[{"_1":2,"_187":-5,"_188":-5},"loaderData",{"_3":4,"_18":19,"_25":26,"_165":166},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":11,"_24":22},"username","isAskGordonEnabled",true,"showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":89,"_112":113,"_152":-5,"_153":11,"_154":22,"_155":11,"_156":11,"_157":11,"_158":-5,"_159":11,"_160":-5,"_161":162,"_163":114,"_164":-7},"canonicalUrl","https://hub.docker.com/r/heroku/shaas/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","heroku","reponame","shaas","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2017-11-08T08:49:20.669778Z","description","Shell as a Service","is_private","last_updated","2021-09-13T21:14:47.176827Z","last_modified","2025-07-01T08:54:33.595797Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",7784084,"repository_type","star_count",0,"status",6,"status_description","archived","source","collaborator_count","full_description","# shaas\nShell as a Service\n\n## Overview\nAPI to inspect and execute scripts in a server's environment via HTTP and WebSockets.\n\n**This is obviously a *really bad idea* on a server that you care about, but this is a convenience for testing purposes only. This offers no protection whatsoever for the server. This makes the server's entire file system accessible to clients. Please use with great caution.**\n\n## Running\n\nBecause this application gives clients full access to the server, it is highly recommended to run it inside of some kind of containerized environment, such as [Heroku](http://www.heroku.com) or [Docker](https://www.docker.com/). Even in a containerized environment, you may wish to set a username and password, for use via HTTP basic authentication, by setting `BASIC_AUTH=user:password` in the environment before starting. To only allow `GET` requests and disallow websockets, set `READ_ONLY` in the environment.\n\n### Heroku\n\n[![Deploy](https://www.herokucdn.com/deploy/button.png)](https://heroku.com/deploy?template=https://github.com/heroku/shaas)\n\n### Docker\n\nRunning with [Docker Compose](https://docs.docker.com/compose):\n\n $ docker-compose up -d\n $ curl http://localhost:5000/\n\n## Usage\n\nSummary of endpoint behavior for all path, method, and protocol combinations:\n\n| | POST | GET | PUT/APPEND | WebSocket |\n|-----------|---------------------------------------|---------------------|-----------------------|-----------------------------------------------------|\n| File | runs path in context of its directory | downloads path | uploads body to path | interactively runs path in context of its directory |\n| Directory | runs body in context of path | lists files in path | n/a | runs interactive shell in context of path |\n\n### Executing Commands\n\nTo execute a command in the context of a given directory on the server, simply `POST` the command with the directory as the URL path. For example, running `pwd` in the directory `/usr/bin` returns the path in the response:\n\n $ curl http://shaas.example.com/usr/bin -i -X POST -d 'pwd'\n HTTP/1.1 200 OK\n Date: Tue, 21 Apr 2015 17:22:07 GMT\n Content-Type: text/plain; charset=utf-8\n Transfer-Encoding: chunked\n\n /usr/bin\n\nThis is the most versatile endpoint. The functionality of all the other endpoints could be achieved with a `POST` to a directory path, but are offered as a convenience.\n\n### Executing Scripts\n\nTo execute a script on the server, simply `POST` the script path as the URL path and any input to the script in the body. For example, to find the factors of the number 24:\n\n $ curl http://shaas.example.com/usr/bin/factor -i -X POST -d '24'\n HTTP/1.1 200 OK\n Server: Cowboy\n Connection: keep-alive\n Date: Fri, 15 May 2015 16:40:08 GMT\n Content-Type: text/plain; charset=utf-8\n Transfer-Encoding: chunked\n Via: 1.1 vegur\n \n 24: 2 2 2 3\n \nBecause `/usr/bin` is on the `PATH`, this could also be run with just the command in the body:\n\n $ curl