Skip to content

Commit a84c3d4

Browse files
janduboisjandubois
authored
Merge pull request #3870 from olamilekan000/preserve-env-int-test-and-doc
add preserve-env variable to doc and also add an integration test
2 parents 6a52a2f + 30104e5 commit a84c3d4

File tree

6 files changed

+145
-1
lines changed

6 files changed

+145
-1
lines changed

‎cmd/limactl/shell.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,11 @@ lima command is provided as an alias for limactl shell $LIMA_INSTANCE. $LIMA_INS
3636
By default, the first 'ssh' executable found in the host's PATH is used to connect to the Lima instance.
3737
A custom ssh alias can be used instead by setting the $` + sshutil.EnvShellSSH + ` environment variable.
3838
39+
Environment Variables:
40+
--preserve-env: Propagates host environment variables to the guest instance.
41+
Use LIMA_SHELLENV_ALLOW to specify which variables to allow.
42+
Use LIMA_SHELLENV_BLOCK to specify which variables to block (extends default blocklist with +).
43+
3944
Hint: try --debug to show the detailed logs, if it seems hanging (mostly due to some SSH issue).
4045
`
4146

‎cmd/nerdctl.lima‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
#!/bin/sh
22
set -eu
3+
# Use --preserve-env to pass through environment variables from host machine into guest instance
34
exec limactl shell --preserve-env default nerdctl "$@"

