-info:' <<< "$result" | awk '{print $(2)}')
+  nic=$(grep -m 1 -i 'driver:' <<< "$result" | awk '{print $2}')
+  bus=$(grep -m 1 -i 'bus-info:' <<< "$result" | awk '{print $2}')
 
   if [[ "${bus,,}" != "" && "${bus,,}" != "n/a" && "${bus,,}" != "tap" ]]; then
-    [[ "$DEBUG" == [Yy1]* ]] && info "Detected BUS: $bus"
+    enabled "$DEBUG" && info "Detected BUS: $bus"
     error "This container does not support host mode networking!"
     exit 29
   fi
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
+  if enabled "$DHCP"; then
 
     checkOS
 
@@ -694,7 +727,7 @@ getInfo() {
     fi
 
     if [[ "${nic,,}" != "macvlan" ]]; then
-      [[ "$DEBUG" == [Yy1]* ]] && info "Detected NIC: $nic"
+      enabled "$DEBUG" && info "Detected NIC: $nic"
       error "The container needs to be in a MACVLAN network when DHCP=Y."
       exit 29
     fi
@@ -762,19 +795,19 @@ getInfo() {
 
   GATEWAY_MAC=$(echo "$VM_NET_MAC" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/')
 
-  if [[ "$DEBUG" == [Yy1]* ]]; then
+  if enabled "$DEBUG"; then
     line="Host: $HOST  IP: $IP  Gateway: $GATEWAY  Interface: $VM_NET_DEV  MAC: $VM_NET_MAC  MTU: $mtu"
     [[ "$MTU" != "0" && "$MTU" != "$mtu" ]] && line+=" ($MTU)"
     info "$line"
     if [ -f /etc/resolv.conf ]; then
-      nameservers=$(grep '^nameserver*' /etc/resolv.conf | head -c -1 | sed 's/nameserver //g;' | sed -z 's/\n/, /g')
+      nameservers=$(grep '^nameserver ' /etc/resolv.conf | sed 's/^nameserver //' | paste -sd ',' | sed 's/,/, /g')
       [ -n "$nameservers" ] && info "Nameservers: $nameservers"
     fi
     echo
   fi
 
-  echo "$IP" > /run/shm/qemu.ip
-  echo "$nic" > /run/shm/qemu.nic
+  echo "$IP" > "$QEMU_DIR"/qemu.ip
+  echo "$nic" > "$QEMU_DIR"//qemu.nic
 
   return 0
 }
@@ -783,14 +816,14 @@ getInfo() {
 #  Configure Network
 # ######################################
 
-if [[ "$NETWORK" == [Nn]* ]]; then
+if disabled "$NETWORK"; then
   NET_OPTS=""
   return 0
 fi
 
 msg="Initializing network..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 getInfo
 cleanUp
@@ -802,14 +835,14 @@ fi
 MSG="Booting DSM instance..."
 html "$MSG"
 
-if [[ "$DHCP" == [Yy1]* ]]; then
+if enabled "$DHCP"; then
 
   # Configure for macvtap interface
   configureDHCP || exit 20
 
 else
 
-  if [[ "${WEB:-}" != [Nn]* ]]; then
+  if ! disabled "${WEB:-}"; then
     sleep 1.2
     closeWeb
   fi
@@ -824,7 +857,7 @@ else
         closeBridge
         NETWORK="user"
 
-        if [[ "$ROOTLESS" != [Yy1]* || "$DEBUG" == [Yy1]* ]]; then
+        if ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
           msg="falling back to user-mode networking!"
           msg="failed to setup NAT networking, $msg"
           warn "$msg"

src/power.sh

@@ -1,144 +1,115 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-: "${API_TIMEOUT:="50"}"   # API Call timeout
-: "${QEMU_TIMEOUT:="50"}"  # QEMU Termination timeout
+: "${SHUTDOWN:="Y"}"        # Graceful ACPI shutdown
+: "${TIMEOUT:="115"}"       # QEMU termination timeout
+: "${API_TIMEOUT:="90"}"    # External API call timeout
 
