Generate RDP password at startup - #2
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the Hatch container startup flow to auto-generate an RDP password when RDP_PASSWORD is not provided, and updates runtime UX/docs to support retrieving the generated credentials.
Changes:
- Generate an RDP password at container startup when
RDP_PASSWORDis omitted and surface credentials via container logs and an in-container credentials file. - Add a dedicated login shell banner displayed in the xterm session launched by the XRDP session window manager.
- Update Compose and documentation to reflect the generated-password flow (no longer requiring
RDP_PASSWORDto be set up-front).
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/entrypoint.sh | Generates password when missing; writes/logs credentials during container startup |
| README.md | Updates run instructions to rely on generated password and docker logs |
| INSTALL.md | Updates install/start/verification steps for generated-password flow |
| Dockerfile | Installs new login shell script into the image and marks it executable |
| docker-compose.yml | Makes RDP_PASSWORD optional to enable auto-generation |
| config/startwm.sh | Launches xterm using the new hatch-login-shell entrypoint |
| config/login-shell.sh | New script that prints a Hatch banner and execs a login bash shell |
| .env.example | Documents leaving RDP_PASSWORD blank to auto-generate |
Suppressed comments (2)
scripts/entrypoint.sh:17
- The credentials file always labels the timestamp as "Generated:" even when the password was provided via
RDP_PASSWORD. This is misleading; rename it to a neutral label (or make it conditional).
echo "Generated: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
scripts/entrypoint.sh:11
chpasswdconsumesuser:passwordlines; if a user-suppliedRDP_PASSWORDcontains ':' or a newline, the input format breaks and can set an unintended password. ValidateRDP_PASSWORDbefore piping it intochpasswd.
if ! id "$RDP_USER" >/dev/null 2>&1; then useradd --create-home --shell /bin/bash "$RDP_USER"; fi
printf '%s:%s\n' "$RDP_USER" "$RDP_PASSWORD" | chpasswd
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+6
to
+9
| if [ -z "${RDP_PASSWORD:-}" ]; then | ||
| RDP_PASSWORD="$(openssl rand -hex 24)" | ||
| GENERATED_PASSWORD=1 | ||
| fi |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
scripts/entrypoint.sh:9
entrypoint.shnow relies onopenssl randto generate a password whenRDP_PASSWORDis unset, but the image build does not explicitly install theopensslCLI. Ifopensslis missing at runtime, the entrypoint will exit (due toset -e) and the container won't start. Consider adding a fallback that does not depend on openssl (e.g.,/dev/urandom+od), or explicitly installopensslin the image.
if [ -z "${RDP_PASSWORD:-}" ]; then
RDP_PASSWORD="$(openssl rand -hex 24)"
GENERATED_PASSWORD=1
fi
Comment on lines
+18
to
+23
| { | ||
| echo "Hatch RDP credentials" | ||
| echo "Generated: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" | ||
| echo "RDP user: $RDP_USER" | ||
| echo "RDP password: $RDP_PASSWORD" | ||
| } > /var/log/hatch/rdp-credentials.log |
Comment on lines
+47
to
+49
| location = / { | ||
| return 302 https://\$http_host/guacamole/; | ||
| } |
Comment on lines
+22
to
+27
| { | ||
| echo "Hatch RDP credentials" | ||
| echo "Written: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" | ||
| echo "RDP user: $RDP_USER" | ||
| echo "RDP password: $RDP_PASSWORD" | ||
| } > /var/log/hatch/rdp-credentials.log |
Comment on lines
+37
to
+43
| if [ "$GENERATED_PASSWORD" -eq 1 ]; then | ||
| echo "Generated RDP password: $RDP_PASSWORD" | ||
| echo "Generated RDP credentials were also written to /var/log/hatch/rdp-credentials.log" | ||
| else | ||
| echo "Using RDP password from RDP_PASSWORD" | ||
| echo "RDP credentials were also written to /var/log/hatch/rdp-credentials.log" | ||
| fi |
Comment on lines
+18
to
+20
| install -d -m 0755 /etc/hatch | ||
| printf '%s\n' "${HATCH_START_URL:-about:blank}" > /etc/hatch/start-url | ||
| chmod 0644 /etc/hatch/start-url |
| libwebsockets-dev \ | ||
| uuid-dev \ | ||
| wget \ | ||
| && wget -O /tmp/guacamole-server.tar.gz "https://archive.apache.org/dist/guacamole/${GUACAMOLE_VERSION}/source/guacamole-server-${GUACAMOLE_VERSION}.tar.gz" \ |
| set -eu | ||
| pgrep -x nginx >/dev/null | ||
| pgrep -x guacd >/dev/null | ||
| pgrep -f 'org.apache.catalina.startup.Bootstrap' >/dev/null |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.
Suppressed comments (3)
Previously missed (3) — in code that hasn't changed since the last review.
Dockerfile:37
GUACAMOLE_VERSIONis parameterized for the guacd build, but theguacamole-webstage is pinned toguacamole/guacamole:1.6.0. IfGUACAMOLE_VERSIONis changed later, guacd and the webapp can silently drift to different versions.
FROM guacamole/guacamole:1.6.0 AS guacamole-web
FROM debian:12-slim
scripts/entrypoint.sh:51
- When
RDP_PASSWORDis generated (GENERATED_PASSWORD=1), the startup logs never print the actual generated RDP password—unless Guacamole happens to reuse it. IfGUAC_USER/GUAC_PASSWORDare set to custom values, the log line saying generated credentials were printed becomes misleading, and users running detached won’t be able to retrieve the generated RDP password from logs.
if [ "$GENERATED_PASSWORD" -eq 1 ]; then
echo "Generated RDP credentials were printed as Guacamole credentials and written to /var/log/hatch/rdp-credentials.log"
else
echo "Using RDP password from RDP_PASSWORD"
echo "RDP credentials were also written to /var/log/hatch/rdp-credentials.log"
scripts/e2e-guacamole.sh:124
- This check embeds the URL into a
pgrepregex inside single quotes. URLs can contain regex metacharacters (e.g.,.) and may also contain quotes if overridden via env, which can cause false positives/negatives or break the command. Prefer passing the URL via an env var and using fixed-string matching.
if docker exec "${PREFIX}-hatch" sh -lc "pgrep -af 'chromium.*${URL}' >/dev/null"; then
Comment on lines
7
to
11
| HTTPS_PORT_HEX="$(printf '%04X' "${HATCH_HTTPS_PORT:-443}")" | ||
| grep -qi ":$HTTPS_PORT_HEX " /proc/net/tcp /proc/net/tcp6 2>/dev/null | ||
| grep -qi ':1F90 ' /proc/net/tcp /proc/net/tcp6 2>/dev/null | ||
| grep -qi ':12D6 ' /proc/net/tcp /proc/net/tcp6 2>/dev/null | ||
| grep -qi ':0D3D ' /proc/net/tcp /proc/net/tcp6 2>/dev/null |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification