Repository: bottlerocket-os/bottlerocket
File: sources/api/bootstrap-containers/src/main.rs (Rust)

Code before:
```
*/

#[macro_use]
extern crate log;

use datastore::{serialize_scalar, Key, KeyType};
use simplelog::{Config as LogConfig, LevelFilter, SimpleLogger};
use snafu::{ensure, OptionExt, ResultExt};
use std::collections::HashMap;
use std::convert::TryFrom;
use std::env;
use std::ffi::OsStr;
use std::fmt::Write;
use std::fs;
use std::path::Path;
use std::process::{self, Command};
use std::str::FromStr;

use model::modeled_types::{BootstrapContainerMode, Identifier};

const ENV_FILE_DIR: &str = "/etc/bootstrap-containers";
const DROPIN_FILE_DIR: &str = "/etc/systemd/system";
const PERSISTENT_STORAGE_DIR: &str = "/local/bootstrap-containers";
const DROP_IN_FILENAME: &str = "overrides.conf";
const DEFAULT_CONFIG_PATH: &str = "/etc/bootstrap-containers.toml";

/// Stores user-supplied global arguments
#[derive(Debug)]
struct Args {
    log_level: LevelFilter,
    config_path: String,
    socket_path: String,
}

impl Default for Args {
    fn default() -> Self {
        Self {
            log_level: LevelFilter::Info,
            config_path: DEFAULT_CONFIG_PATH.to_string(),
            socket_path: constants::API_SOCKET.to_string(),
        }
    }
}

/// Stores the subcommand to be executed
#[derive(Debug)]
enum Subcommand {
    CreateContainers,
    MarkBootstrap(MarkBootstrapArgs),
}

Review comment (security):
```suggestion
const DEFAULT_CONFIG_PATH: &str = "/etc/bootstrap-containers/bootstrap-containers.toml";
```

And then add a mount unit like `packages/host-ctr/etc-host-containers.mount.in` to ensure that `/etc/bootstrap-containers` is labeled as `secret_t`.

Code after:
```
*/

#[macro_use]
extern crate log;

use base64::Engine;
use serde::{Deserialize, Serialize};
use simplelog::{Config as LogConfig, LevelFilter, SimpleLogger};
use snafu::{ensure, OptionExt, ResultExt};
use std::collections::HashMap;
use std::convert::TryFrom;
use std::env;
use std::ffi::OsStr;
use std::fmt::Write;
use std::fs;
use std::path::{Path, PathBuf};
use std::process::{self, Command};
use std::str::FromStr;

use modeled_types::{BootstrapContainerMode, Identifier, Url, ValidBase64};

const ENV_FILE_DIR: &str = "/etc/bootstrap-containers";
const DROPIN_FILE_DIR: &str = "/etc/systemd/system";
const PERSISTENT_STORAGE_DIR: &str = "/local/bootstrap-containers";
const DROP_IN_FILENAME: &str = "overrides.conf";
const DEFAULT_CONFIG_PATH: &str = "/etc/bootstrap-containers/bootstrap-containers.toml";

#[derive(Serialize, Deserialize)]
#[serde(rename_all = "kebab-case")]
struct BootstrapContainer {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    source: Option<Url>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    mode: Option<BootstrapContainerMode>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    user_data: Option<ValidBase64>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    essential: Option<bool>,
}

/// Stores user-supplied global arguments
#[derive(Debug)]
struct Args {
    log_level: LevelFilter,
    config_path: PathBuf,
}

impl Default for Args {
    fn default() -> Self {
        Self {