//===----------------------------------------------------------------------===//
// Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//   https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//===----------------------------------------------------------------------===//

import ArgumentParser
import Cgroup
import ContainerizationOCI
import ContainerizationOS
import FoundationEssentials
import LCShim
import SystemPackage

#if canImport(Musl)
import Musl
#elseif canImport(Glibc)
import Glibc
#endif

struct RunCommand: ParsableCommand {
    static let configuration = CommandConfiguration(
        commandName: "run",
        abstract: "Run a container"
    )

    @Option(name: .long, help: "path to an OCI bundle")
    var bundlePath: String

    mutating func run() throws {
        do {
            let spec: ContainerizationOCI.Spec
            do {
                let bundle = try ContainerizationOCI.Bundle.load(path: URL(filePath: bundlePath))
                spec = try bundle.loadConfig()
            } catch {
                throw App.Failure(message: "failed to load OCI bundle at \(bundlePath): \(error)")
            }
            try execInNamespace(spec: spec)
        } catch {
            App.writeError(error)
            throw error
        }
    }

    private func childRootSetup(
        rootfs: ContainerizationOCI.Root,
        mounts: [ContainerizationOCI.Mount]
    ) throws {
        // setup rootfs
        try prepareRoot(rootfs: rootfs.path)
        try mountRootfs(rootfs: rootfs.path, mounts: mounts)
        try setDevSymlinks(rootfs: rootfs.path)

        try pivotRoot(rootfs: rootfs.path)

        // Remount ro if requested.
        if rootfs.readonly {
            try self.remountRootfsReadOnly()
        }

        try reOpenDevNull()
    }

    /// Mask paths per OCI `linux.maskedPaths`. Files (and any non-directory)
    /// get `/dev/null` bind-mounted on top; directories get an empty read-only
    /// tmpfs. Missing paths are skipped silently — matches runc's `maskPath`.
    private func applyMaskedPaths(_ paths: [String]) throws {
        for path in paths {
            var st = stat()
            if stat(path, &st) != 0 {
                if errno == ENOENT {
                    continue
                }
                throw App.Errno(stage: "stat(\(path)) for mask")
            }

            if (st.st_mode & S_IFMT) == S_IFDIR {
                // Match runc: mask directories with a read-only tmpfs. MS_RDONLY
                // is what actually prevents writes into the masked dir; a
                // `size=0k` option would be a no-op (the kernel treats tmpfs
                // size=0 as "no limit", not an empty filesystem).
                guard mount("tmpfs", path, "tmpfs", UInt(MS_RDONLY | MS_NOSUID | MS_NODEV | MS_NOEXEC), nil) == 0 else {
                    throw App.Errno(stage: "mount(tmpfs mask \(path))")
                }
            } else {
                guard mount("/dev/null", path, "bind", UInt(MS_BIND), nil) == 0 else {
                    throw App.Errno(stage: "mount(bind /dev/null -> \(path))")
                }
            }
        }
    }

    /// Make paths read-only per OCI `linux.readonlyPaths` by bind-mounting
    /// each onto itself and remounting with `MS_RDONLY`. Missing paths are
    /// skipped silently — matches runc's `readonlyPath`. The statfs fallback
    /// mirrors `remountRootfsReadOnly()` for filesystems whose existing flags
    /// (e.g. nosuid, nodev) must be preserved on the remount.
    private func applyReadonlyPaths(_ paths: [String]) throws {
        for path in paths {
            var st = stat()
            if stat(path, &st) != 0 {
                if errno == ENOENT {
                    continue
                }
                throw App.Errno(stage: "stat(\(path)) for readonly")
            }

            guard mount(path, path, "", UInt(MS_BIND | MS_REC), nil) == 0 else {
                throw App.Errno(stage: "mount(bind \(path))")
            }

            var flags = UInt(MS_BIND | MS_REMOUNT | MS_RDONLY)
            if mount("", path, "", flags, "") == 0 {
                continue
            }

            var s = statfs()
            guard statfs(path, &s) == 0 else {
                throw App.Errno(stage: "statfs(\(path))")
            }
            flags |= UInt(s.f_flags)

            guard mount("", path, "", flags, "") == 0 else {
                throw App.Errno(stage: "mount remount-ro \(path)")
            }
        }
    }