 # Configure QEMU for graceful shutdown
 
 API_CMD=6
 API_HOST="127.0.0.1:$COM_PORT"
 
-QEMU_TERM=""
-QEMU_LOG="$QEMU_DIR/qemu.log"
-QEMU_OUT="$QEMU_DIR/qemu.out"
+# Configure QEMU for graceful shutdown
+
 QEMU_END="$QEMU_DIR/qemu.end"
 
-if [[ "$KVM" == [Nn]* ]]; then
-  API_TIMEOUT=$(( API_TIMEOUT*2 ))
-  QEMU_TIMEOUT=$(( QEMU_TIMEOUT*2 ))
-fi
-
-touch "$QEMU_LOG"
-
 _trap() {
-  func="$1" ; shift
-  for sig ; do
+  local func="$1"; shift
+  local sig
+  TRAP_PID=$BASHPID
+
+  for sig; do
     trap "$func $sig" "$sig"
   done
 }
 
+app() {
+  echo "$APP" && return 0
+}
+
 finish() {
 
-  local pid
-  local cnt=0
+  local i=0
+  local pid=""
   local reason=$1
+  local pids=( "${HOST_PID:-}" "${WSD_PID:-}" \
+               "${WEB_PID:-}" "${PASST_PID:-}" "${DNSMASQ_PID:-}" )
 
   touch "$QEMU_END"
 
   if [ -s "$QEMU_PID" ]; then
-
-    pid=$(<"$QEMU_PID")
-    echo && error "Forcefully terminating Virtual DSM, reason: $reason..."
-    { kill -15 "$pid" || true; } 2>/dev/null
-
-    while isAlive "$pid"; do
-
-      sleep 1
-      cnt=$((cnt+1))
-
-      # Workaround for zombie pid
-      [ ! -s "$QEMU_PID" ] && break
-
-      if [ "$cnt" -eq 5 ]; then
-        echo && error "QEMU did not terminate itself, forcefully killing process..."
-        { kill -9 "$pid" || true; } 2>/dev/null
+    if read -r pid <"$QEMU_PID"; then
+      if [ -n "$pid" ] && isAlive "$pid"; then
+        local display="$reason"
+        case "$reason" in
+          129 ) display="SIGHUP" ;;
+          130 ) display="SIGINT" ;;
+          131 ) display="SIGQUIT" ;;
+          134 ) display="SIGABRT" ;;
+          143 ) display="SIGTERM" ;;
+        esac
+        error "Forcefully terminating $(app), reason: $display..."
+        { disown "$pid" || :; kill -9 -- "$pid" || :; } 2>/dev/null
       fi
-
-    done
-
-  fi
-
-  fKill "print.sh"
-  fKill "host.bin"
-
-  closeNetwork
-
-  sleep 1
-  echo && echo "❯ Shutdown completed!"
-
-  exit "$reason"
-}
-
-terminal() {
-
-  local dev=""
-
-  if [ -s "$QEMU_OUT" ]; then
-
-    local msg
-    msg=$(<"$QEMU_OUT")
-
-    if [ -n "$msg" ]; then
-
-      if [[ "${msg,,}" != "char"* ||  "$msg" != *"serial0)" ]]; then
-        echo "$msg"
-      fi
-
-      dev="${msg#*/dev/p}"
-      dev="/dev/p${dev%% *}"
-
     fi
   fi
 
-  if [ ! -c "$dev" ]; then
-    dev=$(echo 'info chardev' | nc -q 1 -w 1 localhost "$MON_PORT" | tr -d '\000')
-    dev="${dev#*serial0}"
-    dev="${dev#*pty:}"
-    dev="${dev%%$'\n'*}"
-    dev="${dev%%$'\r'*}"
+  mKill "${pids[@]}"
+  fKill "print.sh"
+
+  closeNetwork
+
+  if ! waitPidFile "$QEMU_PID" 10; then
+    warn "Timed out while waiting for $(app) to exit!"
   fi
 