‎hack/test-preserve-env.sh‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/usr/bin/env bash
2+
3+
# SPDX-FileCopyrightText: Copyright The Lima Authors
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
set -eu -o pipefail
7+
8+
scriptdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
9+
# shellcheck source=common.inc.sh
10+
source "${scriptdir}/common.inc.sh"
11+
12+
if [ "$#" -ne 1 ]; then
13+
ERROR "Usage: $0 NAME"
14+
exit 1
15+
fi
16+
17+
NAME="$1"
18+
19+
INFO "Testing --preserve-env flag"
20+
21+
# Environment variable propagation with --preserve-env
22+
INFO "=== Environment variable propagation with --preserve-env ==="
23+
test_var_name="LIMA_TEST_PRESERVE_ENV_VAR"
24+
test_var_value="test-value-${RANDOM}"
25+
26+
got="$(LIMA_SHELLENV_ALLOW="LIMA_TEST_*" LIMA_TEST_PRESERVE_ENV_VAR="$test_var_value" limactl shell --preserve-env "$NAME" printenv "$test_var_name" 2>/dev/null || echo "NOT_FOUND")"
27+
INFO "$test_var_name: expected=${test_var_value}, got=${got}"
28+
if [ "$got" != "$test_var_value" ]; then
29+
ERROR "Environment variable was not propagated with --preserve-env"
30+
exit 1
31+
fi
32+
33+
# Clean up before next test
34+
unset LIMA_TEST_PRESERVE_ENV_VAR
35+
unset LIMA_SHELLENV_ALLOW
36+
37+
# Environment variable NOT propagated without --preserve-env
38+
INFO "=== Environment variable NOT propagated without --preserve-env ==="
39+
got_without_flag="$(LIMA_TEST_PRESERVE_ENV_VAR="$test_var_value" limactl shell "$NAME" printenv "$test_var_name" 2>/dev/null || echo "NOT_FOUND")"
40+
INFO "$test_var_name without --preserve-env: got=${got_without_flag}"
41+
if [ "$got_without_flag" != "NOT_FOUND" ]; then
42+
ERROR "Environment variable was unexpectedly propagated without --preserve-env"
43+
exit 1
44+
fi
45+
46+
# Blocked environment variables should not be propagated even with --preserve-env
47+
INFO "=== Blocked environment variables are not propagated with --preserve-env ==="
48+
blocked_var_name="HOME"
49+
fake_home="/tmp/fake-home-${RANDOM}"
50+
got_blocked="$(HOME="$fake_home" limactl shell --preserve-env "$NAME" printenv "$blocked_var_name" 2>/dev/null || echo "NOT_FOUND")"
51+
INFO "$blocked_var_name: host=${fake_home}, guest=${got_blocked}"
52+
if [ "$got_blocked" = "$fake_home" ]; then
53+
ERROR "Blocked environment variable $blocked_var_name was propagated"
54+
exit 1
55+
fi
56+
57+
# LIMA_SHELLENV_BLOCK functionality
58+
INFO "=== LIMA_SHELLENV_BLOCK with custom pattern ==="
59+
custom_test_var="LIMA_TEST_CUSTOM_BLOCK"
60+
custom_test_value="should-be-blocked"
61+
got_custom_blocked="$(LIMA_SHELLENV_BLOCK="+LIMA_TEST_CUSTOM_*" LIMA_TEST_CUSTOM_BLOCK="$custom_test_value" limactl shell --preserve-env "$NAME" printenv "$custom_test_var" 2>/dev/null || echo "NOT_FOUND")"
62+
INFO "$custom_test_var with LIMA_SHELLENV_BLOCK: got=${got_custom_blocked}"
63+
if [ "$got_custom_blocked" != "NOT_FOUND" ]; then
64+
ERROR "Custom blocked environment variable was propagated"
65+
exit 1
66+
fi
67+
68+
# Clean up before next test
69+
unset LIMA_TEST_CUSTOM_BLOCK 2>/dev/null || true
70+
unset LIMA_SHELLENV_BLOCK 2>/dev/null || true
71+
72+
# LIMA_SHELLENV_ALLOW functionality
73+
INFO "=== LIMA_SHELLENV_ALLOW with custom pattern ==="
74+
allow_test_var="LIMA_TEST_ALLOW_VAR"
75+
allow_test_value="should-be-allowed"
76+
got_allowed="$(LIMA_SHELLENV_ALLOW="LIMA_TEST_ALLOW_*" LIMA_TEST_ALLOW_VAR="$allow_test_value" limactl shell --preserve-env "$NAME" printenv "$allow_test_var" 2>/dev/null || echo "NOT_FOUND")"
77+
INFO "$allow_test_var with LIMA_SHELLENV_ALLOW: got=${got_allowed}"
78+
if [ "$got_allowed" != "$allow_test_value" ]; then
79+
ERROR "Allowed environment variable was not propagated"
80+
exit 1
81+
fi
82+
83+
# Non-allowed variables are blocked when LIMA_SHELLENV_ALLOW is set
84+
INFO "=== Non-allowed variables are blocked when LIMA_SHELLENV_ALLOW is set ==="
85+
other_test_var="LIMA_TEST_OTHER_VAR"
86+
other_test_value="should-be-blocked"
87+
got_other="$(LIMA_SHELLENV_ALLOW="LIMA_TEST_ALLOW_*" LIMA_TEST_OTHER_VAR="$other_test_value" limactl shell --preserve-env "$NAME" printenv "$other_test_var" 2>/dev/null || echo "NOT_FOUND")"
88+
INFO "$other_test_var with LIMA_SHELLENV_ALLOW (should be blocked): got=${got_other}"
89+
if [ "$got_other" != "NOT_FOUND" ]; then
90+
ERROR "Non-allowed environment variable was propagated when LIMA_SHELLENV_ALLOW was set"
91+
exit 1
92+
fi
93+
94+
INFO "All --preserve-env tests passed"

‎hack/test-templates.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ declare -A CHECKS=(
5858
["provision-data"]=""
5959
["param-env-variables"]=""
6060
["set-user"]=""
61+
["preserve-env"]="1"
6162
)
6263

6364
case "$NAME" in
@@ -276,6 +277,10 @@ if [[ -n ${CHECKS["mount-home"]} ]]; then
276277
"${scriptdir}"/test-mount-home.sh "$NAME"
277278
fi
278279

280+
if [[ -n ${CHECKS["preserve-env"]} ]]; then
281+
"${scriptdir}"/test-preserve-env.sh "$NAME"
282+
fi
283+
279284
# Use GHCR to avoid hitting Docker Hub rate limit
280285
nginx_image="ghcr.io/stargz-containers/nginx:1.19-alpine-org"
281286
alpine_image="ghcr.io/containerd/alpine:3.14.0"

