refactor: harden Docker helper scripts - #25
Merged
Conversation
- Quote paths and variables while using strict Bash execution - Preserve Docker flags and user commands through safe argument arrays - Run shellcheck and shfmt in source and generated project CI
mjun0812
commented
Sep 2, 2026
mjun0812
left a comment
OwnerAuthor
There was a problem hiding this comment.
Codex PR Review
Summary
This pull request hardens the Docker helper scripts with strict Bash execution, safe argument handling, and direct process replacement, and adds shell checks to CI. No blocking findings were confirmed. The Contract axis was skipped because no spec source was available.
Verdict
APPROVE
Findings
N/A
Reviewed by Codex at 78797fe
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview and Background
This PR hardens the template's Docker helper scripts while preserving their build and run behavior. The previous scripts relied on unquoted expansions, legacy command substitution, and string-based optional arguments, which could split paths or user commands unexpectedly.
Related Issues
None.
Implementation Approach
The scripts now use Bash strict mode, quoted path and variable expansions, modern
$(...)command substitution, and arrays for optional Docker flags and forwarded commands. Each terminal Docker or gosu invocation usesexec, so the helper process is replaced directly. Both the repository CI and generated-project CI install and run shfmt and ShellCheck against their respective Docker scripts.Changes
build.sh,run.sh, andentrypoint.shwith safe quoting and strict execution..github/workflows/test.ymlandtemplate/.github/workflows/ci.yml.Impact
Docker image build and run interfaces remain unchanged. Paths and command arguments containing spaces or glob characters are now forwarded as single arguments. CI gains a shell-tool installation step and static checks for Docker scripts; no application runtime or dependency changes are introduced.
Validation Results
shellcheck template/docker/*.sh: passed.shfmt --list template/docker/*.sh: passed with no unformatted files.bash -n template/docker/*.sh: passed.uvx copier copy --vcs-ref HEAD ./ /tmp/test-copier-docker ...: passed.shellcheck /tmp/test-copier-docker/docker/*.sh,shfmt --list /tmp/test-copier-docker/docker/*.sh, andbash -n /tmp/test-copier-docker/docker/*.sh: passed.run.shwith a fake Docker CLI and arguments containing spaces and glob characters; all arguments were preserved../docker/build.sh: could not complete because the local Docker daemon denied BuildKit activity-file access (operation not permitted).