feat: Sanitize environment variables (#1192)

Added strip function to remove whitespace and quotes.

.github/workflows/build.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       -

.github/workflows/check.yml

@@ -7,9 +7,10 @@ jobs:
     name: shellcheck
     runs-on: ubuntu-latest
     steps:
-      - 
+    - 
-        name: Checkout
+      name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v7
+    - parallel:
       -
         name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master

.github/workflows/hub.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       -
         name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - 
         name: Docker Hub Description
         uses: peter-evans/dockerhub-description@v5

.github/workflows/review.yml

@@ -13,9 +13,10 @@ jobs:
     name: review
     runs-on: ubuntu-latest
     steps:
-      -
+    -
-        name: Checkout
+      name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v7
+    - parallel:
       -
         name: Spelling
         uses: reviewdog/action-misspell@v1

Dockerfile

@@ -1,20 +1,12 @@
 # syntax=docker/dockerfile:1
 
 FROM qemux/qemu-host:2.05 AS builder
-
-#  FROM golang as builder
-#  WORKDIR /
-#  RUN git clone https://github.com/qemus/qemu-host.git
-#  WORKDIR /qemu-host/src
-#  RUN go mod download
-#  RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o /qemu-host.bin .
-
 FROM debian:trixie-slim
 
 ARG TARGETARCH
 ARG TARGETPLATFORM
 ARG VERSION_ARG="0.0"
-ARG VERSION_PASST="2026_05_26"
+ARG VERSION_PASST="2026_06_11"
 
 ARG DEBCONF_NOWARNINGS="yes"
 ARG DEBIAN_FRONTEND="noninteractive"

readme.md

@@ -18,11 +18,11 @@ Virtual DSM in a Docker container.
 
  - Multiple disks
  - KVM acceleration
- - Upgrades supported
+ - Automatic download
- 
+
 ## Usage  🐳
 
-##### Via Docker Compose:
+##### Docker Compose:
 
 ```yaml
 services:
@@ -44,22 +44,31 @@ services:
     stop_grace_period: 2m
 ```
 
-##### Via Docker CLI:
+##### Docker CLI:
 
 ```bash
 docker run -it --rm --name dsm -e "DISK_SIZE=256G" -p 5000:5000 --device=/dev/kvm --device=/dev/net/tun --cap-add NET_ADMIN -v "${PWD:-.}/dsm:/storage" --stop-timeout 120 docker.io/vdsm/virtual-dsm
 ```
 
-##### Via Kubernetes:
+##### Kubernetes:
 
 ```shell
 kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/master/kubernetes.yml
 ```
 
-##### Via Github Codespaces:
+##### GitHub Codespaces:
 
 [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/vdsm/virtual-dsm)
 
+## Requirements ⚙️
+
+ - A Linux host with KVM support, or Docker Desktop / Podman on Windows 11 with nested virtualization enabled.
+ - At least 2 GB of RAM available.
+ - At least 32 GB of free disk space.
+
+> [!NOTE]
+> Docker Desktop on macOS and Windows 10 do not currently provide the required KVM support for this image.
+
 ## FAQ 💬
 
 ### How do I use it?
@@ -95,7 +104,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
   ```
   
 > [!TIP]
-> This can also be used to resize the existing disk to a larger capacity without any data loss.
+> This can also be used to resize an existing disk to a larger capacity without any data loss.
 
 ### How do I add multiple disks?
 
@@ -110,9 +119,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - ./example3:/storage3
   ```
 
-### How do I pass-through a disk?
+### How do I pass through a disk?
 
-   It is possible to pass-through disk devices or partitions directly by adding them to your compose file in this way:
+   You can pass through disk devices or partitions directly by adding them to your compose file in this way:
 
   ```yaml
   devices:
@@ -158,7 +167,7 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
   - you enabled "nested virtualization" if you are running the container inside a virtual machine.
 
-  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPS's.
+  - you are not using a cloud provider, as most of them do not allow nested virtualization for their VPSs.
 
   If you did not receive any error from `kvm-ok` but the container still complains about a missing KVM device, it could help to add `privileged: true` to your compose file (or `sudo` to your `docker` command) to rule out any permission issue.
 
@@ -214,9 +223,9 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
     - 'c *:* rwm'
   ```
 
-### How do I pass-through the GPU?
+### How do I pass through the GPU?
 
-  To pass-through your Intel GPU, add the following lines to your compose file:
+  To pass through your Intel GPU, add the following lines to your compose file:
 
