inspect.docker

#! /usr/bin/env bash

declare trace="${TRACE:-}"
# shellcheck disable=SC2034
declare debug="${DEBUG:-}"

set -eu
set -o pipefail

# If NO_REPO_MASKS is set in the environment then propagate it here so that we
# are able to inspect a container with no masked repos without further hacking!
export NO_REPO_MASKS

[[ -n "${trace:-}" ]] && set -o xtrace

cd "$( dirname "$( readlink -e "${0}" )" )" || exit 1

# Set by common/vars.sh, sourced below...
#
#declare build_name=''

# shellcheck disable=SC1091
[[ ! -s common/vars.sh ]] || . common/vars.sh
# shellcheck disable=SC2034 # Set from common/vars.sh
[[ -n "${__COMMON_VARS_INCLUDED:-}" ]] || {
	echo >&2 'FATAL: Inclusion of common defaults failed'
	exit 1
}

# shellcheck disable=SC2154
declare IMAGE="${build_name}:latest"
# shellcheck disable=SC1091
[[ -s common/run.sh ]] && . common/run.sh >/dev/null

if [[ "$( uname -s )" == 'Darwin' ]]; then
	# Darwin/BSD lacks GNU readlink - either realpath or perl's Cwd module
	# will do at a pinch, although both lack the additional options of GNU
	# binaries...
	#
	readlink() {
		if type -pf realpath >/dev/null 2>&1; then
			realpath "${2}" 2>/dev/null
		else
			# The perl statement below returns $PWD if the supplied
			# path doesn't exist :(
			[[ -e "${2}" ]] || return 1
			perl -MCwd -le 'print Cwd::abs_path shift' "${2}"
		fi
	}  # readlink
	export -f readlink
fi


# Provide a '--name' to prevent the container being removed on exit.

# Useful use-cases:
#for s in $(
#	podman image ls |
#		grep '^localhost.*service' |
#		cut -d'/' -f 2- |
#		sed 's/\s\+/:/g' |
#		cut -d':' -f 1-2
#); do
#	./inspect.docker --remove --image "${s}" \
#		'ls -d /var/db/pkg/*/*systemd* /var/db/pkg/*/*udev*'
#done

if [[ -n "${*:-}" ]]; then
	if grep -Eq -- ' -(h|-help) ' <<<" ${*:-} "; then
		output >&2 "Usage: $( basename "${0}" ) [--image=<image>]" \
			'[--name=<name>] [--remove] [--mount=<...>]' \
			'[--memory-reservation=<size>] [--memory-limit=<size>]' \
			'[--swap-limit=<size>] [--device=<...>] [commands]'
		exit 0
	fi
fi

declare _output=''
# shellcheck disable=SC2154
if ! [[ -x "$( type -pf "${_command}" )" ]]; then
	echo >&2 "FATAL: Cannot locate binary '${_command}'"
	exit 1
elif ! _output="$( "${_command}" info 2>&1 )"; then
	if [[ "${_command}" == 'podman' ]]; then
		echo >&2 "FATAL: Unable to successfully execute" \
			"'${_command}' - do you need to run '${_command}" \
			"machine start' or re-run '$( basename "${0}" )' as" \
			"'root'?"
	else
		echo >&2 "FATAL: Unable to successfully execute" \
			"'${_command}' - do you need to re-run" \
			"'$( basename "${0}" )' as 'root'?"
	fi
	exit 1
elif [[ "$( uname -s )" != 'Darwin' ]] &&
		(( EUID )) &&
		grep -Fq -- 'rootless: false' <<<"${_output}"
then
	echo >&2 "FATAL: Please re-run '$( basename "${0}")' as user 'root'"
	exit 1
fi
unset _output

declare -a args=() container_args=() mount=() device=()

# declared in _docker_setup
#declare image='' name=''

_docker_parse() {
	local arg='' next=''

	for arg in "${@:-}"; do
		if [[ -n "${next:-}" ]]; then
			if [[ "${next}" == 'name' ]]; then
				name="${arg}"
				print "Setting container name to '${name}' in $( basename -- "${0#"-"}" )"

			elif [[ "${next}" == 'image' ]]; then
				image="${arg}"

			elif [[ "${next}" == 'mount' ]]; then
				mount+=( "${arg}" )

			elif [[ "${next}" = 'device' ]]; then
				device+=( "${arg}" )
			fi

			next=''

