Repository: bottlerocket-os/bottlerocket
File: sources/api/bootstrap-containers/src/main.rs (Rust)

Code before:
        failed == 0,
        error::ManageContainersFailedSnafu {
            failed,
            tried: bootstrap_containers.len()
        }
    );

    Ok(())
}

/// Handles the `mark-bootstrap` subcommand, which is called by the bootstrap
/// container's systemd unit, which could potentially cause a concurrent invocation
/// in this binary after the API setting finalizes.
async fn mark_bootstrap<P>(args: MarkBootstrapArgs, socket_path: P) -> Result<()>
where
    P: AsRef<Path>,
{
    let container_id: &str = args.container_id.as_ref();
    let mode = args.mode.as_ref();
    info!("Mode for '{}' is '{}'", container_id, mode);

    // When 'mode' is 'once', the container is marked as 'off' once it
    // finishes. This guarantees that the the container is only started in
    // the boot where it was created.
    if mode != "always" {
        let formatted = format!("settings.bootstrap-containers.{}.mode", container_id);
        let key = Key::new(KeyType::Data, &formatted)
            .context(error::KeyFormatSnafu { key: formatted })?;
        let value = serialize_scalar(&"off".to_string()).context(error::SerializeSnafu)?;

        let mut map = HashMap::new();
        map.insert(key, value);
        let settings: model::Settings = datastore::deserialization::from_map(&map)
            .context(error::SettingsDeserializeSnafu { settings: map })?;

        info!("Turning off container '{}'", container_id);
        apiclient::set::set(socket_path, &settings)
            .await
            .context(error::SetSnafu)?;
    }

    Ok(())
}

async fn run() -> Result<()> {
    let (args, subcommand) = parse_args(env::args())?;

    // SimpleLogger will send errors to stderr and anything less to stdout.
    SimpleLogger::init(args.log_level, LogConfig::default()).context(error::LoggerSnafu)?;

    info!("bootstrap-containers started");

Review comment (suggestion):
Can you verify that this actually works as expected? I.e. a bootstrap container that is set to "once" mode only runs once on first boot and not multiple times - either on the same boot (which can happen when the systemd target changes) or on subsequent boots.

I'd suggest a bootstrap container that runs something like:
```
#!/bin/bash
TS="$(date +%s)"
apiclient get settings.bootstrap-containers >
  /.bottlerocket/rootfs/local/${TS}.txt
```

And confirm that only one file is created and it shows the expected value.

Code after:
    ensure!(
        failed == 0,
        error::ManageContainersFailedSnafu {
            failed,
            tried: bootstrap_containers.len()
        }
    );

    Ok(())
}

/// Handles the `mark-bootstrap` subcommand, which is called by the bootstrap
/// container's systemd unit, which could potentially cause a concurrent invocation
/// in this binary after the API setting finalizes.
fn mark_bootstrap(args: MarkBootstrapArgs) -> Result<()> {
    let container_id: &str = args.container_id.as_ref();
    let mode = args.mode.as_ref();
    info!("Mode for '{}' is '{}'", container_id, mode);

    // When 'mode' is 'once', the container is marked as 'off' once it
    // finishes. This guarantees that the container is only started in
    // the boot where it was created.
    if mode != "always" {
        let formatted = format!("settings.bootstrap-containers.{}.mode=off", container_id);
        info!("Turning off container '{}'", container_id);
        command("apiclient", ["set", formatted.as_str()])?;
    }

    Ok(())
}

fn run() -> Result<()> {
    let (args, subcommand) = parse_args(env::args())?;

    // SimpleLogger will send errors to stderr and anything less to stdout.
    SimpleLogger::init(args.log_level, LogConfig::default()).context(error::LoggerSnafu)?;

    info!("bootstrap-containers started");

    match subcommand {
        Subcommand::CreateContainers => create_containers(args.config_path),
        Subcommand::MarkBootstrap(mark_bootstrap_args) => mark_bootstrap(mark_bootstrap_args),
    }
}

// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
// https://github.com/shepmaster/snafu/issues/110
fn main() {
    if let Err(e) = run() {
        match e {