   ```yaml
   environment:
@@ -254,12 +263,12 @@ kubectl apply -f https://raw.githubusercontent.com/vdsm/virtual-dsm/refs/heads/m
 
 ### Is this project legal?
 
-  Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project will be considered legal. 
+  Yes, this project contains only open-source code and does not distribute any material owned by Synology. Neither does it try to circumvent any copyright protection measures.
   
   However, by installing Synology's Virtual DSM, you must accept their end-user license agreement, which does not permit installation on non-Synology hardware. So only run this container on an official Synology NAS, as any other use will be a violation of their terms and conditions.
 
 ## Stars 🌟
-[![Stars](https://starchart.cc/vdsm/virtual-dsm.svg?variant=adaptive)](https://starchart.cc/vdsm/virtual-dsm)
+[![Stargazers](https://raw.githubusercontent.com/star-stats/stars/refs/heads/data/charts/vdsm-virtual-dsm.svg)](https://github.com/vdsm/virtual-dsm/stargazers)
 
 ## Disclaimer ⚖️
 

src/disk.sh

@@ -11,6 +11,15 @@ set -Eeuo pipefail
 : "${DISK_DISCARD:="on"}"         # Controls whether unmap (TRIM) commands are passed to the host.
 : "${DISK_ROTATION:="1"}"         # Rotation rate, set to 1 for SSD storage and increase for HDD
 
+# Sanitize all variables
+DISK_IO=$(strip "$DISK_IO")
+DISK_FMT=$(strip "$DISK_FMT")
+DISK_TYPE=$(strip "$DISK_TYPE")
+DISK_FLAGS=$(strip "$DISK_FLAGS")
+DISK_CACHE=$(strip "$DISK_CACHE")
+DISK_DISCARD=$(strip "$DISK_DISCARD")
+DISK_ROTATION=$(strip "$DISK_ROTATION")
+
 BOOT="$STORAGE/$BASE.boot.img"
 SYSTEM="$STORAGE/$BASE.system.img"
 
@@ -110,7 +119,7 @@ createDisk() {
 
   DATA_SIZE=$(numfmt --from=iec "$DISK_SPACE")
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -139,7 +148,7 @@ createDisk() {
         { chattr +C "$DISK_FILE"; } || :
       fi
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Create an empty file
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -198,7 +207,7 @@ resizeDisk() {
   local REQ=$(( DATA_SIZE - CUR_SIZE ))
   (( REQ < 1 )) && error "Shrinking disks is not supported yet, please increase ${DISK_DESC^^}_SIZE." && exit 71
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     # Check free diskspace
     DIR=$(dirname "$DISK_FILE")
@@ -221,7 +230,7 @@ resizeDisk() {
   case "${DISK_FMT,,}" in
     raw)
 
-      if [[ "$ALLOCATE" == [Nn]* ]]; then
+      if disabled "$ALLOCATE"; then
 
         # Resize file by changing its length
         if ! truncate -s "$DATA_SIZE" "$DISK_FILE"; then
@@ -272,7 +281,7 @@ convertDisk() {
   local DIR FA
   DIR=$(dirname "$TMP_FILE")
 
-  if [[ "$ALLOCATE" != [Nn]* ]]; then
+  if ! disabled "$ALLOCATE"; then
 
     local CUR_SIZE SPACE GB
 
@@ -297,7 +306,7 @@ convertDisk() {
   isCow "$FS" && DISK_PARAM+=",nocow=on"
 
   if [[ "$DST_FMT" != "raw" ]]; then
-    if [[ "$ALLOCATE" == [Nn]* ]]; then
+    if disabled "$ALLOCATE"; then
       CONV_FLAGS+=" -c"
     fi
     [ -n "$DISK_FLAGS" ] && DISK_PARAM+=",$DISK_FLAGS"
@@ -310,7 +319,7 @@ convertDisk() {
   fi
 
   if [[ "$DST_FMT" == "raw" ]]; then
-    if [[ "$ALLOCATE" != [Nn]* ]]; then
+    if ! disabled "$ALLOCATE"; then
       # Work around qemu-img bug
       CUR_SIZE=$(stat -c%s "$TMP_FILE")
       if ! fallocate -l "$CUR_SIZE" "$TMP_FILE" &>/dev/null; then
@@ -433,7 +442,7 @@ finishDisks () {
       DISK_OPTS+=" -object iothread,id=io2" ;;
   esac
 
-  if [[ "$DISK_DISABLE" != [Yy1]* ]]; then
+  if ! enabled "$DISK_DISABLE"; then
     html "Initialized disks successfully..."
   fi
 
@@ -540,7 +549,7 @@ addDisk () {
 
   fi
 
-  if [ -f "$DISK_FILE" ] && [[ "$ALLOCATE" == [Nn]* ]]; then
+  if [ -f "$DISK_FILE" ] && disabled "$ALLOCATE"; then
 
     CUR_SIZE=$(getSize "$DISK_FILE")
     USED=$(du -sB 1 "$DISK_FILE" | cut -f1)
@@ -619,10 +628,10 @@ addDevice () {
 [ -z "${DISK_NAME:-}" ] && DISK_NAME="data"
 [ -z "${DISK_DISABLE:-}" ] && DISK_DISABLE=""
 
-if [[ "$DISK_DISABLE" != [Yy1]* ]]; then
+if ! enabled "$DISK_DISABLE"; then