-  if [ ! -c "$dev" ]; then
-    error "Device '$dev' not found!"
-    finish 34 && return 34
-  fi
-
-  QEMU_TERM="$dev"
-  return 0
+  (( reason != 1 )) && echo && echo "❯ Shutdown completed!"
+  exit "$reason"
 }
 
-_graceful_shutdown() {
+graceful_shutdown() {
 
-  local code=$?
-  local pid url response
+  local sig="$1"
+  local pid=""
+  local code=0
+  local start url response elapsed
 
-  set +e
+  [[ $BASHPID != "$TRAP_PID" ]] && return
+
+  case "$sig" in
+    SIGHUP)  code=129 ;;
+    SIGINT)  code=130 ;;
+    SIGQUIT) code=131 ;;
+    SIGABRT) code=134 ;;
+    SIGTERM) code=143 ;;
+  esac
 
   if [ -f "$QEMU_END" ]; then
     echo && info "Received $1 signal while already shutting down..."
     return
   fi
 
+  set +e
+  start=$SECONDS
   touch "$QEMU_END"
   echo && info "Received $1 signal, sending shutdown command..."
 
-  if [ ! -s "$QEMU_PID" ]; then
-    echo && error "QEMU PID file does not exist?"
-    finish "$code" && return "$code"
+  if [ ! -s "$QEMU_PID" ] || ! read -r pid <"$QEMU_PID"; then
+    warn "QEMU PID file ($QEMU_PID) does not exist?"
+    finish "$code"
   fi
 
-  pid=$(<"$QEMU_PID")
-
-  if ! isAlive "$pid"; then
-    echo && error "QEMU process does not exist?"
-    finish "$code" && return "$code"
+  if [ -z "$pid" ] || ! isAlive "$pid"; then
+    warn "QEMU process with PID $pid does not exist?"
+    finish "$code"
   fi
 
   # Don't send the powerdown signal because vDSM ignores ACPI signals
-  # echo 'system_powerdown' | nc -q 1 -w 1 localhost "$MON_PORT" > /dev/null
+  # nc -q 1 -w 1 -U "$QEMU_DIR/monitor.sock" &> /dev/null <<<'system_powerdown' || :
 
   # Send shutdown command to guest agent via serial port
+  API_TIMEOUT=$(strip "$API_TIMEOUT")
   url="http://$API_HOST/read?command=$API_CMD&timeout=$API_TIMEOUT"
   response=$(curl -sk -m "$(( API_TIMEOUT+2 ))" -S "$url" 2>&1)
 
@@ -151,44 +122,69 @@ _graceful_shutdown() {
     response="${response#*message\"\: \"}"
     [ -z "$response" ] && response="second signal"
     echo && error "Forcefully terminating because of: ${response%%\"*}"
-    { kill -15 "$pid" || true; } 2>/dev/null
+    kill -15 -- "$pid" 2>/dev/null || :
 
   fi
 
-  local cnt=0
+  local name
+  name="$(app)"
 
-  while [ "$cnt" -lt "$QEMU_TIMEOUT" ]; do
+  local term_grace=3      # seconds before loop ends to send SIGTERM
+  local cleanup_grace=3   # seconds reserved after the loop for cleanup
 
