Web-based remote shell for debugging and/or exploiting

Services like GitHub Actions, Cloud Build, Cloud Run, plenty of others others, let users run a container in a somewhat restricted environment, where your request isn't exactly interactive. It could be fun to build a container image that you can pass to these services to interactively look around in the environment and explore

Two parts, a runner image and a controller web app:

Runner image

starts, POSTs to controller to mint new session ID, prints to stdout
Polls GET /<session-ID>/cmds for latest command(s) to run
When it sees a new command, runs the command with os/exec
Any new stdout/stderr logs send POST /<session-ID>/logs to append to ongoing logs (in GCS or Datastore)
If no commands seen after 1m, DELETE /<session-ID> and exits to mark the session as ended

Controller image

GET /<session-ID> serves a form to input new commands
Form does a POST /<session-ID>/cmds to append new commands to run
JS on the page polls GET /<session-ID>/logs (with Range header) to update UI with latest logs
cancel button to DELETE /<session-ID> to end the session and exit the runner container.

Live sessions stored in Datastore, logs stored in GCS with a TTL

How it might look/work:

$ cat cloudbuild.yaml
steps:
- name: gcr.io/blah/runner
$ gcloud builds submit --no-source
...
Step #0: Created new session 1ec05323-3d34-4a9f-8869-1896a56d57cc
Step #0: Go to https://blah.com/1ec05323-3d34-4a9f-8869-1896a56d57cc to provide commands
Step #0: Waiting for commands...
Step #0: Found new commands ["echo hello"]
Step #0: ==> Running "echo hello"
Step #0: hello
Step #0: -------------------------------
Step #0: Waiting for commands...
Step #0: Found new commands ["pwd"]
Step #0: ==> Running "pwd"
Step #0: /something/cool/foo/bar/baz
Step #0: -------------------------------
Step #0: Waiting for commands...
Step #0: No new commands after 1m, exiting...
DONE

imjasonh / ideas

Web-based remote shell for debugging and/or exploiting #85

Runner image

Controller image

Prior Art