September 21, 2026 路 #5
The cleanup that ate the disk
A deploy script cleans yesterday's build directory. What is the dangerous line?
#!/usr/bin/env bash
set -e
BUILD_DIR=${1:-}
echo "cleaning $BUILD_DIR"
cd /srv/app
rm -rf $BUILD_DIR
mkdir -p "$BUILD_DIR"Next puzzle in UTC
One try. The first answer sticks.
How to fix it
Quote "$BUILD_DIR", refuse an empty value, and add set -u so an unset variable aborts the script instead of expanding to nothing.
rm -rf $BUILD_DIR without quotes is two bugs stacked. Word splitting turns a path with spaces into multiple arguments. If BUILD_DIR is empty, the command becomes rm -rf with no path, which is a usage error on GNU rm, but rm -rf $BUILD_DIR/ becomes rm -rf / when the variable is empty. The trailing slash is the classic outage.
set -e does not quote variables for you. set -u would have aborted on an unset variable, but this script defaults the value to empty, so -u alone is not enough. Check that the path is non-empty and lives where you expect.
Fix
set -euo pipefail
if [[ -z ${BUILD_DIR} || ${BUILD_DIR} != /srv/app/builds/* ]]; then
echo "refusing to delete ${BUILD_DIR}" >&2
exit 1
fi
rm -rf -- "${BUILD_DIR}"
The prefix check matters. A quoted empty string is safe. A quoted absolute path that a caller set to / is not.