Update M-CMP deployment script#2208
Conversation
Signed-off-by: Seokho Son <shsongist@gmail.com>
There was a problem hiding this comment.
Pull Request Overview
This PR improves the M-CMP deployment script by adding configuration constants, enhancing security practices, and improving user experience with better error handling and documentation.
- Introduces configuration constants for minimum system requirements (vCPU, RAM)
- Enhances security by downloading Docker installation script to a temporary file before execution
- Improves robustness with proper variable quoting and error handling for directory navigation
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| # Detect actual user (important when executed with sudo) | ||
| TARGET_USER="${SUDO_USER:-$USER}" | ||
| TARGET_HOME=$(eval echo ~"$TARGET_USER") |
There was a problem hiding this comment.
The eval echo pattern used here can be a security risk. Consider using the safer alternative:
TARGET_HOME=$(getent passwd "$TARGET_USER" | cut -d: -f6)This approach reads from the system's password database without shell expansion, avoiding potential command injection if TARGET_USER contains malicious input.
| TARGET_HOME=$(eval echo ~"$TARGET_USER") | |
| TARGET_HOME=$(getent passwd "$TARGET_USER" | cut -d: -f6) |
| echo " ⚠️ Security Note: Downloading and executing remote script" | ||
| echo " → See https://docs.docker.com/engine/install/ for manual installation" | ||
| TMP_DOCKER_SCRIPT=$(mktemp) | ||
| curl -fsSL https://get.docker.com -o "$TMP_DOCKER_SCRIPT" |
There was a problem hiding this comment.
Consider adding error handling for the curl download step. If the download fails, the script will attempt to execute an empty or incomplete file:
if ! curl -fsSL https://get.docker.com -o "$TMP_DOCKER_SCRIPT"; then
echo "❌ Error: Failed to download Docker installation script"
rm -f "$TMP_DOCKER_SCRIPT"
exit 1
fi| curl -fsSL https://get.docker.com -o "$TMP_DOCKER_SCRIPT" | |
| if ! curl -fsSL https://get.docker.com -o "$TMP_DOCKER_SCRIPT"; then | |
| echo "❌ Error: Failed to download Docker installation script" | |
| rm -f "$TMP_DOCKER_SCRIPT" | |
| exit 1 | |
| fi |
|
/approve |
No description provided.