Create container for running bpfman in dev

bpfman-dev-container.sh

#!/usr/bin/env bash

# bpfman-dev-container.sh
#
# Minimal, distrobox-free dev container with Nix mounts and sane TTY.
# /run and /tmp are tmpfs. Nix mounts only if /nix/store exists. Works
# with docker (and maybe with podman).

set -euo pipefail

: "${NAME:=bpfman-dev}"
: "${IMAGE:=fedora:latest}"
: "${DETACH_KEYS:=ctrl-\\}"

host_pwd=$(pwd)

# Pick runtime.
if [[ -z "${RUNTIME:-}" ]]; then
  if command -v docker >/dev/null 2>&1; then
    RUNTIME=docker
  elif command -v podman >/dev/null 2>&1; then
    RUNTIME=podman
  else
    echo "Error: neither docker nor podman found." >&2
    exit 1
  fi
fi

# Build Nix volume specs only if /nix/store exists.
build_nix_vols() {
  if [[ ! -d /nix/store ]]; then
    return 0
  fi
  if command -v nix-distrobox-print-volume-paths >/dev/null 2>&1; then
    nix-distrobox-print-volume-paths
  else
    printf '%s ' \
      "/nix/store:/nix/store" \
      "$HOME/.nix-profile:$HOME/.nix-profile" \
      "/etc/profiles/per-user/$USER:/etc/profiles/per-user/$USER" \
      "/run/current-system/sw:/run/current-system/sw"
  fi
}

vol_args=()

# Split into tokens (each token is host:guest[:opts]).
# shellcheck disable=SC2206
nix_pairs=( $(build_nix_vols) )
for spec in "${nix_pairs[@]}"; do
  [[ -z "$spec" ]] && continue
  vol_args+=(-v "$spec")
done

# Always mount $HOME and $PWD as themselves.
vol_args+=(-v "$HOME:$HOME" -v "$host_pwd:$host_pwd")

# eBPF mounts.
vol_args+=(-v /sys/fs/bpf:/sys/fs/bpf:rw -v /run/bpfman/fs:/run/bpfman/fs:rw)

# Make /run and /tmp ephemeral.
tmpfs_args=(
  --mount type=tmpfs,dst=/run,tmpfs-mode=755
  --mount type=tmpfs,dst=/tmp,tmpfs-mode=1777
)

common_flags=(
  --name "$NAME"
  --privileged
  --cap-add=ALL
  --ulimit memlock=-1:-1
  --security-opt seccomp=unconfined
  --workdir "$host_pwd"
  --detach-keys "$DETACH_KEYS"
  -it
  "${tmpfs_args[@]}"
  "${vol_args[@]}"
)

# Warn about rootless podman limits.
if [[ "$RUNTIME" == "podman" ]] && [[ -z "${CONTAINER_HOST:-}" ]] \
   && [[ "${XDG_RUNTIME_DIR:-}" == /run/user/* ]]; then
  echo "Note: podman rootless may block /sys/fs/bpf and ignore" \
       "--privileged; consider rootful for eBPF." >&2
fi

if ! $RUNTIME inspect "$NAME" >/dev/null 2>&1; then
  echo "Creating $NAME with $RUNTIME ($IMAGE)"
  exec $RUNTIME run "${common_flags[@]}" "$IMAGE" /bin/bash
else
  echo "Re-attaching to existing $NAME"
  $RUNTIME start "$NAME" >/dev/null
  exec $RUNTIME attach --detach-keys="$DETACH_KEYS" "$NAME"
fi

# ./target/debug/bpfman load image --image-url quay.io/bpfman-bytecode/xdp_pass:latest --programs xdp:pass --application XdpPassProgram
# ./target/debug/bpfman attach {program_id} xdp --iface eth0 --priority 100
# ./target/debug/bpfman list programs