fix(box): base64-encode exec args/env so quotes survive libkrun env passing

A container command or env value containing a double-quote was corrupted reaching
the guest: `a3s-box run alpine -- sh -c 'echo "a b"'` failed with the guest sh
reporting 'unterminated quoted string' (plain spaces and quote-free values were
fine). a3s-box passes the command byte-clean end-to-end (cmd Vec<String> -> one
BOX_EXEC_ARG_<i> env var each -> clean KEY=VALUE CStrings -> krun_set_exec), so
the corruption is in libkrun/libkrunfw's env delivery to guest PID 1 — the same
layer whose space-truncation quirk the per-arg BOX_EXEC_ARG design already works
around.

Work around it completely at the a3s-box layer: the runtime now base64-encodes
(URL-safe, no padding — A-Za-z0-9-_ only) the BOX_EXEC_EXEC / ARG_<i> / WORKDIR /
USER / ENV_<k> VALUES and sets BOX_EXEC_B64=1; guest-init decodes them in
ExecConfig::from_env (falling back to the raw value if the marker is absent or a
value fails to decode, so old runtime + new guest still works). base64 contains
no byte that libkrun mishandles, so any container command/env now reaches the
container exactly as written.

Found by comprehensive real-OCI testing. clippy -D warnings clean on runtime +
x86_64-unknown-linux-musl. KVM verification (the repro + no regression) to follow.

Author: Roy Lin

src/guest/init/src/main.rs

@@ -247,31 +247,53 @@ impl ExecConfig {
         // (runtime/src/vm/spec.rs), so this default is only a defensive fallback.
         // Use /bin/sh — universal across distros — never /sbin/init, which does
         // not exist on Alpine and was the original cause of issue #3.
-        let executable = std::env::var("BOX_EXEC_EXEC").unwrap_or_else(|_| "/bin/sh".to_string());
+        // BOX_EXEC_* values are base64-encoded (URL-safe, no pad) by the runtime
+        // when BOX_EXEC_B64=1, so arbitrary bytes (quotes, spaces, `$`, …) survive
+        // libkrun's env serialization. Decode them back; fall back to the raw value
+        // on any decode error or when the marker is absent (older runtime).
+        use base64::Engine;
+        let b64 = std::env::var("BOX_EXEC_B64").map(|v| v == "1").unwrap_or(false);
+        let decode = |s: String| -> String {
+            if !b64 {
+                return s;
+            }
+            base64::engine::general_purpose::URL_SAFE_NO_PAD
+                .decode(s.as_bytes())
+                .ok()
+                .and_then(|bytes| String::from_utf8(bytes).ok())
+                .unwrap_or(s)
+        };
+
+        let executable = std::env::var("BOX_EXEC_EXEC")
+            .map(&decode)
+            .unwrap_or_else(|_| "/bin/sh".to_string());
 
         // Parse args from individual env vars (BOX_EXEC_ARGC + BOX_EXEC_ARG_0..N)
         let args: Vec<String> = match std::env::var("BOX_EXEC_ARGC")
             .ok()
             .and_then(|s| s.parse::<usize>().ok())
         {
             Some(argc) => (0..argc)
-                .filter_map(|i| std::env::var(format!("BOX_EXEC_ARG_{}", i)).ok())
+                .filter_map(|i| std::env::var(format!("BOX_EXEC_ARG_{}", i)).ok().map(&decode))
                 .collect(),
             None => vec![],
         };
 
-        let workdir = std::env::var("BOX_EXEC_WORKDIR").unwrap_or_else(|_| "/".to_string());
+        let workdir = std::env::var("BOX_EXEC_WORKDIR")
+            .map(&decode)
+            .unwrap_or_else(|_| "/".to_string());
 
         // Optional container user (image USER directive or CLI --user).
         let user = std::env::var("BOX_EXEC_USER")
             .ok()
+            .map(&decode)
             .filter(|u| !u.is_empty());
 
-        // Collect BOX_EXEC_ENV_* variables
+        // Collect BOX_EXEC_ENV_* variables (values decoded as above).
         let env: Vec<(String, String)> = std::env::vars()
             .filter_map(|(key, value)| {
                 key.strip_prefix("BOX_EXEC_ENV_")
-                    .map(|stripped| (stripped.to_string(), value))
+                    .map(|stripped| (stripped.to_string(), decode(value)))
             })
             .collect();
 

src/runtime/src/vm/spec.rs

@@ -134,14 +134,20 @@ impl VmManager {
             };
             a3s_box_core::env::merge_env_pairs(&mut container_env, &self.config.extra_env);
 
-            // Pass exec + args as individual env vars (avoids spaces being truncated
-            // by libkrun's env serialization).
+            // Pass exec + args as individual env vars, base64-encoded (URL-safe, no
+            // padding) so arbitrary bytes — spaces, quotes, `$`, `;` — survive
+            // libkrun's env serialization intact (a raw `"` in a value was being
+            // corrupted). `BOX_EXEC_B64=1` tells guest-init to decode them.
+            use base64::Engine;
+            let b64 =
+                |s: &str| base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(s.as_bytes());
             let mut env: Vec<(String, String)> = vec![
-                ("BOX_EXEC_EXEC".to_string(), exec),
+                ("BOX_EXEC_B64".to_string(), "1".to_string()),
+                ("BOX_EXEC_EXEC".to_string(), b64(&exec)),
                 ("BOX_EXEC_ARGC".to_string(), args.len().to_string()),
             ];
             for (i, arg) in args.iter().enumerate() {
-                env.push((format!("BOX_EXEC_ARG_{}", i), arg.clone()));
+                env.push((format!("BOX_EXEC_ARG_{}", i), b64(arg)));
             }
 
             // Prototype: deferred-main-spawn. If the host set BOX_DEFERRED_MAIN=1,
@@ -157,20 +163,23 @@ impl VmManager {
 
             // Pass the effective working directory to guest init so PID 1 and
             // the container entrypoint agree even when no OCI WORKDIR is set.
-            env.push(("BOX_EXEC_WORKDIR".to_string(), workdir.clone()));
+            env.push(("BOX_EXEC_WORKDIR".to_string(), b64(&workdir)));
 
             // Pass the container user (image USER / --user) to guest init, which
             // applies it (setgroups+setgid+setuid) to the MAIN process right
             // before exec — after PID 1 has done its root-only setup. This must
             // NOT go through the shim's libkrun set_uid, which would drop guest
             // PID 1 to the user and break init (mount/chroot need root).
             if let Some(user) = &user {
-                env.push(("BOX_EXEC_USER".to_string(), user.clone()));
+                env.push(("BOX_EXEC_USER".to_string(), b64(user)));
             }
 
-            // Pass container environment variables with BOX_EXEC_ENV_ prefix
+            // Pass container environment variables with BOX_EXEC_ENV_ prefix (values
+            // base64-encoded like the rest, so a value containing `"`/spaces/etc.
+            // reaches the container intact). The key stays raw — env names are
+            // restricted to a safe character set.
             for (key, value) in container_env {
-                env.push((format!("BOX_EXEC_ENV_{}", key), value));
+                env.push((format!("BOX_EXEC_ENV_{}", key), b64(&value)));
             }
 
             // Pass user volume mounts to guest init for mounting inside the VM.