		# Name components may contain lowercase characters, digits and
		# separators. A separator is defined as a period, one or two
		# underscores, or one or more dashes. A name component may not start or
		# end with a separator.
		#
		elif grep -Eq -- '^-(n|-name)(=[a-z0-9]+(([.]|[_]{1,2}|[-]+)[a-z0-9]+)*)?$' <<<"${arg}"; then
			if [[ "${arg}" == *=* ]]; then
				name="$( echo "${arg}" | cut -d'=' -f 2- )"
				print "Setting container name to '${name}' in $( basename -- "${0#"-"}" )"
			else
				next='name'
			fi

		# ... a tag name may contain lowercase and uppercase characters,
		# digits, underscores, periods and dashes. A tag name may not start
		# with a period or a dash and may contain a maximum of 128 characters.
		#
		elif grep -Eq -- '^-(i|-image)(=[a-z0-9]+(([.]|[_]{1,2}|[-]+)[a-z0-9]+)*(:[a-zA-Z0-9_][a-zA-Z0-9_.-]*)?)?$' <<<"${arg}"; then
			if [[ "${arg}" == *=* ]]; then
				image="$( echo "${arg}" | cut -d'=' -f 2- )"
			else
				next='image'
			fi

		elif grep -Eq -- '^-(m|-mount)(=.*)?$' <<<"${arg}"; then
			if [[ "${arg}" == *=* ]]; then
				mount+=( "$( echo "${arg}" | cut -d'=' -f 2- )" )
			else
				next='mount'
			fi

		elif grep -Eq -- '^-(d|-device)(=.*)?$' <<<"${arg}"; then
			if [[ "${arg}" == *=* ]]; then
				device+=( "$( echo "${arg}" | cut -d'=' -f 2- )" )
			else
				next='device'
			fi

		elif grep -Eq -- '^-(r|-rm|-remove)$' <<<"${arg}"; then
			rm=1

		else
			args+=( "${arg}" )
		fi
	done
	if [[ -n "${next:-}" ]]; then
		warn "Missing value for argument '--${next}'"
	fi
	(( ${#device[@]} )) && DOCKER_DEVICES="${device[*]}"

	for arg in "${args[@]:-}"; do
		container_args+=( "${arg}" )
	done

	export name image DOCKER_DEVICES
	export -a mount device container_args

	unset arg next
}  # _docker_parse

# shellcheck disable=SC2120
docker_run() {
	local -a mirrormountpoints=()
	local -a mirrormountpointsro=()
	local -a runargs=()
	local -a files=()
	local -A mountpoints=()
	local -A mountpointsro=()
	local -i skipped=0
	local -i runrc=0
	local mp='' src=''  # cwd=''
	local default_repo_path='' rw_repo_path=''
	local default_distdir_path='' default_pkgdir_path=''

	#${arr[@]+"${arr[@]}"}
	(( 0 == ${#args[@]} )) && args=( 'sh' )

	# shellcheck disable=SC2207
	runargs=(
		$(
			# shellcheck disable=SC2015
			if
				[[ "$( uname -s )" != 'Darwin' ]] &&
					(( $( nproc ) > 1 )) &&
					$_command info 2>&1 |
						grep -q -- 'cpuset'
			then
				echo "--cpuset-cpus 1-$(( $( nproc ) - 1 ))"
			fi
		)
		--init
		--name "${name}"
		--privileged
		#--network slirp4netns
		# Some code such as podman's go code tries to fetch packages from
		# IPv6-addressable hosts...
		--network host
		--pids-limit 1024
		$( add_arg rm --%% )
		--ulimit nofile=1024:1024
	)
	# shellcheck disable=SC2206,SC2207
	runargs+=(
		--entrypoint '/bin/sh'
		  ${DOCKER_DEVICES:-}
		  $( add_arg ACCEPT_KEYWORDS --env %% )
		  $( add_arg FEATURES --env %% )
		  $( add_arg TERM --env %% )
		  $( add_arg USE --env %% )
		--interactive
		--tty
		  ${DOCKER_EXTRA_MOUNTS:-}
		  ${DOCKER_VOLUMES:-}
	)
	if [[ -r /proc/cgroups ]] && grep -q -- '^memory.*1$' /proc/cgroups &&
		[[ -n "${PODMAN_MEMORY_RESERVATION:-}" || -n "${PODMAN_MEMORY_LIMIT}" || -n "${PODMAN_SWAP_LIMIT}" ]]
	then
		# shellcheck disable=SC2207
		runargs+=(
			$( add_arg PODMAN_MEMORY_RESERVATION --memory-reservation "${PODMAN_MEMORY_RESERVATION:-}" )
			$( add_arg PODMAN_MEMORY_LIMIT --memory "${PODMAN_MEMORY_LIMIT:-}" )
			$( add_arg PODMAN_SWAP_LIMIT --memory-swap "${PODMAN_SWAP_LIMIT:-}" )
		)
	fi

