#!/bin/sh
# Confine dot in bubblewrap, taking input from stdin and writing PNG
# output to stdout.

# 64 megs seems to be enough, 21 megs isn’t.
address_space=64001000

# With zero --fsize, we can’t write the output file on stdout if it's
# redirected to a file, but you can pipe it to `cat`.
file_size=0

cpu_seconds=5

# Apparently Pango or fontconfig is multithreaded now‽
# (process:2): GLib-ERROR **: 00:37:18.600: creating thread '[pango] FcInit': Error creating thread: Resource temporarily unavailable
processes=4

# We’re using --unshare-user, etc., explicitly, because --unshare-all
# uses the wimpy --unshare-user-try and --unshare-cgroup-try options.
# --remount-ro / prevents malicious code from filling the root
# filesystem with empty files.

exec bwrap \
      --ro-bind /bin /bin \
      --ro-bind /lib /lib \
      --ro-bind /lib64 /lib64 \
      --ro-bind /sbin /sbin \
      --ro-bind /usr/lib /usr/lib \
      --ro-bind /usr/share/fonts /usr/share/fonts \
      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
      --ro-bind /etc/fonts /etc/fonts \
      --remount-ro / \
      --unshare-user --unshare-ipc --unshare-pid --unshare-net --unshare-uts \
      --unshare-cgroup --die-with-parent --new-session --cap-drop ALL \
      --clearenv --setenv PATH /bin \
      prlimit --as="$address_space" --fsize="$file_size" \
              --cpu="$cpu_seconds" --nproc="$processes" \
                  dot -Tpng -Gdpi=192

# For testing, to verify that network access is indeed blocked:
#                 nc.traditional -v -v 127.0.0.1 8000