http://shaas.example.com/ -i -X POST -d 'factor 24'\n HTTP/1.1 200 OK\n Server: Cowboy\n Connection: keep-alive\n Date: Fri, 15 May 2015 16:45:43 GMT\n Content-Type: text/plain; charset=utf-8\n Transfer-Encoding: chunked\n Via: 1.1 vegur\n \n 24: 2 2 2 3\n\n### CGI Environment Variables\n\nAll commands and scripts are automatically run with [CGI](http://en.wikipedia.org/wiki/Common_Gateway_Interface) environment variables for access to HTTP headers, query parameters, and other metadata:\n \n $ curl http://shaas.example.com/ -X POST -d 'env | sort'\n CONTENT_LENGTH=10\n CONTENT_TYPE=application/x-www-form-urlencoded\n GATEWAY_INTERFACE=CGI/1.1\n HTTP_ACCEPT=*/*\n HTTP_CONNECTION=close\n HTTP_CONNECT_TIME=5\n HTTP_CONTENT_LENGTH=10\n HTTP_CONTENT_TYPE=application/x-www-form-urlencoded\n HTTP_HOST=shaas.example.com\n HTTP_TOTAL_ROUTE_TIME=0\n HTTP_USER_AGENT=curl/7.37.1\n HTTP_VIA=1.1 vegur\n HTTP_X_FORWARDED_FOR=73.170.209.186\n HTTP_X_FORWARDED_PORT=80\n HTTP_X_FORWARDED_PROTO=http\n HTTP_X_REQUEST_ID=9003884b-310a-4095-8ff1-0894494aff75\n HTTP_X_REQUEST_START=1429846020992\n PATH_INFO=/\n PWD=/\n QUERY_STRING=\n REMOTE_ADDR=10.216.205.205:30916\n REMOTE_HOST=10.216.205.205:30916\n REQUEST_METHOD=POST\n REQUEST_URI=/\n SCRIPT_FILENAME=/\n SCRIPT_NAME=/\n SERVER_NAME=shaas.example.com\n SERVER_PORT=23389\n SERVER_PROTOCOL=HTTP/1.1\n SERVER_SOFTWARE=go\n SHLVL=1\n _=/usr/bin/env\n\n### Interactive Sessions\n\nBy accessing the endpoints above via WebSockets, the commands are run interactively. If the path is a directory, an interactive `bash` session is started in that directory. If the path is a script, it is run in an interactive session. For example, using the [wssh](https://github.com/progrium/wssh) client:\n\n $ wssh ws://shaas.example.com/\n / $ echo 'hello'\n echo 'hello'\n hello\n\n### Listing a Directory\n\nDirectories are listed in JSON format for easy parsing:\n\n\n $ curl http://shaas.example.com/usr -i -X GET\n HTTP/1.1 200 OK\n Server: Cowboy\n Connection: keep-alive\n Content-Type: application/json\n Date: Fri, 15 May 2015 16:52:29 GMT\n Content-Length: 996\n Via: 1.1 vegur\n \n {\n \"bin\": {\n \"size\": 36864,\n \"type\": \"d\",\n \"permission\": 493,\n \"updated_at\": \"2015-03-20T09:28:58.547556085Z\"\n },\n \"games\": {\n \"size\": 4096,\n \"type\": \"d\",\n \"permission\": 493,\n \"updated_at\": \"2014-04-10T22:12:14Z\"\n }\n }\n\nIf viewing the directory in a browser (or any client with a `html` in the `Accept` header), the listing will be returned in HTML:\n\n $ curl http://shaas.example.com/usr -i -X GET -H 'Accept: text/html'\n HTTP/1.1 200 OK\n Content-Type: text/html\n Date: Tue, 21 Apr 2015 17:46:58 GMT\n Content-Length: 185\n\n

/bin
/games

\n\nTo list a directory in plain text, use POST with the `ls` command and options of your choice:\n\n $ curl http://shaas.example.com/usr -i -X POST -d 'ls -lA'\n HTTP/1.1 200 OK\n Server: Cowboy\n Connection: keep-alive\n Date: Fri, 15 May 2015 16:54:28 GMT\n Content-Type: text/plain; charset=utf-8\n Transfer-Encoding: chunked\n Via: 1.1 vegur\n \n total 72\n drwxr-xr-x 2 root root 36864 Mar 20 09:28 bin\n drwxr-xr-x 2 root root 4096 Apr 10 2014 games\n\n### Downloading a File\n\nFiles are returned in their native format:\n\n $ curl http://shaas.example.com/var/logs/server.log -i -X GET\n HTTP/1.1 200 OK\n Date: Tue, 21 Apr 2015 17:31:45 GMT\n Content-Type: plain/text\n\n ...