nix/docker-builder.nix (1)

Line range hint 24-30: LGTM! Clean implementation of command configuration.

The integration of Cmd into the Docker image config enables flexible binary execution as intended.

Consider documenting the supported binaries and their usage in the README or Docker-specific documentation to help users understand this new capability.

flake.nix (2)

181-210: Consider enhancing IP address handling and command validation

The entrypoint script implementation looks good overall, but there are a few potential improvements:

1. The hostname -i command might return multiple IP addresses in some container configurations. Consider handling this case explicitly.
2. The auxiliary command execution could benefit from additional validation.

Consider applying these improvements:

 dockerHoprdEntrypoint = pkgs.writeShellScriptBin "docker-entrypoint.sh" ''
   set -euo pipefail

   # if the default listen host has not been set by the user,
   # we will set it to the container's ip address

   listen_host="''${HOPRD_DEFAULT_SESSION_LISTEN_HOST:-}"
   listen_host_preset_ip="''${listen_host%%:*}"
   listen_host_preset_port="''${listen_host#*:}"

   if [ -z "''${listen_host_preset_ip:-}" ]; then
-    listen_host_ip="$(hostname -i)"
+    # Take the first IP address if multiple are returned
+    listen_host_ip="$(hostname -i | awk '{print $1}')"
+    
+    # Validate IP format
+    if ! echo "$listen_host_ip" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+      echo "Error: Invalid IP address format: $listen_host_ip" >&2
+      exit 1
+    fi

     if [ -z "''${listen_host_preset_port:-}" ]; then
       listen_host="''${listen_host_ip}"
     else
       listen_host="''${listen_host_ip}:''${listen_host_preset_port}"
     fi
   fi

   export HOPRD_DEFAULT_SESSION_LISTEN_HOST="''${listen_host}"

   if [ -x "/bin/''${1:-}" ]; then
+    # Validate command is in the allowed list
+    case "$1" in
+      hoprd|hoprd-api-schema)
+        exec "$@"
+        ;;
+      *)
+        echo "Error: Command not allowed: $1" >&2
+        exit 1
+        ;;
+    esac
-    # allow execution of auxiliary commands
-    exec "$@"
   else
     # default to hoprd
     exec /bin/hoprd "$@"
   fi
 '';

---

180-225: LGTM! Components are well integrated

The integration of the new Docker entrypoint:

1. Correctly applies only to hoprd images
2. Maintains backward compatibility
3. Successfully implements the PR objective of allowing execution of other hopr binaries

This is a good architectural decision as it:

• Simplifies the user experience by auto-configuring the listen host
• Maintains flexibility by allowing user override
• Enables auxiliary command execution while keeping the default behavior

Configuration used: .coderabbit.yaml
Review profile: CHILL

#!/bin/bash
# Description: Check how the new Cmd parameter is used across the codebase
# Expected: Find references showing how different binaries are specified

rg -l "Cmd\s*=" --type nix

#!/bin/bash
# Let's check the actual usage in flake.nix to understand how Cmd is being used
rg "Cmd\s*=" --type nix -A 5 -B 5

flake.nix (1)

181-211: LGTM! The entrypoint script implementation looks solid.

The script effectively handles the container's IP address configuration and provides flexibility for running auxiliary commands. Good use of set -euo pipefail for error handling.

Consider adding these improvements:

1. Add a comment explaining why port 50000 is the default
2. Add port number validation

 if [ -z "${listen_host_preset_ip:-}" ]; then
   listen_host_ip="$(hostname -i)"
+  # Validate that we got exactly one IP
+  if [[ "$listen_host_ip" =~ [[:space:]] ]]; then
+    echo "Error: Multiple IPs returned by hostname -i" >&2
+    exit 1
+  fi
 
   if [ -z "${listen_host_preset_port:-}" ]; then
+    # Default port for HOPR sessions
     listen_host="${listen_host_ip}:50000"
   else
+    # Validate port number
+    if ! [[ "${listen_host_preset_port}" =~ ^[0-9]+$ ]] || \
+       [ "${listen_host_preset_port}" -lt 1 ] || \
+       [ "${listen_host_preset_port}" -gt 65535 ]; then
+      echo "Error: Invalid port number: ${listen_host_preset_port}" >&2
+      exit 1
+    fi
     listen_host="${listen_host_ip}:${listen_host_preset_port}"
   fi
 fi

Configuration used: .coderabbit.yaml
Review profile: CHILL