[raphaelcoeffic]

Stacked on #43: retarget to main once it is merged.

Changes

• dive <container> -- <command>... runs the command in the dive environment instead of starting zsh. Plain dive <container> is unchanged.
  • The command runs directly (no zsh -c), so arguments arrive intact, and it is passed through the sudo re-exec.
  • Exit status: the command's own; 127 if it is not found and 126 if it cannot be run, as in shells; 128 + signal if it is killed.
  • Same environment as the interactive shell, but zshrc is not loaded (documented in the README).
• Signal forwarding: dive's waiting processes forward SIGHUP/INT/QUIT/TERM to their child when another process sent them (kill, timeout, sudo relaying). Signals generated by the kernel (si_code > 0: Ctrl-C, terminal hangup) are not forwarded, since they already reach the command through the foreground process group.
• Fix: the single-thread check before fork() read /proc/self/task by path, which no longer resolves inside the container's mount namespace. Since fix: guard fork() sites against multi-threaded regressions #40 every session logged could not read /proc/self/task, and the check was skipped. It now keeps a handle on the original /proc. Includes a unit test.
• CI: smoke test of the release binary against an Alpine Docker container: a plain command, stdout, exit code, HTTPS.

Testing

Local x86_64 tests with the 26.05 base image, against Alpine containers under Docker and rootless podman:

• exit codes 0 / 3 / 127 / 143
• arguments with spaces and $; stdin and stdout piping
• the command runs in the container's namespaces (container hostname, /etc/os-release)
• PATH / NIX_SSL_CERT_FILE match the interactive shell; curl reaches github.com and rejects the eMudhra test host
• real Ctrl-C through a pty, also with sudo use_pty: the command gets exactly one SIGINT, and dive exits with its status
• timeout -s TERM|INT|HUP 4 dive <ctr> -- sleep 47: the command is stopped after 4s. Before, Docker left it running (TERM) or waited the full duration (INT).
• the thread check reports 1 thread at both fork sites, with no warning

Not tested: an interactive terminal session by hand.

Known limitation

si_code shows who sent a signal, not who else received it. GNU timeout also signals its whole process group. Under rootless podman that group signal reaches the command directly, on top of the copies relayed by sudo and dive: timeout -s INT delivers SIGINT 3 times there. This is harmless for TERM/HUP, and only affects programs that treat a second Ctrl-C as "force quit". Under Docker only the relayed copy gets through, so it is delivered once. Fully deduplicating would require running the command in its own process group as the terminal's foreground job.

🤖 Generated with Claude Code