From 6210ceb85675546a89e60417e26bd8929a553c58 Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Wed, 29 Apr 2026 23:07:12 -0700
Subject: [PATCH 1/3] tests/int: amend runc exec --env test

This tests checks that "runc exec --env VAR=VAR ..." actually appends
VAR=VAL to the exec's environment.

Add additional checks that:
 - process.env from config.json is also inherited;
 - HOME is set.

Those checks do not reveal any new issues.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 tests/integration/exec.bats | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tests/integration/exec.bats b/tests/integration/exec.bats
index 11e4bb473..5d936f402 100644
--- a/tests/integration/exec.bats
+++ b/tests/integration/exec.bats
@@ -100,8 +100,12 @@ function teardown() {
 
 	runc exec --env RUNC_EXEC_TEST=true test_busybox env
 	[ "$status" -eq 0 ]
-
-	[[ ${output} == *"RUNC_EXEC_TEST=true"* ]]
+	[[ "$output" == *"RUNC_EXEC_TEST=true"* ]]
+	# Env should inherit what's in config.json.
+	[[ "$output" == *'PATH='* ]]
+	[[ "$output" == *'TERM='* ]]
+	# Env should have HOME set from container's /etc/passwd.
+	[[ "$output" == *'HOME='* ]]
 }
 
 @test "runc exec --user" {

From d5307867f92f1c7bb3a394b9759238081ecbe5a5 Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Wed, 29 Apr 2026 23:09:40 -0700
Subject: [PATCH 2/3] tests/int/env.bats: add test for runc exec -p

All existing tests check runc run, and there is no single runc exec
environment test except for one in exec.bats.

Add it (no new issues found).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 tests/integration/env.bats | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tests/integration/env.bats b/tests/integration/env.bats
index cb984942e..4521fe735 100644
--- a/tests/integration/env.bats
+++ b/tests/integration/env.bats
@@ -95,3 +95,34 @@ function teardown() {
 	#
 	[ "$(wc -l <<<"$output")" -eq 4 ]
 }
+
+# Check that runc exec -p process.json takes env from
+# process.json only, not from config.json, and that HOME
+# is always set.
+@test "env [runc exec -p]" {
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
+	[ "$status" -eq 0 ]
+
+	cat <<_EOF_ >process.json
+{
+    "terminal": false,
+    "args": [
+        "/bin/env"
+    ],
+    "cwd": "/",
+    "env": [
+        "FOO=bar"
+    ]
+}
+_EOF_
+
+	runc exec -p process.json test_busybox
+	[ "$status" -eq 0 ]
+	# Env should have entries from process.json.
+	[[ "$output" == *'FOO=bar'* ]]
+	# ...and HOME set from container's /etc/passwd.
+	[[ "$output" == *'HOME=/root'* ]]
+	# Env should NOT contain entries from config.json.
+	[[ "$output" != *'TERM='* ]]
+	[[ "$output" != *'PATH='* ]]
+}

From 321073efdeeee2d9d022a242ca25c3ce29e050b3 Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Wed, 29 Apr 2026 22:52:40 -0700
Subject: [PATCH 3/3] runc exec -p: fix adding HOME to nil env

Before commit 7dc24868, when process.env was nil, prepareEnv
returned a flag telling HOME is not set, and it was added.

Commit 7dc24868 moved the functionality of adding HOME into
prepareEnv but did not properly handle nil case. As a result,
runc exec -p with process.json having no env set resulted in
an exec with no HOME set.

Fix this, and add unit and integration tests.

Fixes: 7dc24868 ("libct: switch to numeric UID/GID/groups")
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 libcontainer/env.go        |  5 +----
 libcontainer/env_test.go   |  4 ++++
 tests/integration/env.bats | 17 +++++++++++++++++
 3 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/libcontainer/env.go b/libcontainer/env.go
index 71b2f69d0..96a357c20 100644
--- a/libcontainer/env.go
+++ b/libcontainer/env.go
@@ -22,10 +22,7 @@ import (
 //
 // Returns the prepared environment.
 func prepareEnv(env []string, uid int) ([]string, error) {
-	if env == nil {
-		return nil, nil
-	}
-	var homeIsSet bool
+	homeIsSet := false
 
 	// Deduplication code based on dedupEnv from Go 1.22 os/exec.
 
diff --git a/libcontainer/env_test.go b/libcontainer/env_test.go
index 18dc52e88..f7b3a21cf 100644
--- a/libcontainer/env_test.go
+++ b/libcontainer/env_test.go
@@ -21,6 +21,10 @@ func TestPrepareEnv(t *testing.T) {
 	tests := []struct {
 		env, wantEnv []string
 	}{
+		{
+			env:     nil,
+			wantEnv: []string{home},
+		},
 		{
 			env:     []string{},
 			wantEnv: []string{home},
diff --git a/tests/integration/env.bats b/tests/integration/env.bats
index 4521fe735..e40184d55 100644
--- a/tests/integration/env.bats
+++ b/tests/integration/env.bats
@@ -126,3 +126,20 @@ _EOF_
 	[[ "$output" != *'TERM='* ]]
 	[[ "$output" != *'PATH='* ]]
 }
+
+@test "env HOME is set for runc exec -p with no process.env" {
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
+	[ "$status" -eq 0 ]
+
+	# "env" is not set.
+	cat <<_EOF_ >process.json
+{
+    "args": ["/bin/env"],
+    "cwd": "/"
+}
+_EOF_
+	runc exec -p process.json test_busybox
+	[ "$status" -eq 0 ]
+	# Env should have HOME set from container's /etc/passwd.
+	[[ "$output" == *'HOME=/root'* ]]
+}