	# If 'portageq' is not available, then ensure that all of the variables
	# referenced immedaitely prior are set so that it never needs to be
	# called.
	#
	# For inspect.docker, mount additional repos read-write so that digest
	# generation, for example, isn't an extended and laborious task.
	#
	if ! type -pf portageq >/dev/null 2>&1; then
		default_repo_path='/var/db/repos/gentoo'
		rw_repo_path='/var/db/repos/srcshelton'
		default_distdir_path='/var/cache/portage/dist'
		default_pkgdir_path="/var/cache/portage/pkg/${ARCH:-"${arch}"}/${PKGHOST:-"docker"}"
		if [ ! -d /var/db/repos/gentoo ] && [ -d /var/db/repo/gentoo ]; then
			default_repo_path='/var/db/repo/gentoo'
			rw_repo_path='/var/db/repo/srcshelton'
		fi
		[ -d "${rw_repo_path:-}" ] ||
			rw_repo_path=''
	fi
	if [ -n "${PKGDIR_OVERRIDE:-}" ]; then
		default_pkgdir_path="${PKGDIR_OVERRIDE}"
	fi

	# shellcheck disable=SC2046,SC2206,SC2207
	mirrormountpointsro=(
		# We need write access to be able to update eclasses...
		#/etc/portage/repos.conf

		"${default_repo_path:-"$( # <- Syntax
			portageq get_repo_path "${EROOT:-"/"}" $(
				portageq get_repos "${EROOT:-"/"}"
			)
		)"}"

		/etc/locale.gen  # FIXME: Commented in common/run.sh?

		/usr/src  # Used to affect kernel-builds, now seems fine?
	)
	# shellcheck disable=SC2206
	mirrormountpoints=(
		#/var/cache/portage/dist
		"${default_distdir_path:-"$( portageq distdir )"}"
		${rw_repo_path:-}
		'/var/log/portage'
	)

	#ENV PKGDIR="${PKGCACHE:-"/var/cache/portage/pkg"}/${ARCH:-"amd64"}/${PKGHOST:-"docker"}"
	#local PKGCACHE="${PKGCACHE:="/var/cache/portage/pkg"}"
	#local PKGHOST="${PKGHOST:="docker"}"
	local PKGDIR="${PKGDIR:="${default_pkgdir_path:-"$( portageq pkgdir )"}"}"

	# Allow use of 'ARCH' variable as an override...
	print "Using architecture '${ARCH:-"${arch}"}' ..."
	mountpoints["${PKGDIR}"]="/var/cache/portage/pkg/${ARCH:-"${arch}"}/${PKGHOST:-"docker"}"
	mountpointsro['/etc/portage/repos.conf']='/etc/portage/repos.conf.host'
	[ -S /var/run/syslog-ng/log ] && mountpoints['/var/run/syslog-ng/log']='/dev/log'

	cwd="$( dirname "$( readlink -e "${BASH_SOURCE[$(( ${#BASH_SOURCE[@]} - 1 ))]}" )" )"
	print "Volume/mount base directory is '${cwd}'"
	mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/package.accept_keywords"]='/etc/portage/package.accept_keywords'
	if [ -s "${cwd}/${base_dir:+"${base_dir}/"}etc/portage/package.accept_keywords.${ARCH:-"${arch}"}" ]; then
		mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/package.accept_keywords.${ARCH:-"${arch}"}"]="/etc/portage/package.accept_keywords/${ARCH:-"${arch}"}"
	fi

