incus.shell

#!/bin/bash
set -euo pipefail
CONTAINER="${1:-${CLAUDE_CONTAINER:-}}"
if [[ -z "$CONTAINER" ]]; then
  echo "Usage: $(basename "$0") <container> [command...]"
  exit 1
fi
STATUS=$(incus list "^${CONTAINER}$" --format csv --columns s 2>/dev/null)
if [[ -z "$STATUS" ]]; then
  echo "Container not found: $CONTAINER" >&2
  exit 1
fi
if [[ "$STATUS" != "RUNNING" ]]; then
  echo "Starting $CONTAINER..."
  incus start "$CONTAINER"
  attempts=0
  while ! timeout 5 incus exec "$CONTAINER" -- true </dev/null &>/dev/null; do
    sleep 1
    attempts=$((attempts + 1))
    if [[ $attempts -ge 30 ]]; then
      echo "Timed out waiting for $CONTAINER to be ready" >&2
      exit 1
    fi
  done
fi

HOST_USER="$(id -un)"
HOST_UID="$(id -u)"
HOST_GID="$(id -g)"

# We use --user/--group instead of `su -` so incus manages the PTY
# end-to-end (no signal-intercepting middleman that kills the session
# on Ctrl+C).  However, --group only sets the primary GID — supplementary
# groups (e.g. docker) are not loaded.  To fix this we ask the container
# to resolve the user's supplementary groups and pass them via --group.
SUPP_GIDS=$(incus exec "$CONTAINER" -- id -G "$HOST_USER" 2>/dev/null | tr ' ' ',')
GROUP_FLAGS=()
if [[ -n "$SUPP_GIDS" ]]; then
  for gid in ${SUPP_GIDS//,/ }; do
    GROUP_FLAGS+=(--group "$gid")
  done
else
  GROUP_FLAGS=(--group "$HOST_GID")
fi

if [[ $# -gt 1 ]]; then
  shift
  exec incus exec "$CONTAINER" \
    --user "$HOST_UID" "${GROUP_FLAGS[@]}" \
    --cwd /workspace \
    --env "HOME=/home/$HOST_USER" \
    --env "USER=$HOST_USER" \
    -- zsh -lic "$*"
else
  exec incus exec "$CONTAINER" \
    --user "$HOST_UID" "${GROUP_FLAGS[@]}" \
    --cwd /workspace \
    --env "HOME=/home/$HOST_USER" \
    --env "USER=$HOST_USER" \
    -- zsh -li
fi