Repository: hashicorp/nomad
File: drivers/rawexec/driver.go (Go)

Code before:
		exitResult:   &drivers.ExitResult{},
		logger:       d.logger,
		doneCh:       make(chan struct{}),
	}

	d.tasks.Set(taskState.TaskConfig.ID, h)

	go h.run()
	return nil
}

func (d *Driver) buildEnvList(tc *TaskConfig, cfg *drivers.TaskConfig) ([]string, error) {

	// combine tc and cfg denyLists
	denyList := slices.Concat(d.config.DeniedEnvvars, tc.DeniedEnvvars)

	envList := make([]string, 0, len(cfg.Env))    // to return final envvar list
	deniedList := make([]string, 0, len(cfg.Env)) // to capture envvars that match globs
	keyList := make([]string, 0, len(cfg.Env))    // to create key string for capturing matches

	for k := range cfg.Env {
		//make a key list
		keyList = append(keyList, k)
	}

	keyString := strings.Join(keyList, " ")

	for _, v := range denyList {
		//wrap in glob
		envVar := "*" + v + "*"
		found := glob.Glob(envVar, keyString)
		if found {
			// if deny list pattern is present convert glob to regex
			// pattern replaces each glob with "match all but whitespace" char
			// to remove each key from the keyString
			pattern := strings.ReplaceAll(v, "*", "\\S*")
			r, err := regexp.Compile(pattern)
			if err != nil {
				d.logger.Error("failed to compile regex, matched denyList entry not denied", v)
				return []string{}, errors.New(fmt.Sprintf("failed to compile regex, matched denyList entry not denied: %s", v))
			}

			matches := r.FindAllString(keyString, -1)
			// and append all matched keys to deniedList
			deniedList = append(deniedList, matches...)

		}
	}
	for k, v := range cfg.Env {
		if found := slices.Contains(deniedList, k); !found {
			envList = append(envList, k+"="+v)

Review comment (suggestion):
We're doing a bunch of small memory allocations here and I'm not sure it's necessary to build up all this intermediate state. Our goal is to take a `map[string]string` and transform it into a `[]string`, but until the final step where we're implementing the `k+"="+v` I think we could work directly on the map.

From a high-level view, you can iterate the map, and then delete the key from the map if its in the deny list (or matches the glob). See https://go.dev/play/p/QNulOgAJ9L9 for a hacky prototype.

Code after:
		doneCh:       make(chan struct{}),
	}

	d.tasks.Set(taskState.TaskConfig.ID, h)

	go h.run()
	return nil
}

func (d *Driver) buildEnvList(tc *TaskConfig, cfg *drivers.TaskConfig) []string {
	// combine tc and cfg denyLists
	denyList := slices.Concat(d.config.DeniedEnvvars, tc.DeniedEnvvars)
	envList := make([]string, 0, len(cfg.Env))

	for k, v := range cfg.Env {
		found := false
		for _, denied := range denyList {
			if found = glob.Glob(denied, k); found {
				break
			}
		}

		if !found {
			envList = append(envList, k+"="+v)
		}
	}
	sort.Strings(envList)
	return envList
}

func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drivers.DriverNetwork, error) {
	if !d.config.Enabled {
		return nil, nil, errDisabledDriver
	}

	if _, ok := d.tasks.Get(cfg.ID); ok {
		return nil, nil, fmt.Errorf("task with ID %q already started", cfg.ID)
	}

	var driverConfig TaskConfig
	if err := cfg.DecodeDriverConfig(&driverConfig); err != nil {
		return nil, nil, fmt.Errorf("failed to decode driver config: %v", err)
	}

	driverConfig.OverrideCgroupV2 = cgroupslib.CustomPathCG2(driverConfig.OverrideCgroupV2)

	if err := driverConfig.validate(); err != nil {
		return nil, nil, fmt.Errorf("failed driver config validation: %v", err)
	}

	if err := d.Validate(*cfg); err != nil {