   msg="Initializing disks..."
   html "$msg"
-  [[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+  enabled "$DEBUG" && echo "$msg"
 fi
 
 case "${DISK_TYPE,,}" in
@@ -634,7 +643,7 @@ if [ -z "$ALLOCATE" ]; then
   ALLOCATE="N"
 fi
 
-if [[ "$ALLOCATE" == [Nn]* ]]; then
+if disabled "$ALLOCATE"; then
   DISK_STYLE="growable"
   DISK_ALLOC="preallocation=off"
 else
@@ -645,7 +654,7 @@ fi
 DISK_OPTS+=$(createDevice "$BOOT" "$DISK_TYPE" "1" "0xa" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 DISK_OPTS+=$(createDevice "$SYSTEM" "$DISK_TYPE" "2" "0xb" "raw" "$DISK_IO" "$DISK_CACHE" "" "")
 
-if [[ "$DISK_DISABLE" == [Yy1]* ]]; then
+if enabled "$DISK_DISABLE"; then
   finishDisks
   return 0
 fi

src/display.sh

@@ -8,9 +8,14 @@ set -Eeuo pipefail
 : "${DISPLAY:="none"}"  # Display type
 : "${RENDERNODE:="/dev/dri/renderD128"}"  # Render node
 
+# Sanitize variables
+VGA=$(strip "$VGA")
+DISPLAY=$(strip "$DISPLAY")
+RENDERNODE=$(strip "$RENDERNODE")
+
 CPU_VENDOR=$(lscpu | awk '/Vendor ID/{print $3}')
 
-if [[ "$GPU" != [Yy1]* || "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
+if ! enabled "$GPU" || [[ "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
 
   [[ "${DISPLAY,,}" == "none" ]] && VGA="none"
   DISPLAY_OPTS="-display $DISPLAY -vga $VGA"
@@ -20,7 +25,7 @@ fi
 
 msg="Configuring display drivers..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 DISPLAY_OPTS="-display egl-headless,rendernode=$RENDERNODE"
 DISPLAY_OPTS+=" -vga $VGA"

src/entry.sh

@@ -28,7 +28,7 @@ cmd=(qemu-system-x86_64)
 version=$("${cmd[@]}" --version | awk 'NR==1 { print $4 }')
 info "Booting $APP using QEMU v$version..."
 
-if [[ "$SHUTDOWN" != [Yy1]* ]]; then
+if ! enabled "$SHUTDOWN"; then
   exec "${cmd[@]}" ${ARGS:+ $ARGS}
 fi
 

src/finish.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-if [[ "$DEBUG" == [Yy1]* ]]; then
+if enabled "$DEBUG"; then
   printf "QEMU arguments:\n\n%s\n\n" "${ARGS// -/$'\n-'}"
 fi
 

src/install.sh

@@ -27,6 +27,8 @@ FILE=$(find / -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ ! -s "$FILE" ] && FILE=$(find "$STORAGE" -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ -s "$FILE" ] && BASE="DSM_VirtualDSM" && URL="file://$FILE" 
 
+URL=$(strip "$URL")
+
 if [ -n "$URL" ] && [ ! -s "$FILE" ] && [ ! -d "$DIR" ]; then
   BASE=$(basename "$URL" .pat)
   if [ ! -s "$STORAGE/$BASE.system.img" ]; then

src/memory.sh

@@ -2,12 +2,12 @@
 set -Eeuo pipefail
 
 msg="Checking memory..."
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 RAM_AVAIL=$(free -b | grep -m 1 Mem: | awk '{print $7}')
 AVAIL_MEM=$(formatBytes "$RAM_AVAIL")
 
-if [[ "$RAM_CHECK" != [Nn]* && "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
+if ! disabled "$RAM_CHECK" && [[ "${RAM_SIZE,,}" != "max" && "${RAM_SIZE,,}" != "half" ]]; then
 
   wanted=$(numfmt --from=iec "$RAM_SIZE")
 

src/network.sh

@@ -24,6 +24,7 @@ set -Eeuo pipefail
 : "${PASST_OPTS:=""}"
 : "${PASST_DEBUG:=""}"
 : "${PASST_PID:="/var/run/passt.pid"}"
+: "${PASST_SOCKET:="/tmp/passt.socket"}"
 
 : "${DNSMASQ_OPTS:=""}"
 : "${DNSMASQ_DEBUG:=""}"
@@ -31,6 +32,15 @@ set -Eeuo pipefail
 : "${DNSMASQ_PID:="/var/run/dnsmasq.pid"}"
 : "${DNSMASQ_CONF_DIR:="/etc/dnsmasq.d"}"
 
+# Sanitize variables
+MAC=$(strip "$MAC")
+MTU=$(strip "$MTU")
+ADAPTER=$(strip "$ADAPTER")
+NETWORK=$(strip "$NETWORK")
+PASST_MTU=$(strip "$PASST_MTU")
+HOST_PORTS=$(strip "$HOST_PORTS")
+USER_PORTS=$(strip "$USER_PORTS")
+
 ADD_ERR="Please add the following setting to your container:"
 
 # ######################################
@@ -39,7 +49,7 @@ ADD_ERR="Please add the following setting to your container:"
 
 configureDHCP() {
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring MACVTAP networking..."
+  enabled "$DEBUG" && echo "Configuring MACVTAP networking..."
 
   # Create the necessary file structure for /dev/vhost-net
   if [ ! -c /dev/vhost-net ]; then
@@ -127,8 +137,8 @@ configureDNS() {
 
   echo "$gateway" > /run/shm/qemu.gw
 