+  TIMEOUT=$(strip "$TIMEOUT")
+  if [[ ! "$TIMEOUT" =~ ^[0-9]+$ ]]; then
+    TIMEOUT=115
+  fi
+
+  if (( TIMEOUT >= 30 )); then
+    term_grace=5
+    cleanup_grace=5
+  elif (( TIMEOUT >= 15 )); then
+    term_grace=4
+    cleanup_grace=4
+  fi
+
+  local cnt=0 sigterm_at=0 min wait_until elapsed timeout_left
+
+  elapsed=$((SECONDS - start))
+  timeout_left=$((TIMEOUT - elapsed))
+
+  min=$((term_grace + cleanup_grace + 1))
+  (( timeout_left < min )) && timeout_left=$min
+
+  wait_until=$((timeout_left - cleanup_grace))
+  sigterm_at=$((wait_until - term_grace))
+
+  while (( cnt <= wait_until )); do
+
+    sleep 1 &
+    local slp=$!
+
+    # Stop waiting if the process has exited
     ! isAlive "$pid" && break
 
-    sleep 1
-    cnt=$((cnt+1))
-
-    [[ "$DEBUG" == [Yy1]* ]] && info "Shutting down, waiting... ($cnt/$QEMU_TIMEOUT)"
-
-    # Workaround for zombie pid
+    # Workaround for stale/zombie QEMU pid file
     [ ! -s "$QEMU_PID" ] && break
 
+    if (( cnt == sigterm_at )); then
+      info "${name^} is still running, sending SIGTERM... ($cnt/$wait_until)"
+      kill -15 -- "$pid" 2>/dev/null || :
+    elif (( cnt > 0 )) && enabled "${DEBUG:-}"; then
+      info "Waiting for $name to shut down... ($cnt/$wait_until)"
+    fi
+
+    wait "$slp"
+    (( cnt++ ))
+
   done
 
-  if [ "$cnt" -ge "$QEMU_TIMEOUT" ]; then
-    echo && error "Shutdown timeout reached, aborting..."
-  fi
-
-  finish "$code" && return "$code"
+  finish "$code"
 }
 
-MON_OPTS="\
-        -pidfile $QEMU_PID \
-        -name $PROCESS,process=$PROCESS,debug-threads=on \
-        -monitor telnet:localhost:$MON_PORT,server,nowait,nodelay"
+! enabled "$SHUTDOWN" && return 0
+[ -n "${QEMU_TIMEOUT:-}" ] && TIMEOUT="$QEMU_TIMEOUT"
 
-if [[ "$CONSOLE" != [Yy]* ]]; then
-
-  MON_OPTS+=" -daemonize -D $QEMU_LOG"
-
-  _trap _graceful_shutdown SIGTERM SIGHUP SIGINT SIGABRT SIGQUIT
-
-fi
+_trap graceful_shutdown SIGTERM SIGHUP SIGABRT SIGQUIT
 
 return 0

src/proc.sh

@@ -7,6 +7,10 @@ set -Eeuo pipefail
 : "${CPU_FLAGS:=""}"
 : "${CPU_MODEL:=""}"
 
+HOST_CPU=$(strip "$HOST_CPU")
+CPU_FLAGS=$(strip "$CPU_FLAGS")
+CPU_MODEL=$(strip "$CPU_MODEL")
+
 CLOCKSOURCE="tsc"
 [[ "${ARCH,,}" == "arm64" ]] && CLOCKSOURCE="arch_sys_counter"
 CLOCK="/sys/devices/system/clocksource/clocksource0/current_clocksource"
@@ -27,14 +31,14 @@ fi
 
 flags=$(sed -ne '/^flags/s/^.*: //p' /proc/cpuinfo)
 
-if [[ "$KVM" != [Nn]* ]]; then
+if ! disabled "$KVM"; then
 
   CPU_FEATURES="kvm=on,l3-cache=on,+hypervisor"
   KVM_OPTS=",accel=kvm -enable-kvm -global kvm-pit.lost_tick_policy=discard"
 
   if ! grep -qw "sse4_2" <<< "$flags"; then
     error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
-    [[ "$DEBUG" != [Yy1]* ]] && exit 88
+    ! enabled "$DEBUG" && exit 88
   fi
 
   if [ -z "$CPU_MODEL" ]; then

src/reset.sh

@@ -2,7 +2,7 @@
 set -Eeuo pipefail
 
 trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
-[[ "${TRACE:-}" == [Yy1]* ]] && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
+enabled "${TRACE:-}" && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
 
