cloudflare / cloudflare/cloudflared
Windows: '--portable' command-line directive for binary-relative paths
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
Inspired by feature request #1539 for more-secure file‑based (quick) tunnel configurations, I would like to propose a `--portable` switch for Windows builds.
When `cloudflared` is launched via the the Service Control Manager (SCM), the SCM sets the initial working directory to `%SystemRoot%\System32`. This prevents the use of drive‑relative rooted paths (e.g. `\srv\cloudflare\...`), which would otherwise allow configurations to survive drive‑letter changes — a common scenario after OS reinstalls or storage layout changes.
The proposed `--portable` switch could trigger `cloudflared` to set its active/working directory, at the earliest possible timing, to where the executable itself resides. This behaviour could be on a opt‑in basis and would mitigate breaking existing setups.
While the path to the executable must remain absolute, allowing drive‑relative paths everywhere else reduces the risk of breakages when drive letters change.
## Example 1
### Config
```cmd
"X:\bin\cloudflared.exe" --portable --config="/srv/cloudflare/tunnel.yml" tunnel run
```
Resolves to `X:\srv\cloudflare\tunnel.yml`.
### Credentials
```yml
tunnel: ...
credentials-file: /srv/cloudflare/tunnel.json
ingress:
- service: http://127.0.0.1
```
Resolves to `X:\srv\cloudflare\tunnel.json`.
## Example 2
### Config
```cmd
"C:\Program Files\Cloudflared\cloudflared.exe" --portable --config="tunnel.yml" tunnel run
```
Resolves to `C:\Program Files\Cloudflared\tunnel.yml`.
### Credentials
```yml
tunnel: ...
credentials-file: tunnel.json
ingress:
- service: http://127.0.0.1
```
Resolves to `C:\Program Files\Cloudflared\tunnel.json`.
Contributor guide
Assessment
This issue has not been assessed yet.