-  [[ "${DNSMASQ_DISABLE:-}" == [Yy1]* ]] && return 0
+  enabled "${DNSMASQ_DISABLE:-}" && return 0
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Starting dnsmasq daemon..."
+  enabled "$DEBUG" && echo "Starting dnsmasq daemon..."
 
   [ -s "$DNSMASQ_PID" ] && pKill "$(<"$DNSMASQ_PID")"
   rm -f "$DNSMASQ_PID"
@@ -173,7 +183,7 @@ configureDNS() {
   arguments+=" --log-facility=$log"
 
   arguments=$(echo "$arguments" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
-  [[ "$DEBUG" == [Yy1]* ]] && printf "Dnsmasq arguments:\n\n%s\n\n" "${arguments// -/$'\n-'}"
+  enabled "$DEBUG" && printf "Dnsmasq arguments:\n\n%s\n\n" "${arguments// -/$'\n-'}"
 
   { $DNSMASQ ${arguments:+ $arguments}; rc=$?; } || :
 
@@ -181,7 +191,7 @@ configureDNS() {
 
     local msg="Failed to start Dnsmasq, reason: $rc"
 
-    if [[ "${NETWORK,,}" == "slirp" || "${NETWORK,,}" == "passt" || "$ROOTLESS" != [Yy1]* || "$DEBUG" == [Yy1]* ]]; then
+    if [[ "${NETWORK,,}" == "slirp" || "${NETWORK,,}" == "passt" ]] || ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
       [ -f "$log" ] && [ -s "$log" ] && cat "$log"
       error "$msg"
     fi
@@ -189,7 +199,7 @@ configureDNS() {
     return 1
   fi
 
-  if [[ "$DNSMASQ_DEBUG" == [Yy1]* ]]; then
+  if enabled "$DNSMASQ_DEBUG"; then
     tail -fn +0 "$log" --pid=$$ &
   fi
 
@@ -283,7 +293,7 @@ getSlirp() {
 configureSlirp() {
 
   NETWORK="slirp"
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring slirp networking..."
+  enabled "$DEBUG" && echo "Configuring slirp networking..."
 
   local ip="$IP"
   [ -n "$VM_NET_IP" ] && ip="$VM_NET_IP"
@@ -300,12 +310,15 @@ configureSlirp() {
   forward=$(getSlirp "$ip")
   [ -n "$forward" ] && NET_OPTS+=",$forward"
 
-  if [[ "${DNSMASQ_DISABLE:-}" == [Yy1]* ]]; then
+  if enabled "${DNSMASQ_DISABLE:-}"; then
     echo "$gateway" > /run/shm/qemu.gw
   else
     [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
     configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
   VM_NET_IP="$ip"
@@ -315,7 +328,7 @@ configureSlirp() {
 configurePasst() {
 
   NETWORK="passt"
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring user-mode networking..."
+  enabled "$DEBUG" && echo "Configuring user-mode networking..."
 
   local log="/tmp/passt.log"
   rm -f "$log"
@@ -352,27 +365,31 @@ configurePasst() {
   PASST_OPTS+=" -H $VM_NET_HOST"
   PASST_OPTS+=" -M $GATEWAY_MAC"
   PASST_OPTS+=" -P $PASST_PID"
+  PASST_OPTS+=" -s $PASST_SOCKET"
   PASST_OPTS+=" -l $log"
   PASST_OPTS+=" -q"
 
-  if [[ "${DNSMASQ_DISABLE:-}" != [Yy1]* ]]; then
+  if ! enabled "${DNSMASQ_DISABLE:-}"; then
     [ ! -f /etc/resolv.dnsmasq ] && cp /etc/resolv.conf /etc/resolv.dnsmasq
-    echo -e "nameserver 127.0.0.1\nsearch .\noptions ndots:0" >/etc/resolv.conf
+    printf '%s\n' \
+      'nameserver 127.0.0.1' \
+      'search .' \
+      'options ndots:0' > /etc/resolv.conf
   fi
 
   PASST_OPTS=$(echo "$PASST_OPTS" | sed 's/\t/ /g' | tr -s ' ' | sed 's/^ *//')
 
-  if [[ "$DEBUG" == [Yy1]* || "$PASST_DEBUG" == [Yy1]* ]]; then
+  if enabled "$DEBUG" || enabled "$PASST_DEBUG"; then
     printf "Passt arguments:\n\n%s\n\n" "${PASST_OPTS// -/$'\n-'}"
   fi
 
   [ ! -f "$PASST" ] && cp /usr/bin/passt* /run
 
-  if ! $PASST ${PASST_OPTS:+ $PASST_OPTS} >/dev/null 2>&1; then
+  if ! "$PASST" ${PASST_OPTS:+$PASST_OPTS} >/dev/null 2>&1; then
 
     rm -f "$log"
     PASST_OPTS="${PASST_OPTS/ -q/}"
-    { $PASST ${PASST_OPTS:+ $PASST_OPTS}; rc=$?; } || :
+    { "$PASST" ${PASST_OPTS:+$PASST_OPTS}; rc=$?; } || :
 
     if (( rc != 0 )); then
       [ -f "$log" ] && [ -s "$log" ] && cat "$log"
@@ -382,15 +399,15 @@ configurePasst() {
 
   fi
 
-  if [[ "$PASST_DEBUG" == [Yy1]* ]]; then
+  if enabled "$PASST_DEBUG"; then
     tail -fn +0 "$log" --pid=$$ &
   else
-    if [[ "$DEBUG" == [Yy1]* ]]; then
+    if enabled "$DEBUG"; then
       [ -f "$log" ] && [ -s "$log" ] && cat "$log" && echo ""
     fi
   fi
 
-  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket"