 [ ! -f "/run/entry.sh" ] && error "Script must be run inside the container!" && exit 11
 [ "$(id -u)" -ne "0" ] && error "Script must be executed with root privileges." && exit 12
@@ -13,7 +13,6 @@ trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
 : "${KVM:="Y"}"            # KVM acceleration
 : "${DEBUG:="N"}"          # Disable debugging mode
 : "${COUNTRY:=""}"         # Country code for mirror
-: "${CONSOLE:="N"}"        # Disable console mode
 : "${ALLOCATE:=""}"        # Preallocate diskspace
 : "${ARGUMENTS:=""}"       # Extra QEMU parameters
 : "${CPU_CORES:="2"}"      # Amount of CPU cores
@@ -22,8 +21,13 @@ trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
 : "${DISK_SIZE:="16G"}"    # Initial data disk size
 : "${STORAGE:="/storage"}" # Storage folder location
 
-# Helper variables
+# Sanitize variables
+TZ=$(strip "$TZ")
+STORAGE=$(strip "$STORAGE")
+COUNTRY=$(strip "$COUNTRY")
+DISK_SIZE=$(strip "$DISK_SIZE")
 
+# Helper variables
 ROOTLESS="N"
 PRIVILEGED="N"
 ENGINE="Docker"
@@ -40,7 +44,7 @@ if [ -f "/run/.containerenv" ]; then
   fi
 fi
 
-echo "❯ Starting $APP for $ENGINE v$(</run/version)..."
+echo "❯ Starting $APP for $ENGINE v$(</etc/version)..."
 echo "❯ For support visit $SUPPORT"
 
 # Get the capability bounding set
@@ -61,7 +65,7 @@ fi
 INFO="/run/shm/msg.html"
 PAGE="/run/shm/index.html"
 TEMPLATE="/var/www/index.html"
-FOOTER1="$APP for $ENGINE v$(</run/version)"
+FOOTER1="$APP for $ENGINE v$(</etc/version)"
 FOOTER2="<a href='$SUPPORT'>$SUPPORT</a>"
 
 SOCKETS=1
@@ -79,7 +83,7 @@ if grep -qi "socket(s)" <<< "$(lscpu)"; then
   [ "$SOCKETS" -lt "1" ] && SOCKETS=1
 fi
 
-CPU_CORES="${CPU_CORES// /}"
+CPU_CORES=$(strip "$CPU_CORES")
 [ -z "$CPU_CORES" ] && CPU_CORES=2
 [[ "${CPU_CORES,,}" == "max" ]] && CPU_CORES="$CORES"
 [[ "${CPU_CORES,,}" == "half" ]] && CPU_CORES=$(( CORES / 2 ))
@@ -102,7 +106,6 @@ else
 fi
 
 QEMU_PID="$QEMU_DIR/qemu.pid"
-rm -f "$QEMU_PID"
 
 # Check folder
 
@@ -134,6 +137,8 @@ RAM_TOTAL=$(free -b | grep -m 1 Mem: | awk '{print $2}')
 
 RAM_SPARE=500000000
 RAM_MINIMUM=136314880
+
+RAM_SIZE=$(strip "$RAM_SIZE")
 RAM_SIZE="${RAM_SIZE// /}"
 [ -z "$RAM_SIZE" ] && RAM_SIZE="2G"
 
@@ -171,7 +176,7 @@ else
   TARGET="arm64"
 fi
 
-if [[ "$KVM" == [Nn]* ]]; then
+if disabled "$KVM"; then
   warn "KVM acceleration is disabled, this will cause the machine to run about 10 times slower!"
 else
   if [[ "${ARCH,,}" != "$TARGET" ]]; then
@@ -180,7 +185,7 @@ else
   fi
 fi
 