    private func remountRootfsReadOnly() throws {
        var flags = UInt(MS_BIND | MS_REMOUNT | MS_RDONLY)

        let ret = mount("", "/", "", flags, "")
        if ret == 0 {
            return
        }

        var s = statfs()
        guard statfs("/", &s) == 0 else {
            throw App.Errno(stage: "statfs(/)")
        }
        flags |= UInt(s.f_flags)

        guard mount("", "/", "", flags, "") == 0 else {
            throw App.Errno(stage: "mount rootfs ro")
        }
    }

    private func childSetup(
        spec: ContainerizationOCI.Spec,
        ackPipe: FileDescriptor,
        syncPipe: FileDescriptor
    ) throws {
        guard let process = spec.process else {
            throw App.Failure(message: "no process configuration found in runtime spec")
        }
        guard let root = spec.root else {
            throw App.Failure(message: "no root found in runtime spec")
        }

        // Wait for the grandparent to tell us that they acked our pid.
        var pidAckBuffer = [UInt8](repeating: 0, count: App.ackPid.count)
        let pidAckBytesRead = try pidAckBuffer.withUnsafeMutableBytes { buffer in
            try ackPipe.read(into: buffer)
        }
        guard pidAckBytesRead > 0 else {
            throw App.Failure(message: "read ack pipe")
        }
        let pidAckStr = String(decoding: pidAckBuffer[..<pidAckBytesRead], as: UTF8.self)

        guard pidAckStr == App.ackPid else {
            throw App.Failure(message: "received invalid acknowledgement string: \(pidAckStr)")
        }

        guard unshare(CLONE_NEWCGROUP) == 0 else {
            throw App.Errno(stage: "unshare(cgroup)")
        }

        guard setsid() != -1 else {
            throw App.Errno(stage: "setsid()")
        }

        try childRootSetup(rootfs: root, mounts: spec.mounts)

        if process.terminal {
            let pty = try Console()
            try pty.configureStdIO()
            var masterFD = pty.master

            try withUnsafeBytes(of: &masterFD) { bytes in
                _ = try syncPipe.write(bytes)
            }

            // Wait for the grandparent to tell us that they acked our console.
            var consoleAckBuffer = [UInt8](repeating: 0, count: App.ackConsole.count)
            let consoleAckBytesRead = try consoleAckBuffer.withUnsafeMutableBytes { buffer in
                try ackPipe.read(into: buffer)
            }
            guard consoleAckBytesRead > 0 else {
                throw App.Failure(message: "read ack pipe")
            }
            let consoleAckStr = String(decoding: consoleAckBuffer[..<consoleAckBytesRead], as: UTF8.self)

            guard consoleAckStr == App.ackConsole else {
                throw App.Failure(message: "received invalid acknowledgement string: \(consoleAckStr)")
            }

            guard ioctl(0, UInt(TIOCSCTTY), 0) != -1 else {
                throw App.Errno(stage: "setctty(0)")
            }

            try mountConsole(path: pty.slavePath)
            try pty.close()
        }

        if !spec.hostname.isEmpty {
            let errCode = spec.hostname.withCString { ptr in
                sethostname(ptr, spec.hostname.count)
            }
            guard errCode == 0 else {
                throw App.Errno(stage: "sethostname()")
            }
        }

        // Apply sysctls from the OCI spec.
        if let sysctls = spec.linux?.sysctl {
            for (key, value) in sysctls {
                let path = "/proc/sys/" + key.replacingOccurrences(of: ".", with: "/")
                let fd = open(path, O_WRONLY)
                guard fd >= 0 else {
                    throw App.Errno(stage: "sysctl open(\(path))")
                }
                defer { close(fd) }
                let bytes = Array(value.utf8)
                let written = write(fd, bytes, bytes.count)
                guard written == bytes.count else {
                    throw App.Errno(stage: "sysctl write(\(key)=\(value))")
                }
            }
        }

        // Apply OCI maskedPaths/readonlyPaths AFTER sysctls (writes to
        // /proc/sys/* would otherwise fail once /proc/sys is remounted ro)
        // and BEFORE the user/capability change (mount() requires
        // CAP_SYS_ADMIN, which we still have here as root). Mask runs first
        // so a path appearing in both lists is hidden, not just locked.
        try self.applyMaskedPaths(spec.linux?.maskedPaths ?? [])
        try self.applyReadonlyPaths(spec.linux?.readonlyPaths ?? [])

