I'm building a tool called escalator
for solving a certain problem I'm encountering in Docker containers (I need USER
to be unprivileged but I need ENTRYPOINT
to be PID 1 and root:root
). In any case, the need for such a tool is beside the point of the question
The current usage docs emitted by clap/structopt:
escalator 0.1.0
Naftuli Kay <me@naftuli.wtf>
Escalate user and group ids to root and execute a binary with arguments in place without forking.
USAGE:
escalator [FLAGS] <binary> [args]...
FLAGS:
-h, --help Prints help information
-V, --version Prints version information
-v Verbosity; pass multiple times to increase log verbosity. By default, verbosity is set to ERROR, -v
yields WARN, -vv yields INFO, -vvv yields DEBUG, and -vvvv yields TRACE.
ARGS:
<binary> A fully-qualified path to the binary to execute.
<args>... A list of arguments to pass to the binary upon execution.
The actual structopt
definition:
/// Escalate user and group ids to root and execute a binary with arguments in place without forking.
#[derive(Debug, StructOpt)]
struct CLI {
/// Verbosity; pass multiple times to increase log verbosity. By default, verbosity is set to
/// ERROR, -v yields WARN, -vv yields INFO, -vvv yields DEBUG, and -vvvv yields TRACE.
#[structopt(short = "v", parse(from_occurrences))]
verbosity: u8,
/// A fully-qualified path to the binary to execute.
#[structopt(parse(from_os_str))]
binary: PathBuf,
/// A list of arguments to pass to the binary upon execution.
args: Vec<String>,
}
The issue that I'm encountering is that I can't pass arbitrary flags in my invocation:
$ sudo target/debug/escalator $(which id) -u -n
error: Found argument '-u' which wasn't expected, or isn't valid in this context
USAGE:
escalator [FLAGS] <binary> [args]...
For more information try --help
Is there a way to tell structopt/clap to not parse anything including and after the args
positional value? I'm climbing through the settings right now to see if this is possible. Things do just work if I call escalator $(which id) -- -u -n
, but since the whole purpose of this binary is to proxy things forward, it seems like a bit of overhead to have to always pass --
to delimit between the binary and the arguments.
Any ideas?