-if [[ "$KVM" != [Nn]* ]]; then
+if ! disabled "$KVM"; then
 
   KVM_ERR=""
 
@@ -197,7 +202,7 @@ if [[ "$KVM" != [Nn]* ]]; then
         fi
         if ! grep -qw "sse4_2" <<< "$flags"; then
           error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
-          [[ "$DEBUG" != [Yy1]* ]] && exit 88
+          ! enabled "$DEBUG" && exit 88
         fi
       fi
     fi
@@ -218,15 +223,15 @@ if [[ "$KVM" != [Nn]* ]]; then
           error "KVM acceleration is not available $KVM_ERR, this will cause the machine to run about 10 times slower."
           error "See the FAQ for possible causes, or disable acceleration by adding the \"KVM=N\" variable (not recommended)." ;;
       esac
-      [[ "$DEBUG" != [Yy1]* ]] && exit 88
+      ! enabled "$DEBUG" && exit 88
     fi
   fi
 
 fi
 
 # Cleanup files
-rm -f /run/shm/qemu.*
-rm -f /run/shm/dsm.url
+rm -f "$QEMU_DIR"/dsm.url
+rm -f "$QEMU_DIR"/qemu.* "$QEMU_DIR"/*.pid "$QEMU_DIR"/*.sock
 
 # Cleanup dirs
 rm -rf /tmp/dsm

src/serial.sh

@@ -5,10 +5,16 @@ set -Eeuo pipefail
 
 : "${HOST_MAC:=""}"
 : "${HOST_DEBUG:=""}"
-: "${HOST_SERIAL:=""}"
 : "${HOST_MODEL:=""}"
+: "${HOST_SERIAL:=""}"
 : "${GUEST_SERIAL:=""}"
 
+# Sanitize variables
+HOST_MAC=$(strip "$HOST_MAC")
+HOST_MODEL=$(strip "$HOST_MODEL")
+HOST_SERIAL=$(strip "$HOST_SERIAL")
+GUEST_SERIAL=$(strip "$GUEST_SERIAL")
+
 if [ -n "$HOST_MAC" ]; then
 
   HOST_MAC="${HOST_MAC//-/:}"
@@ -24,6 +30,8 @@ if [ -n "$HOST_MAC" ]; then
 
 fi
 
+HOST_PID="$QEMU_DIR/host.pid"
+
 HOST_ARGS=()
 HOST_ARGS+=("-cpu=$CPU_CORES")
 HOST_ARGS+=("-cpu_arch=$HOST_CPU")
@@ -33,13 +41,15 @@ HOST_ARGS+=("-cpu_arch=$HOST_CPU")
 [ -n "$HOST_SERIAL" ] && HOST_ARGS+=("-hostsn=$HOST_SERIAL")
 [ -n "$GUEST_SERIAL" ] && HOST_ARGS+=("-guestsn=$GUEST_SERIAL")
 
-if [[ "$HOST_DEBUG" == [Yy1]* ]]; then
+if enabled "$HOST_DEBUG"; then
   set -x
   ./host.bin "${HOST_ARGS[@]}" &
   { set +x; } 2>/dev/null
+  echo "$!" > "$HOST_PID"
   echo
 else
   ./host.bin "${HOST_ARGS[@]}" >/dev/null &
+  echo "$!" > "$HOST_PID"
 fi
 
 cnt=0
@@ -60,14 +70,7 @@ while ! nc -z -w2 127.0.0.1 "$CHR_PORT" > /dev/null 2>&1; do
 done
 
