gather-info: remove environment vars and sensor docker inspect vars

Author: Banshee1221

customers/gather-info.sh

@@ -271,6 +271,97 @@ save_command() {
     log_verbose "Saved: $filename"
 }
 
+sanitize_docker_inspect() {
+    # Sanitize docker inspect JSON output by removing environment variable values
+    # Input: JSON from docker inspect (via stdin)
+    # Output: Sanitized JSON with env var values replaced with "[REDACTED]"
+    local temp_file
+    temp_file=$(mktemp)
+    local sanitized_file="${temp_file}.sanitized"
+    
+    # Read stdin into temp file
+    if ! cat > "$temp_file" 2>/dev/null || [[ ! -s "$temp_file" ]]; then
+        rm -f "$temp_file"
+        return 1
+    fi
+    
+    # Try using jq first (most reliable for JSON manipulation)
+    if command_exists jq; then
+        # Handle both array and single object responses from docker inspect
+        # Walk through the JSON and sanitize all Env arrays
+        if jq -c 'if type == "array" then 
+            map(walk(if type == "object" and has("Env") then 
+                .Env = (.Env | if type == "array" then 
+                    map(if type == "string" and contains("=") then 
+                        (split("=")[0] + "=[REDACTED]") 
+                    else . end)
+                else . end)
+            else . end))
+        else 
+            walk(if type == "object" and has("Env") then 
+                .Env = (.Env | if type == "array" then 
+                    map(if type == "string" and contains("=") then 
+                        (split("=")[0] + "=[REDACTED]") 
+                    else . end)
+                else . end)
+            else . end)
+        end' "$temp_file" 2>/dev/null > "$sanitized_file"; then
+            # Verify output is non-empty and looks like JSON
+            if [[ -s "$sanitized_file" ]] && grep -qE '[\[\{]' "$sanitized_file" 2>/dev/null; then
+                cat "$sanitized_file"
+                rm -f "$sanitized_file" "$temp_file"
+                return 0
+            fi
+            rm -f "$sanitized_file"
+        fi
+    fi
+    
+    # Fallback: Use sed for pattern-based sanitization
+    # Match patterns like: "KEY=VALUE" within JSON strings
+    # This regex: "KEY=anything" becomes "KEY=[REDACTED]"
+    if sed -E 's/"([A-Za-z_][A-Za-z0-9_]*)=([^"]*)"/"\1=[REDACTED]"/g' "$temp_file" 2>/dev/null > "$sanitized_file"; then
+        # Verify the output is still valid JSON-like (has braces/brackets)
+        if [[ -s "$sanitized_file" ]] && grep -qE '[\[\{]' "$sanitized_file" 2>/dev/null; then
+            cat "$sanitized_file"
+            rm -f "$sanitized_file" "$temp_file"
+            return 0
+        fi
+        rm -f "$sanitized_file"
+    fi
+    
+    # Last resort: Use perl for more reliable pattern matching (if available)
+    if command_exists perl; then
+        if perl -pe 's/"([A-Za-z_][A-Za-z0-9_]*)=([^"]*)"/"$1=[REDACTED]"/g' "$temp_file" 2>/dev/null > "$sanitized_file"; then
+            if [[ -s "$sanitized_file" ]] && grep -qE '[\[\{]' "$sanitized_file" 2>/dev/null; then
+                cat "$sanitized_file"
+                rm -f "$sanitized_file" "$temp_file"
+                return 0
+            fi
+            rm -f "$sanitized_file"
+        fi
+    fi
+    
+    # If all sanitization methods fail, use simple sed as absolute fallback
+    # This is a best-effort attempt that may not catch all cases
+    if sed 's/=[^",]*"/=[REDACTED]"/g' "$temp_file" 2>/dev/null > "$sanitized_file"; then
+        if [[ -s "$sanitized_file" ]]; then
+            # Prepend warning comment (outside JSON) if possible
+            # For JSON arrays/objects, we can't easily add comments, so we'll just return it
+            cat "$sanitized_file"
+            rm -f "$sanitized_file" "$temp_file"
+            # Return 1 to indicate fallback was used (caller can log warning if needed)
+            return 1
+        fi
+    fi
+    
+    # Absolute last resort: return original with minimal sanitization attempt
+    # Log to stderr so it doesn't pollute the JSON output
+    echo "# WARNING: Environment variable sanitization may be incomplete. Some sensitive data may remain." >&2
+    cat "$temp_file"
+    rm -f "$temp_file"
+    return 1
+}
+
 #-------------------------------------------------------------------------------
 # Early Detection Functions
 #-------------------------------------------------------------------------------
@@ -1049,9 +1140,29 @@ collect_docker_info() {
 
             log_info "  → ${container_name} (${container_image})"
 
-            # Container inspect
-            save_command "docker/vllm_logs/${container_name}_inspect.json" "root" \
-                docker inspect "$container_id"
+            # Container inspect (with environment variable sanitization)
+            local inspect_output sanitized_output sanitize_status
+            inspect_output=$(run_cmd "root" docker inspect "$container_id" 2>&1)
+            if [[ -n "$inspect_output" ]]; then
+                # Sanitize the output
+                sanitized_output=$(echo "$inspect_output" | sanitize_docker_inspect 2>&1)
+                sanitize_status=$?
+                
+                {
+                    echo "# Command: docker inspect $container_id"
+                    echo "# Timestamp: $(date -Iseconds)"
+                    echo "# Requires root: root"
+                    if [[ $sanitize_status -eq 0 ]]; then
+                        echo "# Note: Environment variable values have been sanitized"
+                    else
+                        echo "# WARNING: Environment variable sanitization may be incomplete"
+                        echo "# Consider installing 'jq' for reliable JSON sanitization"
+                    fi
+                    echo "---"
+                    echo "$sanitized_output"
+                } > "${WORK_DIR}/docker/vllm_logs/${container_name}_inspect.json" 2>&1
+                log_verbose "Saved: docker/vllm_logs/${container_name}_inspect.json (sanitized)"
+            fi
 
             # Container logs (last 10000 lines to avoid massive files)
             save_command "docker/vllm_logs/${container_name}_logs.txt" "root" \
@@ -1349,10 +1460,6 @@ collect_package_info() {
 collect_additional_info() {
     print_section "Additional System Information"
 
-    print_subsection "Environment"
-    save_command "system/environment.txt" "noroot" env
-    log_info "Environment variables"
-    
     print_subsection "Loaded Kernel Modules"
     save_command "system/lsmod.txt" "noroot" lsmod
     log_info "Kernel modules"