+  NET_OPTS="-netdev stream,id=hostnet0,server=off,addr.type=unix,addr.path=$PASST_SOCKET"
 
   configureDNS "lo" "$ip" "$VM_NET_MAC" "$VM_NET_HOST" "$VM_NET_MASK" "$gateway" || return 1
 
@@ -439,7 +456,7 @@ configureNAT() {
   local tuntap="TUN device is missing. $ADD_ERR --device /dev/net/tun"
   local tables="the 'ip_tables' kernel module is not loaded. Try this command: sudo modprobe ip_tables iptable_nat"
 
-  [[ "$DEBUG" == [Yy1]* ]] && echo "Configuring NAT networking..."
+  enabled "$DEBUG" && echo "Configuring NAT networking..."
 
   # Create the necessary file structure for /dev/net/tun
   if [ ! -c /dev/net/tun ]; then
@@ -450,7 +467,7 @@ configureNAT() {
   fi
 
   if [ ! -c /dev/net/tun ]; then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -458,7 +475,7 @@ configureNAT() {
   if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
     { sysctl -w net.ipv4.ip_forward=1 > /dev/null 2>&1; rc=$?; } || :
     if (( rc != 0 )) || [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
-      [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+      enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
       warn "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1"
       return 1
     fi
@@ -488,7 +505,7 @@ configureNAT() {
   { ip link add dev "$VM_NET_BRIDGE" type bridge ; rc=$?; } || :
 
   if (( rc != 0 )); then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "failed to create bridge. $ADD_ERR --cap-add NET_ADMIN" && return 1
   fi
 
@@ -503,7 +520,7 @@ configureNAT() {
 
   # Set tap to the bridge created
   if ! ip tuntap add dev "$VM_NET_TAP" mode tap; then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     warn "$tuntap" && return 1
   fi
 
@@ -541,7 +558,7 @@ configureNAT() {
 
   # NAT traffic from bridge subnet to Docker uplink
   if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE > /dev/null 2>&1; then
-    [[ "$ROOTLESS" == [Yy1]* && "$DEBUG" != [Yy1]* ]] && return 1
+    enabled "$ROOTLESS" && ! enabled "$DEBUG" && return 1
     if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -s "$subnet" ! -d "$subnet" -m comment --comment "remove" -j MASQUERADE; then
       warn "$tables" && return 1
     fi
@@ -611,11 +628,11 @@ closeWeb() {
 
 closeNetwork() {
 
-  if [[ "${WEB:-}" != [Nn]* && "$DHCP" == [Yy1]* ]]; then
+  if ! disabled "${WEB:-}" && enabled "$DHCP"; then
     closeWeb
   fi
 
-  [[ "$NETWORK" == [Nn]* ]] && return 0
+  disabled "$NETWORK" && return 0
 
   exec 30<&- || true
   exec 40<&- || true
@@ -630,9 +647,8 @@ cleanUp() {
   closeBridge
 
   # Clean up old files
-  rm -f "$PASST_PID"
+  rm -f "$PASST_PID" "$PASST_SOCKET"
-  rm -f "$DNSMASQ_PID"
+  rm -f "$DNSMASQ_PID" /etc/resolv.dnsmasq
-  rm -f /etc/resolv.dnsmasq
 
   return 0
 }
@@ -648,7 +664,7 @@ checkOS() {
   [[ "${kernel,,}" == *"darwin"* ]] && os="$ENGINE Desktop for macOS"
   [[ "${kernel,,}" == *"microsoft"* ]] && os="$ENGINE Desktop for Windows"
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
+  if enabled "$DHCP"; then
     iface="macvtap"
     [[ "${kernel,,}" == *"synology"* ]] && os="Synology Container Manager"
   fi
@@ -680,11 +696,11 @@ getInfo() {
 
   GATEWAY=$(ip route list dev "$VM_NET_DEV" | awk ' /^default/ {print $3}' | head -n 1)
   { IP=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/ | head -n 1); } 2>/dev/null || :
-  [ -z "$IP" ] && [[ "$DHCP" != [Yy1]* ]] && error "Could not determine container IPv4 address!" && exit 26
+  [ -z "$IP" ] && ! enabled "$DHCP" && error "Could not determine container IPv4 address!" && exit 26
 
   IP6=""
   # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
     { IP6=$(ip -6 addr show dev "$VM_NET_DEV" scope global up); rc=$?; } 2>/dev/null || :
     (( rc != 0 )) && IP6=""
     [ -n "$IP6" ] && IP6=$(echo "$IP6" | sed -e's/^.*inet6 \([^ ]*\)\/.*$/\1/;t;d' | head -n 1)
@@ -696,12 +712,12 @@ getInfo() {
   bus=$(grep -m 1 -i 'bus-info:' <<< "$result" | awk '{print $2}')
 