 # Configure serial ports
-
-if [[ "$CONSOLE" != [Yy]* ]]; then
-  SERIAL_OPTS="-serial pty"
-else
-  SERIAL_OPTS="-serial mon:stdio"
-fi
-
-SERIAL_OPTS+=" \
+SERIAL_OPTS="-serial mon:stdio \
         -device virtio-serial-pci,id=virtio-serial0,bus=pcie.0,addr=0x3 \
         -chardev socket,id=charchannel0,host=127.0.0.1,port=$CHR_PORT,reconnect=10 \
         -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=vchannel"

src/server.sh

@@ -2,17 +2,25 @@
 set -Eeuo pipefail
 
 : "${COM_PORT:="2210"}"    # Comm port
-: "${MON_PORT:="7100"}"    # Monitor port
 : "${WEB_PORT:="5000"}"    # Webserver port
 : "${CHR_PORT:="12345"}"   # Character port
 : "${WSD_PORT:="8004"}"    # Websockets port
 
-cp -r /var/www/* /run/shm
-rm -f /var/run/websocketd.pid
+# Sanitize port variables
+COM_PORT=$(strip "$COM_PORT")
+WEB_PORT=$(strip "$WEB_PORT")
+CHR_PORT=$(strip "$CHR_PORT")
+WSD_PORT=$(strip "$WSD_PORT")
+
+WEB_PID="/run/nginx.pid"
+WSD_PID="$QEMU_DIR/websocketd.pid"
+
+cp -r /var/www/* "$QEMU_DIR"
+rm -f "$WSD_PID" "$WEB_PID"
 
 html "Starting $APP for $ENGINE..."
 
-if [[ "${WEB:-}" != [Nn]* ]]; then
+if ! disabled "${WEB:-}"; then
 
   mkdir -p /etc/nginx/sites-enabled
   cp /etc/nginx/default.conf /etc/nginx/sites-enabled/web.conf
@@ -21,7 +29,7 @@ if [[ "${WEB:-}" != [Nn]* ]]; then
   sed -i "s/proxy_pass http:\/\/127.0.0.1:8004\/;/proxy_pass http:\/\/127.0.0.1:$WSD_PORT\/;/g" /etc/nginx/sites-enabled/web.conf
 
   # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
 
     sed -i "s/listen $WEB_PORT default_server;/listen [::]:$WEB_PORT default_server ipv6only=off;/g" /etc/nginx/sites-enabled/web.conf
 
@@ -32,7 +40,7 @@ if [[ "${WEB:-}" != [Nn]* ]]; then
 
   # Start websocket server
   websocketd --address 127.0.0.1 --port="$WSD_PORT" /run/socket.sh >/var/log/websocketd.log &
-  echo "$!" > /var/run/websocketd.pid
+  echo "$!" > "$WSD_PID"
 
 fi
 

src/utils.sh

@@ -7,6 +7,40 @@ info () { printf "%b%s%b" "\E[1;34m❯ \E[1;36m" "${1:-}" "\E[0m\n"; }
 error () { printf "%b%s%b" "\E[1;31m❯ " "ERROR: ${1:-}" "\E[0m\n" >&2; }
 warn () { printf "%b%s%b" "\E[1;31m❯ " "Warning: ${1:-}" "\E[0m\n" >&2; }
 
+strip() {
+  local value="${1:-}"
+
+  # Remove surrounding whitespace
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  # Remove leading/trailing single/double quotes
+  value="${value%\"}"
+  value="${value#\"}"
+  value="${value%\'}"
+  value="${value#\'}"
+
+  # Remove surrounding whitespace again
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  printf '%s' "$value"
+}
+
+enabled() {
+  case "$(strip "${1:-}")" in
+    Y|y|YES|Yes|yes|TRUE|True|true|1|ON|On|on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+disabled() {
+  case "$(strip "${1:-}")" in
+    N|n|NO|No|no|FALSE|False|false|0|OFF|Off|off) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 formatBytes() {
   local result
   result=$(numfmt --to=iec --suffix=B "$1" | sed -r 's/([A-Z])/ \1/' | sed 's/ B/ bytes/g;')
@@ -28,6 +62,7 @@ formatBytes() {
 
 isAlive() {
   local pid="$1"
+  [ -z "$pid" ] && return 1
 
   if kill -0 "$pid" 2>/dev/null; then
     return 0
@@ -36,23 +71,67 @@ isAlive() {
   return 1
 }
 
