bug: templates using sh -c inlining for init_script are vulnerable to quoting breakage
- Dominant language
- HCL
- Stars
- 79
- Forks
- 161
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 38
Description
## Problem
Several templates inline the agent init script via:
```bash
sudo -u '${linux_user}' sh -c '${init_script}'
```
This pattern is fragile: if the upstream bootstrap script (`provisionersdk/scripts/bootstrap_linux.sh` in [coder/coder](https://github.com/coder/coder)) ever contains a single quote (apostrophe), the shell quoting breaks silently. The agent fails to start with no clear error.
This just happened — see https://github.com/coder/coder/issues/22062. A comment containing `exec'ing` was added to the bootstrap script, breaking all templates using this pattern.
## Affected templates
```
coder/templates/aws-linux — cloud-init/userdata.sh.tftpl
coder/templates/gcp-linux — main.tf (metadata_startup_script)
mossylion/templates/scaleway-instance — cloud-init/userdata.sh.tftpl
ericpaulsen/templates/k8s-username — main.tf
```
## Templates already using safe patterns
These templates write the init script as file content via cloud-config `write_files` or similar, avoiding the quoting issue entirely:
```
coder/templates/azure-linux — cloud-init write_files + systemd
coder/templates/digitalocean-linux — cloud-init write_files
```
## Proposed fix
Update the affected templates to use the same `write_files` approach as `azure-linux` and `digitalocean-linux`. Instead of inlining the script into `sh -c '...'`, write it to a file and execute it:
```yaml
write_files:
- path: /opt/coder/init
permissions: "0755"
encoding: b64
content: ${init_script}
```
Then execute via a systemd unit or `runcmd`:
```yaml
runcmd:
- sudo -u ${linux_user} /opt/coder/init
```
This is immune to quoting issues since the script content is base64-encoded and written as a file rather than inlined into a shell command.
## Related
- https://github.com/coder/coder/issues/22062 — upstream fix + CI lint to prevent single quotes in bootstrap scripts
Contributor guide
Assessment
This issue has not been assessed yet.