\n\n### Uploading a File\n\n`PUT` creates or replaces a file with the request body:\n\n $ curl http://shaas.example.com/var/logs/server.log -i -X PUT --data-binary 'hello 1'\n HTTP/1.1 200 OK\n Date: Tue, 28 Mar 2017 09:13:05 GMT\n Content-Length: 0\n Content-Type: text/plain; charset=utf-8\n\n $ curl http://shaas.example.com/var/logs/server.log -i -X PUT --data-binary 'hello 2'\n HTTP/1.1 200 OK\n Date: Tue, 28 Mar 2017 09:13:05 GMT\n Content-Length: 0\n Content-Type: text/plain; charset=utf-8\n\n $ curl localhost:5000/var/logs/server.log -i\n HTTP/1.1 200 OK\n Content-Length: 7\n Date: Tue, 28 Mar 2017 09:13:38 GMT\n Content-Type: text/plain; charset=utf-8\n\n hello 2\n\n`APPEND` creates or appends a file with the request body:\n\n $ curl http://shaas.example.com/var/logs/server.log -i -X APPEND --data-binary 'hello 1'\n HTTP/1.1 200 OK\n Date: Tue, 28 Mar 2017 09:13:05 GMT\n Content-Length: 0\n Content-Type: text/plain; charset=utf-8\n\n $ curl http://shaas.example.com/var/logs/server.log -i -X APPEND --data-binary 'hello 2'\n HTTP/1.1 200 OK\n Date: Tue, 28 Mar 2017 09:13:05 GMT\n Content-Length: 0\n Content-Type: text/plain; charset=utf-8\n\n $ curl localhost:5000/var/logs/server.log -i\n HTTP/1.1 200 OK\n Content-Length: 14\n Date: Tue, 28 Mar 2017 11:56:43 GMT\n Content-Type: text/plain; charset=utf-8\n\n hello-1hello-2\n\n## Overriding HTTP Methods\n\nBecause not all clients support all HTTP methods, particularly `PUT` and the custom `APPEND` method, the method can alternatively be overridden with the `_method` query parameter alongd with the `POST` method. For example, the following are equivalent:\n\n $ curl http://shaas.example.com/var/logs/server.log -i -X APPEND --data-binary 'hello 1'\n\n $ curl http://shaas.example.com/var/logs/server.log?_method=APPEND -i -X POST --data-binary 'hello 1'\n\n## Testing\n\nDue to the nature of this application and the access it has to the host machine, testing is done functionality within a [Docker](https://www.docker.com) container. To run tests, be sure Docker is running, [Docker Compose](https://docs.docker.com/compose) is installed, and run:\n\n $ go test -v ./... -ftest\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":22,"_83":11,"_84":11},"read","write","admin","user","storage_size",61009762,"orgData",{"_90":91,"_92":93,"_94":95,"_96":33,"_97":98,"_99":100,"_101":98,"_102":103,"_104":105,"_106":107,"_108":109,"_110":109,"_111":22},"id","34b39d0074c011e4bea40242ac11001b","uuid","34b39d00-74c0-11e4-bea4-0242ac11001b","type","organization","orgname","full_name","Heroku","location","San Francisco, CA","company","profile_url","https://www.heroku.com/","date_joined","2013-05-02T23:54:40Z","gravatar_url","https://www.gravatar.com/avatar/3d5c3e6e739b3f159973611ed5c47c84?s=80&r=g&d=mm","gravatar_email","","badge","is_active","recentTags",[114],{"_115":44,"_116":117,"_118":119,"_90":120,"_121":122,"_50":140,"_141":142,"_143":33,"_144":56,"_57":145,"_146":147,"_148":130,"_149":140,"_150":138,"_151":22},"content_type","creator",62811,"full_size",61000835,17736383,"images",[123],{"_124":125,"_126":127,"_128":109,"_129":130,"_131":132,"_133":134,"_135":109,"_136":-5,"_137":119,"_63":138,"_139":-5},"architecture","amd64","digest","sha256:a7787e345ab9adde304cc1389ffb8dadfab8697156ec660c492845c01fec84d7","features","last_pulled","2026-11-06T03:42:31.50099809Z","last_pushed","2021-09-13T21:14:47Z","os","linux","os_features","os_version","size","active","variant","2021-09-13T21:14:46.880957Z","last_updater",177,"last_updater_username","media_type","latest","repository",2040658,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxAgenticPlatformBadge","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":167,"_174":175,"_161":185,"_186":11},{"_40":168,"_42":169,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":170,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":171,"_79":11,"_80":173,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":172},[78],{"_82":22,"_83":11,"_84":11},"tags",{"_176":177,"_178":-5,"_179":-5,"_180":181},"count",1,"next","previous","results",[182],{"_115":44,"_116":117,"_118":119,"_90":120,"_121":183,"_50":140,"_141":142,"_143":33,"_144":56,"_57":145,"_146":147,"_148":130,"_149":140,"_150":138,"_151":22},[184],{"_124":125,"_126":127,"_128":109,"_129":130,"_131":132,"_133":134,"_135":109,"_136":-5,"_137":119,"_63":138,"_139":-5},[],"canDeleteTags","actionData","errors"]

heroku/shaas

Tags for heroku/shaas