-pKill() {
+waitPid() {
+  local i=0
   local pid="$1"
+  local timeout="${2:-10}"
 
-  { kill -15 "$pid" || true; } 2>/dev/null
-
-  while isAlive "$pid"; do
+  while [ -n "$pid" ] && isAlive "$pid"; do
     sleep 0.2
+    i=$((i + 1))
+    (( i >= timeout * 5 )) && return 1
   done
 
   return 0
 }
 
+waitPidFile() {
+  local i=0
+  local pid=""
+  local file="$1"
+  local timeout="${2:-10}"
+
+  [ ! -s "$file" ] && return 0
+  ! read -r pid <"$file" && return 0
+  [ -z "$pid" ] && return 0
+
+  while [ -s "$file" ] && isAlive "$pid"; do
+    sleep 0.2
+    i=$((i + 1))
+    (( i >= timeout * 5 )) && return 1
+  done
+
+  rm -f -- "$file"
+  return 0
+}
+
+pKill() {
+  local pid="$1"
+  local timeout="${2:-10}"
+
+  { kill -15 -- "$pid" || :; } 2>/dev/null
+
+  if ! waitPid "$pid" "$timeout"; then
+    warn "Timed out while waiting for PID $pid"
+  fi
+
+  return 0
+}
+
 fWait() {
+  local i=0
   local name="$1"
+  local timeout="${2:-10}"
+
+  [ -z "$name" ] && return 0
 
   while pgrep -f -l "$name" >/dev/null; do
     sleep 0.2
+    i=$((i + 1))
+    if (( i >= timeout * 5 )); then
+      warn "Timed out while waiting for process: $name"
+      break
+    fi
   done
 
   return 0
@@ -60,9 +139,44 @@ fWait() {
 
 fKill() {
   local name="$1"
+  local timeout="${2:-10}"
 
-  { pkill -f "$name" || true; } 2>/dev/null
-  fWait "$name"
+  [ -z "$name" ] && return 0
+
+  { pkill -f "$name" || :; } 2>/dev/null
+  fWait "$name" "$timeout"
+
+  return 0
+}
+
+sKill() {
+  local pid=""
+  local file="$1"
+
+  [ ! -s "$file" ] && return 0
+  ! read -r pid <"$file" && return 0
+  [ -z "$pid" ] && return 0
+
+  if isAlive "$pid"; then
+    { kill -15 -- "$pid" || :; } 2>/dev/null
+  fi
+
+  return 0
+}
+
+mKill() {
+  local timeout=10
+  local files=("$@")
+
+  for file in "${files[@]}"; do
+    sKill "$file"
+  done
+
+  for file in "${files[@]}"; do
+    if ! waitPidFile "$file" "$timeout"; then
+      warn "Timed out while waiting for PID file: $file"
+    fi
+  done
 
   return 0
 }
@@ -178,6 +292,8 @@ cpu() {
 
 hasDisk() {
 
+  enabled "${DISK_DISABLE:-}" && return 1
+
   [ -b "/disk" ] && return 0
   [ -b "/disk1" ] && return 0
   [ -b "/dev/disk1" ] && return 0

web/js/script.js

@@ -7,10 +7,14 @@ function getInfo() {
     var url = "msg.html";
 
     try {
+        if (request) {
+            request.abort();
+        }
+
         if (window.XMLHttpRequest) {
             request = new XMLHttpRequest();
         } else {
-            throw "XMLHttpRequest not available!";
+            throw new Error("XMLHttpRequest not available!");
         }
 
         request.onreadystatechange = processInfo;