   if [[ "${bus,,}" != "" && "${bus,,}" != "n/a" && "${bus,,}" != "tap" ]]; then
-    [[ "$DEBUG" == [Yy1]* ]] && info "Detected BUS: $bus"
+    enabled "$DEBUG" && info "Detected BUS: $bus"
     error "This container does not support host mode networking!"
     exit 29
   fi
 
-  if [[ "$DHCP" == [Yy1]* ]]; then
+  if enabled "$DHCP"; then
 
     checkOS
 
@@ -711,7 +727,7 @@ getInfo() {
     fi
 
     if [[ "${nic,,}" != "macvlan" ]]; then
-      [[ "$DEBUG" == [Yy1]* ]] && info "Detected NIC: $nic"
+      enabled "$DEBUG" && info "Detected NIC: $nic"
       error "The container needs to be in a MACVLAN network when DHCP=Y."
       exit 29
     fi
@@ -779,7 +795,7 @@ getInfo() {
 
   GATEWAY_MAC=$(echo "$VM_NET_MAC" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/')
 
-  if [[ "$DEBUG" == [Yy1]* ]]; then
+  if enabled "$DEBUG"; then
     line="Host: $HOST  IP: $IP  Gateway: $GATEWAY  Interface: $VM_NET_DEV  MAC: $VM_NET_MAC  MTU: $mtu"
     [[ "$MTU" != "0" && "$MTU" != "$mtu" ]] && line+=" ($MTU)"
     info "$line"
@@ -800,14 +816,14 @@ getInfo() {
 #  Configure Network
 # ######################################
 
-if [[ "$NETWORK" == [Nn]* ]]; then
+if disabled "$NETWORK"; then
   NET_OPTS=""
   return 0
 fi
 
 msg="Initializing network..."
 html "$msg"
-[[ "$DEBUG" == [Yy1]* ]] && echo "$msg"
+enabled "$DEBUG" && echo "$msg"
 
 getInfo
 cleanUp
@@ -819,14 +835,14 @@ fi
 MSG="Booting DSM instance..."
 html "$MSG"
 
-if [[ "$DHCP" == [Yy1]* ]]; then
+if enabled "$DHCP"; then
 
   # Configure for macvtap interface
   configureDHCP || exit 20
 
 else
 
-  if [[ "${WEB:-}" != [Nn]* ]]; then
+  if ! disabled "${WEB:-}"; then
     sleep 1.2
     closeWeb
   fi
@@ -841,7 +857,7 @@ else
         closeBridge
         NETWORK="user"
 
-        if [[ "$ROOTLESS" != [Yy1]* || "$DEBUG" == [Yy1]* ]]; then
+        if ! enabled "$ROOTLESS" || enabled "$DEBUG"; then
           msg="falling back to user-mode networking!"
           msg="failed to setup NAT networking, $msg"
           warn "$msg"

src/power.sh

@@ -109,6 +109,7 @@ graceful_shutdown() {
   # nc -q 1 -w 1 -U "$QEMU_DIR/monitor.sock" &> /dev/null <<<'system_powerdown' || :
 
   # Send shutdown command to guest agent via serial port
+  API_TIMEOUT=$(strip "$API_TIMEOUT")
   url="http://$API_HOST/read?command=$API_CMD&timeout=$API_TIMEOUT"
   response=$(curl -sk -m "$(( API_TIMEOUT+2 ))" -S "$url" 2>&1)
 
@@ -121,42 +122,59 @@ graceful_shutdown() {
     response="${response#*message\"\: \"}"
     [ -z "$response" ] && response="second signal"
     echo && error "Forcefully terminating because of: ${response%%\"*}"
-    { kill -15 -- "$pid" || :; } 2>/dev/null
+    kill -15 -- "$pid" 2>/dev/null || :
 
   fi
 
-  local cnt=0 abort=0 factor=3 offset=3 min max name
+  local name
-
-  [[ "$TIMEOUT" =~ ^[0-9]+$ ]] || TIMEOUT=115
-  [ "$TIMEOUT" -ge 15 ] && factor=4 && offset=4
-  [ "$TIMEOUT" -ge 30 ] && factor=5 && offset=5
-  min=$(( factor + offset + 1 ))
-  [ "$TIMEOUT" -lt "$min" ] && TIMEOUT="$min"
-  elapsed=$(( SECONDS - start ))
-  max=$(( TIMEOUT - offset - elapsed ))
-  [ "$max" -lt "$factor" ] && max=$(( factor + 1 ))
-  abort=$(( max - factor ))
   name="$(app)"
 
-  while [ "$cnt" -le "$max" ]; do
+  local term_grace=3      # seconds before loop ends to send SIGTERM
+  local cleanup_grace=3   # seconds reserved after the loop for cleanup
+
+  TIMEOUT=$(strip "$TIMEOUT")
+  if [[ ! "$TIMEOUT" =~ ^[0-9]+$ ]]; then
+    TIMEOUT=115
+  fi
+
+  if (( TIMEOUT >= 30 )); then
+    term_grace=5
+    cleanup_grace=5
+  elif (( TIMEOUT >= 15 )); then
+    term_grace=4
+    cleanup_grace=4
+  fi
+
+  local cnt=0 sigterm_at=0 min wait_until elapsed timeout_left
+
+  elapsed=$((SECONDS - start))
+  timeout_left=$((TIMEOUT - elapsed))
+
+  min=$((term_grace + cleanup_grace + 1))
+  (( timeout_left < min )) && timeout_left=$min
+
+  wait_until=$((timeout_left - cleanup_grace))
+  sigterm_at=$((wait_until - term_grace))
+
+  while (( cnt <= wait_until )); do
 
     sleep 1 &