	declare mask_file=''
	if [[ -n "${arch:-}" ]] &&
		[[ -f "${cwd}/${base_dir:+"${base_dir}/"}etc/portage/profile/use.mask.${arch}" ]]
	then
		mask_file="${cwd}/${base_dir:+"${base_dir}/"}etc/portage/profile/use.mask.${arch}"
	fi
	[[ -z "${mask_file:-}" ]] &&
		mask_file="${cwd}/${base_dir:+"${base_dir}/"}etc/portage/profile/use.mask"
	if [ -s "${mask_file}" ]; then
		mountpointsro["${mask_file}"]='/etc/portage/profile/use.mask'
	fi
	unset mask_file
	mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/profile/package.use.mask"]='/etc/portage/profile/package.use.force'
	mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/profile/package.use.mask"]='/etc/portage/profile/package.use.mask'
	mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/package.license"]='/etc/portage/package.license'
	mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/package.use.build"]='/etc/portage/package.use'
	#mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/package.unmask"]='/etc/portage/package.unmask'
	#mountpointsro["${cwd}/${base_dir:+"${base_dir}/"}etc/portage/package.unmask/package.unmask"]='/etc/portage/package.unmask/host.unmask'
	#if [ -s "/lib/modules/$( uname -r )/build/arch/x86/boot/vmlinux.bin" ]; then
	#	mountpointsro["/lib/modules/$( uname -r )/build/arch/x86/boot/vmlinux.bin"]="/boot/vmlinux-$( uname -r )"
	#fi
	if [ -s "/lib/modules/$( uname -r )/vmlinux-$( uname -r )" ]; then
		mirrormountpointsro+=( "/lib/modules/$( uname -r )/vmlinux-$( uname -r )" )
	fi

	local mps=''
	for mps in ${mirrormountpointsro[@]+"${mirrormountpointsro[@]}"}; do
		[ -n "${mps:-}" ] || continue
		for mp in ${mps}; do
			src="$( readlink -e "${mp}" )" || print "readlink() for mirrored read-only mountpoint '${mp}' failed: ${?}"
			if [ -z "${src:-}" ] || ! [ -e "${src}" ]; then
				warn "$( basename "${0}" ) skipping mountpoint '${mp}'"
				: $(( skipped = skipped + 1 ))
				continue
			fi
			runargs+=( --mount "type=bind,source=${src},destination=${mp}${docker_readonly:+",${docker_readonly}"}" )
		done
	done
	for mps in ${mirrormountpoints[@]+"${mirrormountpoints[@]}"}; do
		[ -n "${mps:-}" ] || continue
		for mp in ${mps}; do
			src="$( readlink -e "${mp}" )" || print "readlink() for mirrored mountpoint '${mp}' failed: ${?}"
			if [ -z "${src:-}" ] || ! [ -e "${src}" ]; then
				warn "$( basename "${0}" ) skipping mountpoint '${mp}'"
				: $(( skipped = skipped + 1 ))
				continue
			fi
			runargs+=( --mount "type=bind,source=${src},destination=${mp}" )
		done
	done
	for mps in ${mountpointsro[@]+"${!mountpointsro[@]}"}; do
		[ -n "${mps:-}" ] || continue
		for mp in ${mps}; do
			src="$( readlink -e "${mp}" )" || print "readlink() for read-only mountpoint '${mp}' failed: ${?}"
			if [ -z "${src:-}" ] || ! [ -e "${src}" ]; then
				warn "$( basename "${0}" ) skipping mountpoint '${mp}' -> '${mountpointsro[${mp}]}'"
				: $(( skipped = skipped + 1 ))
				continue
			fi
			runargs+=( --mount "type=bind,source=${src},destination=${mountpointsro[${mp}]}${docker_readonly:+",${docker_readonly}"}" )
		done
	done
	for mps in ${mountpoints[@]+"${!mountpoints[@]}"}; do
		[ -n "${mps:-}" ] || continue
		for mp in ${mps}; do
			src="$( readlink -e "${mp}" )" || print "readlink() for mountpoint '${mp}' failed (do you need to set 'PKGDIR'?): ${?}"
			if [ -z "${src:-}" ] || ! [ -e "${src}" ]; then
				warn "$( basename "${0}" ) skipping mountpoint '${mp}' -> '${mountpoints[${mp}]}'"
				: $(( skipped = skipped + 1 ))
				continue
			fi
			runargs+=( --mount "type=bind,source=${src},destination=${mountpoints[${mp}]}" )
		done
	done

