Configuration not parsed if --template is provided

[dwt]

Hi there,

while looking at the way fence starts up and reads configuration it seems not to behave how I expected. This may be because my mental model is wrong, so let's describe.

• I would have expected that configuration at ~/.config/fence/fence.json is always read, except when I provide a custom --settings some/other/path.json argument
• That means, that any customizations that this settings file does (e.g. adding paths to the code sandbox should apply when I run fence -t code some_command

This does not seem to be the case? It seems that fence -t code ls only loads the code template, not its extensions from my custom config file.

Is that intentional?

related but not part of this bug report: How do I provide a configuration that defines extensions for various default sandbox templates? (for example by adding ~/.pi/** to the writeAllowed directive?

[jy-tan]

Yes, fence -t code ... only loads the code template. Your config (~/.config/fence/fence.json) can extend a template (or any other custom config files).

So for your pi example, you can define your config like this:

{
  "extends": "code",  // -> merges with the code template config
  "filesystem": {
    "allowWrite": ["~/.pi/**"]
  }
}

Then fence some-command would run the command with the default config (now with code included).

See Configuration > Config Inheritance for more details.

[dwt]

This is somewhat surprising, from what my knowledge of unix tools has given me I would have expected the configuration to work like this:

• fence has some builtin templates, that I can trigger via -t template-name
• ~/.config/fence/fence.json should be able to customize them all to my liking or even add more
• same for .fence.json (possibly up a few levels) (that might be a bad idea as it is possibly editable in sandbox)
• fence -t code should load my customized version of that template, chaining customizations in the current workspace, my user level customizations and of course originating in the builtin templates.

Instead fence seems to work like this:

• fence does not load any custom configuration when I explicitly invoke a template
• local, user and system wide defaults do not seem to compose
• the configuration only seems to be able to customize one profile - I recon that I will always need multiple sandbox profiles depending on the type of tool I wish to sandbox.

Is there a rationale behind these decisions that I do not see yet? Would you be open to change this behavior?