Function build_env

crates/openshell-driver-podman/src/container.rs:331–427

Merge environment variables from user spec/template with required driver vars. User-supplied vars are inserted first so that the required driver vars always win -- preventing spec/template overrides of security- critical values like `OPENSHELL_ENDPOINT` or `OPENSHELL_SANDBOX_ID`.

(
    sandbox: &DriverSandbox,
    config: &PodmanComputeConfig,
    image: &str,
)

/// vars always win -- preventing spec/template overrides of security-
/// critical values like `OPENSHELL_ENDPOINT` or `OPENSHELL_SANDBOX_ID`.
fn build_env(
    sandbox: &DriverSandbox,
    config: &PodmanComputeConfig,
    image: &str,
) -> BTreeMap<String, String> {
    let spec = sandbox.spec.as_ref();
    let template = spec.and_then(|s| s.template.as_ref());

    let mut env: BTreeMap<String, String> = BTreeMap::new();

    // 1. User-supplied environment (lowest priority).
    // Template vars first, then spec overwrites (spec is user-specified).
    let mut user_env: BTreeMap<String, String> = BTreeMap::new();
    if let Some(t) = template {
        for (k, v) in &t.environment {
            user_env.insert(k.clone(), v.clone());
        }
    }
    if let Some(s) = spec {
        if !s.log_level.is_empty() {
            env.insert(
                openshell_core::sandbox_env::LOG_LEVEL.into(),
                s.log_level.clone(),
            );
        }
        for (k, v) in &s.environment {
            user_env.insert(k.clone(), v.clone());
        }
    }
    env.extend(user_env.clone());
    if !user_env.is_empty()
        && let Ok(json) = serde_json::to_string(&user_env)
    {
        env.insert(openshell_core::sandbox_env::USER_ENVIRONMENT.into(), json);
    }

    // 2. Required driver vars (highest priority -- always overwrite).
    env.insert(
        openshell_core::sandbox_env::SANDBOX.into(),
        sandbox.name.clone(),
    );
    env.insert(
        openshell_core::sandbox_env::SANDBOX_ID.into(),
        sandbox.id.clone(),
    );
    env.insert(
        openshell_core::sandbox_env::ENDPOINT.into(),
        config.grpc_endpoint.clone(),
    );
    env.insert(
        openshell_core::sandbox_env::SSH_SOCKET_PATH.into(),
        config.sandbox_ssh_socket_path.clone(),
    );
    env.insert("OPENSHELL_CONTAINER_IMAGE".into(), image.to_string());
    env.insert(
        openshell_core::sandbox_env::SANDBOX_COMMAND.into(),
        "sleep infinity".into(),
    );