	if [ $(( skipped )) -ge 1 ]; then
		warn "${skipped} mount-points not connected to container"
		sleep 5
	fi

	runargs+=( --mount 'type=tmpfs,destination=/run,ro=false,tmpfs-size=10M,tmpfs-mode=0755' )

	if (( ${#mount[@]} )); then
		for mp in "${mount[@]}"; do
			if [[ -n "${mp:-}" ]]; then
				print "Adding command line mount option '--mount ${mp}' ..."
				runargs+=( --mount "${mp}" )
			fi
		done
	fi

	unset src mps mp

	if [ -n "${DOCKER_VERBOSE:-}" ]; then
		output
		[ -n "${DOCKER_VARS:-}" ] && output "VERBOSE: DOCKER_VARS is '${DOCKER_VARS}'"
		local arg='' next=''
		for arg in "${runargs[@]}"; do
			case "${next}" in
				mount)
					arg="$( sed -r \
						-e 's/^type=/type: /' \
						-e 's/,(src|source)=/\tsource: /' \
						-e 's/,(dst|destination)=/\tdestination: /' \
						-e 's/, ro=true$/\tRO/' \
							<<<"${arg}")"
					output "VERBOSE: Mount point '${arg}'"
					;;
				volume)
					output "VERBOSE: Volume '${arg}'"
					;;
			esac
			if [[ "${arg}" =~ ^--(mount|volume)$ ]]; then
				next="${arg#"--"}"
			else
				next=''
			fi
		done | column -t -s $'\t'
		unset next arg
		output
	fi

	(
		if (( debug )); then
			local arg=''
			print "Starting container with command '$_command container run \\"
			for arg in "${runargs[@]}"; do
				case "${arg}" in
					--*)	print "    ${arg} \\" ;;
					*)		print "        ${arg} \\" ;;
				esac
			done
			print "  ${image}${*:+" \\"}"
			for arg in "${@:-}"; do
				[[ -n "${arg:-}" ]] && print "    ${arg} \\"
			done
			print "'"
			unset arg
			if touch inspect.docker.debug.log; then
				cat >inspect.docker.debug.log <<-EOF
					#! /bin/sh

					set -eux

				EOF
				printf >>inspect.docker.debug.log '%s container run \\\n' "${_command}"
				for arg in "${runargs[@]}"; do
					printf >>inspect.docker.debug.log '        %s \\\n' "${arg}"
				done
				unset arg
				printf >>inspect.docker.debug.log '    %s \\\n' "${image}"
				# Start at $1 as $0 is the command itself...
				local -i i=1
				for (( ; i < ${#} ; i++ )); do
					printf >>inspect.docker.debug.log '        %s \\\n' "${!i:-}"
				done
				# At this point i == ${#}...
				printf >>inspect.docker.debug.log '        %s\n' "${!i:-}"
				unset i
			fi
		fi
		# shellcheck disable=SC2086
		$_command \
				${DOCKER_VARS:-} \
			container run \
				"${runargs[@]}" \
			"${image}" -c "${args[@]}"
	)
	runrc=${?}

	for mp in \
		${mirrormountpointsro[@]+"${mirrormountpointsro[@]}"} \
		${mirrormountpoints[@]+"${mirrormountpoints[@]}"} \
		${mountpointsro[@]+"${!mountpointsro[@]}"} \
		${mountpoints[@]+"${!mountpoints[@]}"}
	do
		[ -n "${mp:-}" ] || continue
		files+=( "${mp}" )
	done
	for mp in ${mountpointsro[@]+"${!mountpointsro[@]}"}; do
		[ -n "${mp:-}" ] || continue
		mp="${mountpointsro[${mp}]}" || continue
		files+=( "${cwd}/${base_dir:+"${base_dir}"}${mp}" )
	done
	for mp in ${mountpoints[@]+"${!mountpoints[@]}"}; do
		[ -n "${mp:-}" ] || continue
		mp="${mountpoints[${mp}]}" || continue
		files+=( "${cwd}/${base_dir:+"${base_dir}"}${mp}" )
	done
	files+=( /etc/portage/package.accept_keywords/arm64 )
	for mp in "${files[@]}"; do
		src="$( readlink -e "${mp}" )"
		if [ -n "${src:-}" ]; then
			if [[ -f "${src}" && "$( stat -c '%s %u %a' "${src}" )" == '0 0 700' ]]; then
				warn "Artefact '${src}' detected - removing"
				rm -f "${src}"
			fi
		fi
	done
	unset files

