Support running plugins in isolated containers (#22712)

Implements running plugins in containers to give them some degree
of isolation from the main Vault process and other plugins. It only
supports running on Linux initially, where it is easiest to manage unix
socket communication across the container boundary.

Additionally

* Adds -env arg to vault plugin register.
* Don't return env from 'vault plugin info'

Historically it's been omitted, and it could conceivably have secret information in
it, so if we want to return it in the response, it should probably only be via explicit
opt-in. Skipping for now though as it's not the main purpose of the commit.

sdk/helper/pluginutil/run_config.go

@@ -8,10 +8,16 @@ import (
 	"crypto/sha256"
 	"crypto/tls"
 	"fmt"
+	"os"
 	"os/exec"
+	"strings"
 
+	"github.com/hashicorp/go-hclog"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
+	"github.com/hashicorp/go-plugin/runner"
+	"github.com/hashicorp/go-secure-stdlib/plugincontainer"
+	"github.com/hashicorp/go-secure-stdlib/plugincontainer/config"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 )
 
@@ -30,9 +36,11 @@ type PluginClientConfig struct {
 
 type runConfig struct {
 	// Provided by PluginRunner
-	command string
-	args    []string
-	sha256  []byte
+	command  string
+	image    string
+	imageTag string
+	args     []string
+	sha256   []byte
 
 	// Initialized with what's in PluginRunner.Env, but can be added to
 	env []string
@@ -40,6 +48,18 @@ type runConfig struct {
 	PluginClientConfig
 }
 
+func overlayCmdSpec(base, cmd *exec.Cmd) {
+	if cmd.Path != "" {
+		base.Path = cmd.Path
+	}
+	if len(cmd.Args) > 0 {
+		base.Args = cmd.Args
+	}
+	if len(cmd.Env) > 0 {
+		base.Env = append(base.Env, cmd.Env...)
+	}
+}
+
 func (rc runConfig) makeConfig(ctx context.Context) (*plugin.ClientConfig, error) {
 	cmd := exec.Command(rc.command, rc.args...)
 	cmd.Env = append(cmd.Env, rc.env...)
@@ -88,16 +108,9 @@ func (rc runConfig) makeConfig(ctx context.Context) (*plugin.ClientConfig, error
 		cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", PluginUnwrapTokenEnv, wrapToken))
 	}
 
-	secureConfig := &plugin.SecureConfig{
-		Checksum: rc.sha256,
-		Hash:     sha256.New(),
-	}
-
 	clientConfig := &plugin.ClientConfig{
 		HandshakeConfig:  rc.HandshakeConfig,
 		VersionedPlugins: rc.PluginSets,
-		Cmd:              cmd,
-		SecureConfig:     secureConfig,
 		TLSConfig:        clientTLSConfig,
 		Logger:           rc.Logger,
 		AllowedProtocols: []plugin.Protocol{
@@ -106,6 +119,36 @@ func (rc runConfig) makeConfig(ctx context.Context) (*plugin.ClientConfig, error
 		},
 		AutoMTLS: rc.AutoMTLS,
 	}
+	if rc.image == "" {
+		clientConfig.Cmd = cmd
+		clientConfig.SecureConfig = &plugin.SecureConfig{
+			Checksum: rc.sha256,
+			Hash:     sha256.New(),
+		}
+	} else {
+		clientConfig.SkipHostEnv = true
+		clientConfig.RunnerFunc = func(logger hclog.Logger, goPluginCmd *exec.Cmd, tmpDir string) (runner.Runner, error) {
+			overlayCmdSpec(goPluginCmd, cmd)
+			cfg := &config.ContainerConfig{
+				UnixSocketGroup: fmt.Sprintf("%d", os.Getgid()),
+				Image:           rc.image,
+				Tag:             rc.imageTag,
+				SHA256:          fmt.Sprintf("%x", rc.sha256),
+				Labels: map[string]string{
+					"managed-by": "hashicorp.com/vault",
+				},
+				// TODO: More configurables.
+				// Defaulting to runsc will require installing gVisor in the GitHub runner.
+				// Runtime:         "runsc",
+				// CgroupParent: "",
+				// NanoCpus: 100000000,
+				// Memory: 64 * 1024 * 1024,
+				// TODO: network
+
+			}
+			return plugincontainer.NewContainerRunner(logger, goPluginCmd, cfg, tmpDir)
+		}
+	}
 	return clientConfig, nil
 }
 
@@ -170,11 +213,18 @@ func MLock(mlock bool) RunOpt {
 }
 
 func (r *PluginRunner) RunConfig(ctx context.Context, opts ...RunOpt) (*plugin.Client, error) {
+	var image, imageTag string
+	if r.OCIImage != "" {
+		image = r.OCIImage
+		imageTag = strings.TrimPrefix(r.Version, "v")
+	}
 	rc := runConfig{
-		command: r.Command,
-		args:    r.Args,
-		sha256:  r.Sha256,
-		env:     r.Env,
+		command:  r.Command,
+		image:    image,
+		imageTag: imageTag,
+		args:     r.Args,
+		sha256:   r.Sha256,
+		env:      r.Env,
 	}
 
 	for _, opt := range opts {