fix: propagate child process exit code

Both LandJail.Run() and NSJailManager.Run() always returned nil,
discarding the child process exit code. The landjail child also
wrapped exit codes in fmt.Errorf() instead of calling os.Exit().

Changes:
- Add exitcode.Error type to carry exit codes through the error chain
- Fix landjail child to call os.Exit(exitCode), matching nsjail behavior
- Fix both managers to capture child errors via a channel and return
  exitcode.Error from Run()
- Fix main.go to extract exitcode.Error before defaulting to os.Exit(1)
- Change NSJailManager.RunChildProcess to return error (was void)

Fixes #190

Author: mtojek

cmd/boundary/main.go

@@ -1,8 +1,10 @@
 package main
 
 import (
+	"errors"
 	"fmt"
 	"os"
+	"os/exec"
 
 	"github.com/coder/boundary/cli"
 )
@@ -17,6 +19,10 @@ func main() {
 
 	err := cmd.Invoke().WithOS().Run()
 	if err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			os.Exit(exitErr.ExitCode())
+		}
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
 	}

landjail/child.go

@@ -61,15 +61,12 @@ func RunChild(logger *slog.Logger, config config.AppConfig) error {
 	// Run the command - this will block until it completes
 	err = cmd.Run()
 	if err != nil {
-		// Check if this is a normal exit with non-zero status code
 		if exitError, ok := err.(*exec.ExitError); ok {
-			exitCode := exitError.ExitCode()
-			logger.Debug("Command exited with non-zero status", "exit_code", exitCode)
-			return fmt.Errorf("command exited with code %d", exitCode)
+			logger.Debug("Command exited with non-zero status", "exit_code", exitError.ExitCode())
+		} else {
+			logger.Error("Command execution failed", "error", err)
 		}
-		// This is an unexpected error
-		logger.Error("Command execution failed", "error", err)
-		return fmt.Errorf("command execution failed: %v", err)
+		return err
 	}
 
 	logger.Debug("Command completed successfully")

landjail/manager.go

@@ -67,12 +67,12 @@ func (b *LandJail) Run(ctx context.Context) error {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	// childErr receives the result of RunChildProcess so we can
+	// propagate the child's exit code to our caller.
+	childErr := make(chan error, 1)
 	go func() {
 		defer cancel()
-		err := b.RunChildProcess(os.Args)
-		if err != nil {
-			b.logger.Error("Failed to run child process", "error", err)
-		}
+		childErr <- b.RunChildProcess(os.Args)
 	}()
 
 	// Setup signal handling BEFORE any setup
@@ -89,7 +89,10 @@ func (b *LandJail) Run(ctx context.Context) error {
 		b.logger.Info("Command completed, shutting down...")
 	}
 
-	return nil
+	// Wait for the goroutine to deliver its result. In the ctx.Done
+	// path the error is already buffered; in the signal path the child
+	// will be terminated (Pdeathsig) and the goroutine will follow.
+	return <-childErr
 }
 
 func (b *LandJail) RunChildProcess(command []string) error {

nsjail_manager/child.go

@@ -92,18 +92,11 @@ func RunChild(logger *slog.Logger, cfg config.AppConfig) error {
 	}
 	err = cmd.Run()
 	if err != nil {
-		// Check if this is a normal exit with non-zero status code
 		if exitError, ok := err.(*exec.ExitError); ok {
-			exitCode := exitError.ExitCode()
-			// Log at debug level for non-zero exits (normal behavior)
-			logger.Debug("Command exited with non-zero status", "exit_code", exitCode)
-			// Exit with the same code as the command - don't log as error
-			// This is normal behavior (commands can exit with any code)
-			os.Exit(exitCode)
+			logger.Debug("Command exited with non-zero status", "exit_code", exitError.ExitCode())
+		} else {
+			logger.Error("Command execution failed", "error", err)
 		}
-		// This is an unexpected error (not just a non-zero exit)
-		// Only log actual errors like "command not found" or "permission denied"
-		logger.Error("Command execution failed", "error", err)
 		return err
 	}
 

nsjail_manager/manager.go

@@ -71,9 +71,12 @@ func (b *NSJailManager) Run(ctx context.Context) error {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	// childErr receives the result of RunChildProcess so we can
+	// propagate the child's exit code to our caller.
+	childErr := make(chan error, 1)
 	go func() {
 		defer cancel()
-		b.RunChildProcess(os.Args)
+		childErr <- b.RunChildProcess(os.Args)
 	}()
 
 	// Setup signal handling BEFORE any setup
@@ -90,23 +93,26 @@ func (b *NSJailManager) Run(ctx context.Context) error {
 		b.logger.Info("Command completed, shutting down...")
 	}
 
-	return nil
+	// Wait for the goroutine to deliver its result. In the ctx.Done
+	// path the error is already buffered; in the signal path the child
+	// will be terminated (Pdeathsig) and the goroutine will follow.
+	return <-childErr
 }
 
-func (b *NSJailManager) RunChildProcess(command []string) {
+func (b *NSJailManager) RunChildProcess(command []string) error {
 	cmd := b.jailer.Command(command)
 
 	b.logger.Debug("Executing command in boundary", "command", strings.Join(os.Args, " "))
 	err := cmd.Start()
 	if err != nil {
 		b.logger.Error("Command failed to start", "error", err)
-		return
+		return err
 	}
 
 	err = b.jailer.ConfigureHostNsCommunication(cmd.Process.Pid)
 	if err != nil {
 		b.logger.Error("configuration after command execution failed", "error", err)
-		return
+		return err
 	}
 
 	b.logger.Debug("waiting on a child process to finish")
@@ -121,9 +127,10 @@ func (b *NSJailManager) RunChildProcess(command []string) {
 			// This is an unexpected error (not just a non-zero exit)
 			b.logger.Error("Command execution failed", "error", err)
 		}
-		return
+		return err
 	}
 	b.logger.Debug("Command completed successfully")
+	return nil
 }
 
 func (b *NSJailManager) setupHostAndStartProxy() error {