	for oom in oom "${cwd}/${base_dir:+"${base_dir}/"}oom"; do
		src="$( readlink -e "${oom}" )"
		if [ -n "${src:-}" ]; then
			if [[ -f "${src}" && "$( stat -c '%s %u %a' "${src}" )" == '0 0 644' ]]; then
				warn "Artefact '${src}' detected - removing"
				rm -f "${src}"
			fi
		fi
	done

	# shellcheck disable=SC2086
	return ${runrc}
}  # docker_run

docker_trap() {
	trap '' INT
	podman ${@+"${@}"}
	trap - INT
}  # docker_trap

main() {
	local arg=''
	local -a main_args=()

	# N.B. _docker_parse does most of the argument-parsing...
	if [[ -n "${*:-}" ]]; then
		for arg in "${@:-}"; do
			case "${arg:-}" in
				--memory-reservation=*)
					PODMAN_MEMORY_RESERVATION="${arg#*"="}"
					;;
				--memory-limit=*)
					PODMAN_MEMORY_LIMIT="${arg#*"="}"
					;;
				--swap-limit=*)
					PODMAN_SWAP_LIMIT="${arg#*"="}"
					;;
				*)
					main_args+=( "${arg}" )
					;;
			esac
		done
		set -- "${main_args[@]:-}"
		#print "args: (${#}) '${*:-}'"
	fi
	unset main_args arg

	if [[ -d /proc ]] && [[ -z "${NO_MEMORY_LIMITS:-}" ]]; then
		# Tiny
		#: "${PODMAN_MEMORY_RESERVATION:="256m"}"
		#: "${PODMAN_MEMORY_LIMIT:="512m"}"
		#: "${PODMAN_SWAP_LIMIT:="1g"}"
		# Small
		#: "${PODMAN_MEMORY_RESERVATION:="512m"}"
		#: "${PODMAN_MEMORY_LIMIT:="1g"}"
		#: "${PODMAN_SWAP_LIMIT:="2g"}"
		# Medium
		#: "${PODMAN_MEMORY_RESERVATION:="1g"}"
		#: "${PODMAN_MEMORY_LIMIT:="2g"}"
		#: "${PODMAN_SWAP_LIMIT:="4g"}"
		# Large
		#: "${PODMAN_MEMORY_RESERVATION:="2g"}"
		#: "${PODMAN_MEMORY_LIMIT:="4g"}"
		#: "${PODMAN_SWAP_LIMIT:="8g"}"
		# Extra-Large
		#: "${PODMAN_MEMORY_RESERVATION:="4g"}"
		#: "${PODMAN_MEMORY_LIMIT:="8g"}"
		#: "${PODMAN_SWAP_LIMIT:="16g"}"
		#
		#: "${PODMAN_MEMORY_RESERVATION:="4g"}"
		#: "${PODMAN_MEMORY_LIMIT:="6g"}"
		#
		# See comments in common/vars.sh...
		#
		: "${PODMAN_MEMORY_RESERVATION:="2g"}"
		: "${PODMAN_MEMORY_LIMIT:="6g"}"
		: "${PODMAN_SWAP_LIMIT:="${PODMAN_MEMORY_LIMIT}"}"

