Skip to main content
emisar

Arbitrary shell (staging break-glass)

v0.1.0

STAGING-ONLY BREAK-GLASS. Runs an arbitrary operator-supplied shell script on the runner host via `/bin/sh -c`. This is the one capability emisar is built to avoid: it bypasses the declared-action model entirely — whatever the script says, runs, as the runner's user. It exists so an agent can verify a fix interactively on a staging host before that fix is encoded as a proper declared action or runbook. DO NOT install this pack on production runners and DO NOT enable it in production. Its single action is critical-risk, so the default policy denies it until an operator deliberately opts in; every run is fully audited.

1 denied by default
Pack ID
shell
Vendor
emisar
OS
linux
Actions
1

Install

emisar pack install validates the pack and verifies its content hash before copying it into /etc/emisar/packs. The --hash below pins the install to the exact bytes on this page — a tampered copy is rejected. After install, reload the runner; it re-reads the catalog and advertises every action.

content hash: sha256:0884946aa3c313b3990a3539400d1cd2fb50051fc0efa717be738f6038593134

on the runner host 
sudo emisar pack install shell \
  --hash sha256:0884946aa3c313b3990a3539400d1cd2fb50051fc0efa717be738f6038593134 \
  --dest /etc/emisar/packs

# Reload so the runner re-reads the catalog:
sudo systemctl reload emisar

Actions 1 total

View on GitHub
← Back to registry
Pack reference Publish your own →