     local slp=$!
 
+    # Stop waiting if the process has exited
     ! isAlive "$pid" && break
-    # Workaround for zombie pid
+
+    # Workaround for stale/zombie QEMU pid file
     [ ! -s "$QEMU_PID" ] && break
 
-    if [ "$cnt" -ne "$abort" ]; then
+    if (( cnt == sigterm_at )); then
-      if [ "$cnt" -gt 0 ] && [[ "$DEBUG" == [Yy1]* ]]; then
+      info "${name^} is still running, sending SIGTERM... ($cnt/$wait_until)"
-        info "Waiting for $name to shut down... ($cnt/$max)"
+      kill -15 -- "$pid" 2>/dev/null || :
-      fi
+    elif (( cnt > 0 )) && enabled "${DEBUG:-}"; then
-    else
+      info "Waiting for $name to shut down... ($cnt/$wait_until)"
-      info "${name^} is still running, sending SIGTERM... ($cnt/$max)"
-      { kill -15 -- "$pid" || :; } 2>/dev/null
     fi
 
-    wait $slp
+    wait "$slp"
     (( cnt++ ))
 
   done
@@ -164,7 +182,7 @@ graceful_shutdown() {
   finish "$code"
 }
 
-[[ "$SHUTDOWN" != [Yy1]* ]] && return 0
+! enabled "$SHUTDOWN" && return 0
 [ -n "${QEMU_TIMEOUT:-}" ] && TIMEOUT="$QEMU_TIMEOUT"
 
 _trap graceful_shutdown SIGTERM SIGHUP SIGABRT SIGQUIT

src/proc.sh

@@ -7,6 +7,10 @@ set -Eeuo pipefail
 : "${CPU_FLAGS:=""}"
 : "${CPU_MODEL:=""}"
 
+HOST_CPU=$(strip "$HOST_CPU")
+CPU_FLAGS=$(strip "$CPU_FLAGS")
+CPU_MODEL=$(strip "$CPU_MODEL")
+
 CLOCKSOURCE="tsc"
 [[ "${ARCH,,}" == "arm64" ]] && CLOCKSOURCE="arch_sys_counter"
 CLOCK="/sys/devices/system/clocksource/clocksource0/current_clocksource"
@@ -27,14 +31,14 @@ fi
 
 flags=$(sed -ne '/^flags/s/^.*: //p' /proc/cpuinfo)
 
-if [[ "$KVM" != [Nn]* ]]; then
+if ! disabled "$KVM"; then
 
   CPU_FEATURES="kvm=on,l3-cache=on,+hypervisor"
   KVM_OPTS=",accel=kvm -enable-kvm -global kvm-pit.lost_tick_policy=discard"
 
   if ! grep -qw "sse4_2" <<< "$flags"; then
     error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
-    [[ "$DEBUG" != [Yy1]* ]] && exit 88
+    ! enabled "$DEBUG" && exit 88
   fi
 
   if [ -z "$CPU_MODEL" ]; then

src/reset.sh

@@ -2,7 +2,7 @@
 set -Eeuo pipefail
 
 trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
-[[ "${TRACE:-}" == [Yy1]* ]] && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
+enabled "${TRACE:-}" && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DEBUG
 
 [ ! -f "/run/entry.sh" ] && error "Script must be run inside the container!" && exit 11
 [ "$(id -u)" -ne "0" ] && error "Script must be executed with root privileges." && exit 12
@@ -21,8 +21,13 @@ trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
 : "${DISK_SIZE:="16G"}"    # Initial data disk size
 : "${STORAGE:="/storage"}" # Storage folder location
 
-# Helper variables
+# Sanitize variables
+TZ=$(strip "$TZ")
+STORAGE=$(strip "$STORAGE")
+COUNTRY=$(strip "$COUNTRY")
+DISK_SIZE=$(strip "$DISK_SIZE")
 
+# Helper variables
 ROOTLESS="N"
 PRIVILEGED="N"
 ENGINE="Docker"
@@ -78,7 +83,7 @@ if grep -qi "socket(s)" <<< "$(lscpu)"; then
   [ "$SOCKETS" -lt "1" ] && SOCKETS=1
 fi
 
-CPU_CORES="${CPU_CORES// /}"
+CPU_CORES=$(strip "$CPU_CORES")
 [ -z "$CPU_CORES" ] && CPU_CORES=2
 [[ "${CPU_CORES,,}" == "max" ]] && CPU_CORES="$CORES"
 [[ "${CPU_CORES,,}" == "half" ]] && CPU_CORES=$(( CORES / 2 ))
@@ -132,6 +137,8 @@ RAM_TOTAL=$(free -b | grep -m 1 Mem: | awk '{print $2}')
 
 RAM_SPARE=500000000
 RAM_MINIMUM=136314880
+
+RAM_SIZE=$(strip "$RAM_SIZE")
 RAM_SIZE="${RAM_SIZE// /}"
 [ -z "$RAM_SIZE" ] && RAM_SIZE="2G"
 
@@ -169,7 +176,7 @@ else
   TARGET="arm64"
 fi
 
-if [[ "$KVM" == [Nn]* ]]; then
+if disabled "$KVM"; then
   warn "KVM acceleration is disabled, this will cause the machine to run about 10 times slower!"
 else
   if [[ "${ARCH,,}" != "$TARGET" ]]; then
@@ -178,7 +185,7 @@ else
   fi
 fi
 
-if [[ "$KVM" != [Nn]* ]]; then
+if ! disabled "$KVM"; then
 
   KVM_ERR=""
 
@@ -195,7 +202,7 @@ if [[ "$KVM" != [Nn]* ]]; then
         fi
         if ! grep -qw "sse4_2" <<< "$flags"; then
           error "Your CPU does not have the SSE4 instruction set that Virtual DSM requires!"