		# FIXME: Assume that PODMAN_{SWAP_LIMIT,MEMORY_{LIMIT,RESERVATION}}
		#        have the same order of magnitude...
		local -i swp=0 ram=0 changed=0
		local unit='' divider=''
		case "${PODMAN_MEMORY_LIMIT^^}" in
			*M)
				unit='m'
				divider='1024'
				;;
			*G)
				unit='g'
				divider='1024 / 1024'
				;;
		esac
		if [[ -n "${unit:-}" ]]; then
			# shellcheck disable=SC2004
			eval swp=$(( ( $( grep -m 1 'SwapTotal:' /proc/meminfo | awk '{ print $2 }' ) + 16 ) / ${divider} ))
			# shellcheck disable=SC2004
			eval ram=$(( $( grep -m 1 'MemTotal:' /proc/meminfo | awk '{ print $2 }' ) / ${divider} ))
			# shellcheck disable=SC2295
			if (( ram < ${PODMAN_MEMORY_LIMIT%[${unit,,}${unit^^}]} )) || (( ( ram + swp ) < ${PODMAN_SWAP_LIMIT%[${unit,,}${unit^^}]} )); then
				output >&2 "INFO:  Host resources (rounded down to nearest 1${unit^^}iB):"
				output >&2 "         RAM:        ${ram}${unit^^}"
				output >&2 "         Swap:       ${swp}${unit^^}"
				output >&2 'INFO:  Original memory limits:'
				# shellcheck disable=SC2295
				output >&2 "         Soft limit: ${PODMAN_MEMORY_RESERVATION%[${unit,,}${unit^^}]}${unit^^}"
				# shellcheck disable=SC2295
				output >&2 "         Hard limit: ${PODMAN_MEMORY_LIMIT%[${unit,,}${unit^^}]}${unit^^}"
				# shellcheck disable=SC2295
				output >&2 "         RAM + Swap: ${PODMAN_SWAP_LIMIT%[${unit,,}${unit^^}]}${unit^^}"
			fi
			# shellcheck disable=SC2295
			if (( ram < ${PODMAN_MEMORY_LIMIT%[${unit,,}${unit^^}]} )); then
				PODMAN_MEMORY_RESERVATION="$(( ram - 1 ))${unit,,}"
				PODMAN_MEMORY_LIMIT="$(( ram ))${unit,,}"
				#PODMAN_SWAP_LIMIT="$(( ram + swp ))${unit,,}"
				if (( ram <= 1 )); then
					PODMAN_SWAP_LIMIT="$(( ram * 2 ))${unit,,}"
				else
					PODMAN_SWAP_LIMIT="$(( ram + $(
						awk -v ram="${ram}" 'BEGIN{ print int( sqrt( ram ) + 0.5 ) }'
					) ))${unit,,}"
				fi
				changed=1
			fi
			# shellcheck disable=SC2295
			if (( ( ram + swp ) < ${PODMAN_SWAP_LIMIT%[${unit,,}${unit^^}]} )); then
				#PODMAN_SWAP_LIMIT="$(( ram + swp ))${unit,,}"
				if (( ram <= 1 )); then
					PODMAN_SWAP_LIMIT="$(( ram * 2 ))${unit,,}"
				else
					PODMAN_SWAP_LIMIT="$(( ram + $(
						awk -v ram="${ram}" 'BEGIN{ print int( sqrt( ram ) + 0.5 ) }'
					) ))${unit,,}"
				fi
				changed=1
			fi
			if (( changed )); then
				output >&2 'NOTE:  Changed memory limits based on host configuration:'
				# shellcheck disable=SC2295
				output >&2 "         Soft limit: ${PODMAN_MEMORY_RESERVATION%[${unit,,}${unit^^}]}${unit^^}"
				# shellcheck disable=SC2295
				output >&2 "         Hard limit: ${PODMAN_MEMORY_LIMIT%[${unit,,}${unit^^}]}${unit^^}"
				# shellcheck disable=SC2295
				output >&2 "         RAM + Swap: ${PODMAN_SWAP_LIMIT%[${unit,,}${unit^^}]}${unit^^}"
				output >&2
			fi
		fi
		unset changed ram swp divider unit
	fi

	declare rm=''

	_docker_setup
	_docker_parse ${@+"${@}"}

	image="${image:-"${IMAGE}"}"
	# shellcheck disable=SC2001 # POSIX sh compatibility
	name="${name:-"$( echo "${image}" | sed 's|[:/]|_|g' )-inspect"}"

	if [ -n "${rm:-}" ]; then
		docker_trap rm --volumes "${name}" 2>/dev/null || :
	fi

	local -i rc=0

	output >&2 "Launching container '${name}' from image '${image}' ..."

	#set -o xtrace
	docker_run "${container_args[@]:-}" || rc=${?}

	#if [ -n "${rm:-}" ]; then
	#	docker_trap rm --volumes "${name}"
	#fi

	return ${rc}
}  # main

main "${@:-}"
exit ${?}

# vi: set colorcolumn=80 foldmarker=()\ {,}\ \ #\  foldmethod=marker syntax=bash: