From 546a38c4b991e9e7f0bc0c175f26b000ba66c233 Mon Sep 17 00:00:00 2001 From: J0kkeR Date: Fri, 9 Oct 2026 22:44:57 +0800 Subject: [PATCH] fix(sandbox): skip certutil -N when the NSS DB already exists certutil -N only skips its password prompt when it creates a fresh database. When the sandbox container is restarted, the NSS DB from the first run already exists, so certutil -N asks for the existing password and - with no TTY attached - spins forever in an "Invalid password. Try again." loop, burning a full core and blocking the rest of the entrypoint (the CA trust import never runs). Guard the call with a cert9.db existence check, the same approach mkcert uses (FiloSottile/mkcert#558). certutil -A re-import under the same nickname is safe to repeat, so restarts now complete cleanly. --- containers/docker-entrypoint.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/containers/docker-entrypoint.sh b/containers/docker-entrypoint.sh index e4f472d6..f13e54bf 100644 --- a/containers/docker-entrypoint.sh +++ b/containers/docker-entrypoint.sh @@ -119,7 +119,13 @@ echo "✅ System-wide proxy configuration complete" echo "Adding CA to browser trust store..." sudo -u pentester mkdir -p /home/pentester/.pki/nssdb -sudo -u pentester certutil -N -d sql:/home/pentester/.pki/nssdb --empty-password +# certutil -N only skips its password prompt when it creates a fresh database. +# Against an already-initialized one it asks for the existing password, which — +# with no TTY attached — spins forever in an "Invalid password. Try again." +# loop and blocks the rest of the entrypoint on container restarts. +if [ ! -f /home/pentester/.pki/nssdb/cert9.db ]; then + sudo -u pentester certutil -N -d sql:/home/pentester/.pki/nssdb --empty-password +fi sudo -u pentester certutil -A -n "Testing Root CA" -t "C,," -i /app/certs/ca.crt -d sql:/home/pentester/.pki/nssdb echo "✅ CA added to browser trust store"