        // Apply O_CLOEXEC to all file descriptors except stdio.
        // This ensures that all unwanted fds we may have accidentally
        // inherited are marked close-on-exec so they stay out of the
        // container.
        try App.applyCloseExecOnFDs()

        try App.setRLimits(rlimits: process.rlimits)

        // Prepare capabilities (before user change)
        let preparedCaps = try App.prepareCapabilities(capabilities: process.capabilities ?? ContainerizationOCI.LinuxCapabilities())

        // Change stdio to be owned by the requested user.
        try App.fixStdioPerms(user: process.user)

        // Set uid, gid, and supplementary groups.
        try App.setPermissions(user: process.user)

        // Finish capabilities (after user change)
        try App.finishCapabilities(preparedCaps)

        // Set no_new_privs if requested by the OCI spec.
        try App.setNoNewPrivileges(process: process)

        // Finally execve the container process.
        try App.exec(process: process, currentEnv: process.env)
    }

    private func setupNamespaces(namespaces: [ContainerizationOCI.LinuxNamespace]?) throws -> Int32 {
        var unshareFlags: Int32 = 0

        // Map namespace types to their corresponding CLONE flags
        let nsTypeToFlag: [ContainerizationOCI.LinuxNamespaceType: Int32] = [
            .pid: CLONE_NEWPID,
            .mount: CLONE_NEWNS,
            .uts: CLONE_NEWUTS,
            .ipc: CLONE_NEWIPC,
            .user: CLONE_NEWUSER,
            .cgroup: CLONE_NEWCGROUP,
        ]

        guard let namespaces = namespaces else {
            return CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWUTS
        }

        for ns in namespaces {
            guard let flag = nsTypeToFlag[ns.type] else {
                continue
            }

            if ns.path.isEmpty {
                unshareFlags |= flag
            } else {
                let fd = open(ns.path, O_RDONLY | O_CLOEXEC)
                guard fd >= 0 else {
                    throw App.Errno(stage: "open(\(ns.path))")
                }
                defer { close(fd) }

                guard setns(fd, flag) == 0 else {
                    throw App.Errno(stage: "setns(\(ns.path))")
                }
            }
        }

        return unshareFlags
    }

    private func execInNamespace(spec: ContainerizationOCI.Spec) throws {
        let syncPipe = FileDescriptor(rawValue: 3)
        let ackPipe = FileDescriptor(rawValue: 4)

        let unshareFlags = try setupNamespaces(namespaces: spec.linux?.namespaces)

        guard unshare(unshareFlags) == 0 else {
            throw App.Errno(stage: "unshare(\(unshareFlags))")
        }

        let processID = fork()
        guard processID != -1 else {
            try? syncPipe.close()
            try? ackPipe.close()
            throw App.Errno(stage: "fork")
        }

        if processID == 0 {  // child
            try childSetup(spec: spec, ackPipe: ackPipe, syncPipe: syncPipe)
        } else {  // parent process
            // Setup cgroup before child enters cgroup namespace
            if let linux = spec.linux {
                let cgroupPath = linux.cgroupsPath
                if !cgroupPath.isEmpty {
                    let cgroupManager = try Cgroup2Manager.load(group: URL(filePath: cgroupPath))

                    if let resources = linux.resources {
                        try cgroupManager.applyResources(resources: resources)
                    }

                    try cgroupManager.addProcess(pid: processID)
                }
            }

            // Send our child's pid before we exit.
            var childPid = processID
            try withUnsafeBytes(of: &childPid) { bytes in
                _ = try syncPipe.write(bytes)
            }
        }
    }

    private func mountRootfs(rootfs: String, mounts: [ContainerizationOCI.Mount]) throws {
        let containerMount = ContainerMount(rootfs: rootfs, mounts: mounts)
        try containerMount.mountToRootfs()
        try containerMount.configureConsole()
    }

    private func prepareRoot(rootfs: String) throws {
        guard mount("", "/", "", UInt(MS_SLAVE | MS_REC), nil) == 0 else {
            throw App.Errno(stage: "mount(slave|rec)")
        }

        guard mount(rootfs, rootfs, "bind", UInt(MS_BIND | MS_REC), nil) == 0 else {
            throw App.Errno(stage: "mount(bind|rec)")
        }
    }

