git-launcher: default config path

Author: h4x3rotab

git-launcher/README.md

@@ -1,9 +1,10 @@
 # git-launcher
 
 `git-launcher` runs a workload from one exact Git commit inside a dstack
-container. You give it a Git repository URL, a full commit SHA, and a checkout
-directory. It fetches that commit, verifies that `HEAD` is exactly the commit
-you configured, and then hands control to the workload's entry script.
+container. You give it a config file with a Git repository URL, a full commit
+SHA, and a checkout directory. It fetches that commit, verifies that `HEAD` is
+exactly the commit you configured, and then hands control to the workload's
+entry script.
 
 Use it when you want a generic launcher image whose image digest is stable and
 auditable, while the workload identity comes from an attested config file.
@@ -48,7 +49,9 @@ Do not use it when:
 
 On startup, `git-launcher`:
 
-1. Parses a line-oriented config file. The config is parsed, not sourced.
+1. Parses a line-oriented config file. By default it reads
+   `/etc/git-launcher/config.conf`; you can pass a different path for local
+   testing. The config is parsed, not sourced.
 2. Rejects missing required keys, unknown keys, short SHAs, branches, and tags.
 3. Creates or reuses `WORK_DIR` if it is a Git checkout for the same `REPO_URL`.
 4. Runs `git fetch --tags --prune origin`.
@@ -120,7 +123,9 @@ Rules:
 ## Run locally
 
 Local runs require `bash`, `git`, and standard coreutils. After writing a
-config file for a real workload commit, run the launcher script directly:
+config file for a real workload commit, run the launcher script directly.
+Pass the path explicitly when your local config is not at the container default
+`/etc/git-launcher/config.conf`:
 
 ```sh
 ./bin/git-launcher ./config.conf
@@ -163,7 +168,6 @@ or the workload pin changes the attestation.
 services:
   workload:
     image: docker.io/<org>/git-launcher@sha256:<launcher-digest>
-    command: ["/etc/git-launcher/config.conf"]
     configs:
       - source: pin
         target: /etc/git-launcher/config.conf
@@ -201,8 +205,7 @@ pin, build a small downstream image:
 
 ```dockerfile
 FROM docker.io/<org>/git-launcher@sha256:<launcher-digest>
-COPY web-app.conf /etc/git-launcher/config.conf
-CMD ["/etc/git-launcher/config.conf"]
+COPY config.conf /etc/git-launcher/config.conf
 ```
 
 Deploy the derived image by its own digest. The derived image digest now binds
@@ -218,9 +221,8 @@ For local iteration, bind-mounting the config is convenient:
 services:
   workload:
     image: docker.io/<org>/git-launcher@sha256:<launcher-digest>
-    command: ["/etc/git-launcher/config.conf"]
     volumes:
-      - ./web-app.conf:/etc/git-launcher/config.conf:ro
+      - ./config.conf:/etc/git-launcher/config.conf:ro
       - workload-checkout:/var/lib/git-launcher
       - /var/run/dstack.sock:/var/run/dstack.sock
     restart: unless-stopped

git-launcher/bin/git-launcher

@@ -23,18 +23,22 @@
 set -euo pipefail
 
 PROG=$(basename "$0")
+DEFAULT_CONFIG_FILE=/etc/git-launcher/config.conf
 
 log() { printf '[%s] %s\n' "$PROG" "$*" >&2; }
 die() { printf '[%s] error: %s\n' "$PROG" "$*" >&2; exit 1; }
 
 usage() {
   cat >&2 <<EOF
-Usage: $PROG <config-file>
+Usage: $PROG [config-file]
 
 The config file is a line-oriented KEY=VALUE env file. It is parsed, NOT
 sourced; the launcher only executes (via 'bash -c' / 'bash <script>') the
 workload's own entry point, plus optional INSTALL_CMD / RUN_CMD overrides.
 
+If config-file is omitted, the launcher reads:
+  $DEFAULT_CONFIG_FILE
+
 Required keys:
   REPO_URL       Git URL of the pinned repo (https://... or git@...).
   COMMIT_SHA     Full 40-hex (SHA-1) or 64-hex (SHA-256) commit hash.
@@ -73,16 +77,16 @@ Unknown keys are rejected.
 EOF
 }
 
-if [[ $# -ne 1 ]]; then
-  usage
-  exit 2
-fi
-
 case ${1:-} in
   -h|--help) usage; exit 0 ;;
 esac
 
-CONFIG_FILE=$1
+if [[ $# -gt 1 ]]; then
+  usage
+  exit 2
+fi
+
+CONFIG_FILE=${1:-$DEFAULT_CONFIG_FILE}
 
 require_tool() {
   command -v "$1" >/dev/null 2>&1 || die "required tool not found in PATH: $1"

git-launcher/tests/run-tests.sh

@@ -494,7 +494,26 @@ EOF
 }
 
 test_help_flag() {
-  "$LAUNCHER" --help >/dev/null
+  local out=$TMPROOT/help.out
+  "$LAUNCHER" --help >"$out" 2>&1
+  grep -q "Usage: .*\\[config-file\\]" "$out" || { echo "help does not show optional config file" >&2; cat "$out" >&2; return 1; }
+  grep -q "/etc/git-launcher/config.conf" "$out" || { echo "help does not document default config path" >&2; cat "$out" >&2; return 1; }
+}
+
+test_default_config_path_when_omitted() {
+  # The container path is absolute, so this test verifies selection by checking
+  # the missing-file error. If a developer machine happens to have that file,
+  # the image-level behavior is still covered by the help text and Dockerfile.
+  if [[ -e /etc/git-launcher/config.conf ]]; then
+    echo "default config exists on this host; skipping missing-file assertion" >&2
+    return 0
+  fi
+  local err=$TMPROOT/default-config.err
+  if "$LAUNCHER" 2>"$err"; then
+    echo "launcher succeeded without an explicit config path on a host with no default config" >&2
+    return 1
+  fi
+  grep -q "config file not found: /etc/git-launcher/config.conf" "$err" || { echo "launcher did not use default config path" >&2; cat "$err" >&2; return 1; }
 }
 
 test_release_workflow_attests_image_digest() {
@@ -564,6 +583,7 @@ run_case "entrypoint_script_override"            test_entrypoint_script_override
 run_case "entrypoint_script_escape_rejected"     test_entrypoint_script_escape_rejected
 run_case "install_cmd_without_run_cmd_fails"     test_install_cmd_without_run_cmd_fails
 run_case "help_flag"                             test_help_flag
+run_case "default_config_path_when_omitted"      test_default_config_path_when_omitted
 run_case "release_workflow_attests_image_digest" test_release_workflow_attests_image_digest
 run_case "dockerfile_runtime_is_minimal_launcher" test_dockerfile_runtime_is_minimal_launcher
 run_case "verify_doc_present_and_linked"          test_verify_doc_present_and_linked