‎pkg/envutil/envutil_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ func TestGetDefaultBlockList(t *testing.T) {
207207

208208
assert.DeepEqual(t, blocklist, defaultBlockList)
209209

210-
expectedItems := []string{"PATH", "HOME", "SSH_*"}
210+
expectedItems := []string{"PATH", "HOME", "SSH_*", "USER"}
211211
for _, item := range expectedItems {
212212
found := slices.Contains(blocklist, item)
213213
assert.Assert(t, found, "Expected builtin blocklist to contain %q", item)

‎website/content/en/docs/config/environment-variables.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,45 @@ This page documents the environment variables used in Lima.
5757
lima
5858
```
5959

60+
### `LIMA_SHELLENV_ALLOW`
61+
62+
- **Description**: Specifies a comma-separated list of environment variable patterns to allow when propagating environment variables to the Lima instance with `--preserve-env`. When set, **only** variables matching these patterns will be passed through, completely overriding the default block list behavior. This feature only applies to Lima v2.0.0 or later.
63+
- **Default**: unset (when using `--preserve-env`, all variables are propagated except those matching the block list patterns)
64+
- **Usage**:
65+
```sh
66+
export LIMA_SHELLENV_ALLOW="FPATH,XAUTHORITY,CUSTOM_*"
67+
limactl shell --preserve-env default
68+
```
69+
- **Behavior**:
70+
- **Without `--preserve-env`**: No environment variables are propagated (regardless of this setting)
71+
- **With `--preserve-env` and `LIMA_SHELLENV_ALLOW` unset**: All variables are propagated except those in the block list
72+
- **With `--preserve-env` and `LIMA_SHELLENV_ALLOW` set**: Only variables matching the allow patterns are propagated (block list is ignored)
73+
- **Note**: Patterns support wildcards using `*` at the end (e.g., `CUSTOM_*` matches `CUSTOM_VAR`, `CUSTOM_PATH`, etc.).
74+
75+
### `LIMA_SHELLENV_BLOCK`
76+
77+
- **Description**: Specifies a comma-separated list of environment variable patterns to block when propagating environment variables to the Lima instance with `--preserve-env`. Can either replace the default block list or extend it by prefixing with `+`. This feature only applies to Lima v2.0.0 or later.
78+
- **Default**: A predefined list of system and shell-specific variables that should not be propagated:
79+
- Shell variables: `BASH*`, `SHELL`, `SHLVL`, `ZSH*`, `ZDOTDIR`, `FPATH`
80+
- System paths: `PATH`, `PWD`, `OLDPWD`, `TMPDIR`
81+
- User/system info: `HOME`, `USER`, `LOGNAME`, `UID`, `GID`, `EUID`, `GROUP`, `HOSTNAME`
82+
- Display/terminal: `DISPLAY`, `TERM`, `TERMINFO`, `XAUTHORITY`, `XDG_*`
83+
- SSH/security: `SSH_*`
84+
- Dynamic linker: `DYLD_*`, `LD_*`
85+
- Internal variables: `_*` (variables starting with underscore)
86+
87+
See [`GetDefaultBlockList()`](https://github.com/lima-vm/lima/blob/master/pkg/envutil/envutil.go#L133) for the complete list.
88+
- **Usage**:
89+
```sh
90+
# Replace default block list entirely (not recommended)
91+
export LIMA_SHELLENV_BLOCK="SECRET_*,PRIVATE_*"
92+
93+
# Extend default block list (recommended)
94+
export LIMA_SHELLENV_BLOCK="+SECRET_*,PRIVATE_*"
95+
limactl shell --preserve-env default
96+
```
97+
- **Note**: Patterns support wildcards using `*` at the end (e.g., `SSH_*` matches `SSH_AUTH_SOCK`, `SSH_AGENT_PID`). Use the `+` prefix to add to the default block list rather than replacing it entirely. This variable only affects the `--preserve-env` flag behavior.
98+
6099
### `LIMACTL`
61100

62101
- **Description**: Specifies the path to the `limactl` binary.

0 commit comments

Comments
 (0)