    private func setDevSymlinks(rootfs: String) throws {
        let links: [(src: String, dst: String)] = [
            ("/proc/self/fd", "/dev/fd"),
            ("/proc/self/fd/0", "/dev/stdin"),
            ("/proc/self/fd/1", "/dev/stdout"),
            ("/proc/self/fd/2", "/dev/stderr"),
            ("/dev/rtc0", "/dev/rtc"),
        ]

        let rootfsURL = URL(fileURLWithPath: rootfs)
        for (src, dst) in links {
            let dest = rootfsURL.appendingPathComponent(dst)
            guard symlink(src, dest.path) == 0 else {
                if errno == EEXIST {
                    continue
                }
                throw App.Errno(stage: "symlink(\(src) -> \(dest.path))")
            }
        }
    }

    private func reOpenDevNull() throws {
        let file = open("/dev/null", O_RDWR)
        guard file != -1 else {
            throw App.Errno(stage: "open(/dev/null)")
        }
        defer { close(file) }

        var devNullStat = stat()
        try withUnsafeMutablePointer(to: &devNullStat) { pointer in
            guard fstat(file, pointer) == 0 else {
                throw App.Errno(stage: "fstat(/dev/null)")
            }
        }

        for fd: Int32 in 0...2 {
            var fdStat = stat()
            try withUnsafeMutablePointer(to: &fdStat) { pointer in
                guard fstat(fd, pointer) == 0 else {
                    throw App.Errno(stage: "fstat(fd)")
                }
            }

            if fdStat.st_rdev == devNullStat.st_rdev {
                guard dup3(file, fd, 0) != -1 else {
                    throw App.Errno(stage: "dup3(null)")
                }
            }
        }
    }

    /// Pivots the rootfs of the calling process in the namespace to the provided
    /// rootfs in the argument.
    ///
    /// The pivot_root(".", ".") and unmount old root approach is exactly the same
    /// as runc's pivot root implementation in:
    /// https://github.com/opencontainers/runc/blob/main/libcontainer/rootfs_linux.go
    private func pivotRoot(rootfs: String) throws {
        let oldRoot = open("/", O_RDONLY | O_DIRECTORY)
        if oldRoot <= 0 {
            throw App.Errno(stage: "open(oldroot)")
        }
        defer { close(oldRoot) }

        let newRoot = open(rootfs, O_RDONLY | O_DIRECTORY)
        if newRoot <= 0 {
            throw App.Errno(stage: "open(newroot)")
        }
        defer { close(newRoot) }

        // change cwd to the new root
        guard fchdir(newRoot) == 0 else {
            throw App.Errno(stage: "fchdir(newroot)")
        }
        guard CZ_pivot_root(toCString("."), toCString(".")) == 0 else {
            throw App.Errno(stage: "pivot_root()")
        }
        // change cwd to the old root
        guard fchdir(oldRoot) == 0 else {
            throw App.Errno(stage: "fchdir(oldroot)")
        }
        // mount old root rslave so that unmount doesn't propagate back to outside
        // the namespace
        guard mount("", ".", "", UInt(MS_SLAVE | MS_REC), nil) == 0 else {
            throw App.Errno(stage: "mount(., slave|rec)")
        }
        // unmount old root
        guard umount2(".", Int32(MNT_DETACH)) == 0 else {
            throw App.Errno(stage: "umount(.)")
        }
        // switch cwd to the new root
        guard chdir("/") == 0 else {
            throw App.Errno(stage: "chdir(/)")
        }
    }

    private func toCString(_ str: String) -> UnsafeMutablePointer<CChar>? {
        let cString = str.utf8CString
        let cStringCopy = UnsafeMutableBufferPointer<CChar>.allocate(capacity: cString.count)
        _ = cStringCopy.initialize(from: cString)
        return UnsafeMutablePointer(cStringCopy.baseAddress)
    }

    private func mountConsole(path: String) throws {
        let console = "/dev/console"
        if access(console, F_OK) != 0 {
            let fd = open(console, O_RDWR | O_CREAT, mode_t(UInt16(0o600)))
            guard fd != -1 else {
                throw App.Errno(stage: "open(/dev/console)")
            }
            close(fd)
        }

        guard mount(path, console, "bind", UInt(MS_BIND), nil) == 0 else {
            throw App.Errno(stage: "mount(console)")
        }
    }
}