-          [[ "$DEBUG" != [Yy1]* ]] && exit 88
+          ! enabled "$DEBUG" && exit 88
         fi
       fi
     fi
@@ -216,16 +223,15 @@ if [[ "$KVM" != [Nn]* ]]; then
           error "KVM acceleration is not available $KVM_ERR, this will cause the machine to run about 10 times slower."
           error "See the FAQ for possible causes, or disable acceleration by adding the \"KVM=N\" variable (not recommended)." ;;
       esac
-      [[ "$DEBUG" != [Yy1]* ]] && exit 88
+      ! enabled "$DEBUG" && exit 88
     fi
   fi
 
 fi
 
 # Cleanup files
-rm -f "$QEMU_DIR"/qemu.*
-rm -f "$QEMU_DIR"/*.pid
 rm -f "$QEMU_DIR"/dsm.url
+rm -f "$QEMU_DIR"/qemu.* "$QEMU_DIR"/*.pid "$QEMU_DIR"/*.sock
 
 # Cleanup dirs
 rm -rf /tmp/dsm

src/serial.sh

@@ -5,10 +5,16 @@ set -Eeuo pipefail
 
 : "${HOST_MAC:=""}"
 : "${HOST_DEBUG:=""}"
-: "${HOST_SERIAL:=""}"
 : "${HOST_MODEL:=""}"
+: "${HOST_SERIAL:=""}"
 : "${GUEST_SERIAL:=""}"
 
+# Sanitize variables
+HOST_MAC=$(strip "$HOST_MAC")
+HOST_MODEL=$(strip "$HOST_MODEL")
+HOST_SERIAL=$(strip "$HOST_SERIAL")
+GUEST_SERIAL=$(strip "$GUEST_SERIAL")
+
 if [ -n "$HOST_MAC" ]; then
 
   HOST_MAC="${HOST_MAC//-/:}"
@@ -35,7 +41,7 @@ HOST_ARGS+=("-cpu_arch=$HOST_CPU")
 [ -n "$HOST_SERIAL" ] && HOST_ARGS+=("-hostsn=$HOST_SERIAL")
 [ -n "$GUEST_SERIAL" ] && HOST_ARGS+=("-guestsn=$GUEST_SERIAL")
 
-if [[ "$HOST_DEBUG" == [Yy1]* ]]; then
+if enabled "$HOST_DEBUG"; then
   set -x
   ./host.bin "${HOST_ARGS[@]}" &
   { set +x; } 2>/dev/null

src/server.sh

@@ -6,16 +6,21 @@ set -Eeuo pipefail
 : "${CHR_PORT:="12345"}"   # Character port
 : "${WSD_PORT:="8004"}"    # Websockets port
 
+# Sanitize port variables
+COM_PORT=$(strip "$COM_PORT")
+WEB_PORT=$(strip "$WEB_PORT")
+CHR_PORT=$(strip "$CHR_PORT")
+WSD_PORT=$(strip "$WSD_PORT")
+
 WEB_PID="/run/nginx.pid"
 WSD_PID="$QEMU_DIR/websocketd.pid"
 
 cp -r /var/www/* "$QEMU_DIR"
-rm -f "$WSD_PID"
+rm -f "$WSD_PID" "$WEB_PID"
-rm -f "$WEB_PID"
 
 html "Starting $APP for $ENGINE..."
 
-if [[ "${WEB:-}" != [Nn]* ]]; then
+if ! disabled "${WEB:-}"; then
 
   mkdir -p /etc/nginx/sites-enabled
   cp /etc/nginx/default.conf /etc/nginx/sites-enabled/web.conf
@@ -24,7 +29,7 @@ if [[ "${WEB:-}" != [Nn]* ]]; then
   sed -i "s/proxy_pass http:\/\/127.0.0.1:8004\/;/proxy_pass http:\/\/127.0.0.1:$WSD_PORT\/;/g" /etc/nginx/sites-enabled/web.conf
 
   # shellcheck disable=SC2143
-  if [ -f /proc/net/if_inet6 ] && [ -n "$(ifconfig -a | grep inet6)" ]; then
+  if [ -f /proc/net/if_inet6 ] && [[ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" != "1" ]] && [ -n "$(ifconfig -a | grep inet6)" ]; then
 
     sed -i "s/listen $WEB_PORT default_server;/listen [::]:$WEB_PORT default_server ipv6only=off;/g" /etc/nginx/sites-enabled/web.conf
 

src/utils.sh

@@ -7,6 +7,40 @@ info () { printf "%b%s%b" "\E[1;34m❯ \E[1;36m" "${1:-}" "\E[0m\n"; }
 error () { printf "%b%s%b" "\E[1;31m❯ " "ERROR: ${1:-}" "\E[0m\n" >&2; }
 warn () { printf "%b%s%b" "\E[1;31m❯ " "Warning: ${1:-}" "\E[0m\n" >&2; }
 
+strip() {
+  local value="${1:-}"
+
+  # Remove surrounding whitespace
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  # Remove leading/trailing single/double quotes
+  value="${value%\"}"
+  value="${value#\"}"
+  value="${value%\'}"
+  value="${value#\'}"
+
+  # Remove surrounding whitespace again
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+
+  printf '%s' "$value"
+}
+
+enabled() {
+  case "$(strip "${1:-}")" in
+    Y|y|YES|Yes|yes|TRUE|True|true|1|ON|On|on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+disabled() {
+  case "$(strip "${1:-}")" in
+    N|n|NO|No|no|FALSE|False|false|0|OFF|Off|off) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 formatBytes() {
   local result
   result=$(numfmt --to=iec --suffix=B "$1" | sed -r 's/([A-Z])/ \1/' | sed 's/ B/ bytes/g;')
@@ -258,7 +292,7 @@ cpu() {
 
 hasDisk() {
 
-  [[ "${DISK_DISABLE:-}" == [Yy1]* ]] && return 1
+  enabled "${DISK_DISABLE:-}" && return 1
 
   [ -b "/disk" ] && return 0
   [ -b "/disk1" ] && return 0