[
  {
    "cmd": [],
    "name": "ensure nsjail"
  },
  {
    "cmd": [
      "vpython3",
      "-u",
      "RECIPE_MODULE[recipe_engine::file]/resources/fileutil.py",
      "--json-output",
      "/path/to/tmp/json",
      "copy",
      "RECIPE_MODULE[fuchsia::nsjail]/resources/nsjail/tool_manifest.json",
      "/path/to/tmp/json"
    ],
    "infra_step": true,
    "name": "ensure nsjail.read manifest",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@1@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@{@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@  \"path\": \"path/to/nsjail\",@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@  \"version\": \"version:pinned-version\"@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@}@@@",
      "@@@STEP_LOG_END@tool_manifest.json@@@"
    ]
  },
  {
    "cmd": [],
    "name": "ensure nsjail.install path/to/nsjail",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@1@@@"
    ]
  },
  {
    "cmd": [
      "vpython3",
      "-u",
      "RECIPE_MODULE[recipe_engine::file]/resources/fileutil.py",
      "--json-output",
      "/path/to/tmp/json",
      "ensure-directory",
      "--mode",
      "0777",
      "[START_DIR]/cipd_tool/path/to/nsjail/version%3Apinned-version"
    ],
    "infra_step": true,
    "name": "ensure nsjail.install path/to/nsjail.ensure package directory",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@2@@@"
    ]
  },
  {
    "cmd": [
      "cipd",
      "ensure",
      "-root",
      "[START_DIR]/cipd_tool/path/to/nsjail/version%3Apinned-version",
      "-ensure-file",
      "path/to/nsjail version:pinned-version",
      "-max-threads",
      "0",
      "-json-output",
      "/path/to/tmp/json"
    ],
    "infra_step": true,
    "name": "ensure nsjail.install path/to/nsjail.ensure_installed",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@2@@@",
      "@@@STEP_LOG_LINE@json.output@{@@@",
      "@@@STEP_LOG_LINE@json.output@  \"result\": {@@@",
      "@@@STEP_LOG_LINE@json.output@    \"\": [@@@",
      "@@@STEP_LOG_LINE@json.output@      {@@@",
      "@@@STEP_LOG_LINE@json.output@        \"instance_id\": \"resolved-instance_id-of-version:pinned-v\", @@@",
      "@@@STEP_LOG_LINE@json.output@        \"package\": \"path/to/nsjail\"@@@",
      "@@@STEP_LOG_LINE@json.output@      }@@@",
      "@@@STEP_LOG_LINE@json.output@    ]@@@",
      "@@@STEP_LOG_LINE@json.output@  }@@@",
      "@@@STEP_LOG_LINE@json.output@}@@@",
      "@@@STEP_LOG_END@json.output@@@"
    ]
  },
  {
    "cmd": [],
    "name": "ensure dumb_init"
  },
  {
    "cmd": [
      "vpython3",
      "-u",
      "RECIPE_MODULE[recipe_engine::file]/resources/fileutil.py",
      "--json-output",
      "/path/to/tmp/json",
      "copy",
      "RECIPE_MODULE[fuchsia::nsjail]/resources/dumb_init/tool_manifest.json",
      "/path/to/tmp/json"
    ],
    "infra_step": true,
    "name": "ensure dumb_init.read manifest",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@1@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@{@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@  \"path\": \"path/to/dumb_init\",@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@  \"version\": \"version:pinned-version\"@@@",
      "@@@STEP_LOG_LINE@tool_manifest.json@}@@@",
      "@@@STEP_LOG_END@tool_manifest.json@@@"
    ]
  },
  {
    "cmd": [],
    "name": "ensure dumb_init.install path/to/dumb_init",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@1@@@"
    ]
  },
  {
    "cmd": [
      "vpython3",
      "-u",
      "RECIPE_MODULE[recipe_engine::file]/resources/fileutil.py",
      "--json-output",
      "/path/to/tmp/json",
      "ensure-directory",
      "--mode",
      "0777",
      "[START_DIR]/cipd_tool/path/to/dumb_init/version%3Apinned-version"
    ],
    "infra_step": true,
    "name": "ensure dumb_init.install path/to/dumb_init.ensure package directory",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@2@@@"
    ]
  },
  {
    "cmd": [
      "cipd",
      "ensure",
      "-root",
      "[START_DIR]/cipd_tool/path/to/dumb_init/version%3Apinned-version",
      "-ensure-file",
      "path/to/dumb_init version:pinned-version",
      "-max-threads",
      "0",
      "-json-output",
      "/path/to/tmp/json"
    ],
    "infra_step": true,
    "name": "ensure dumb_init.install path/to/dumb_init.ensure_installed",
    "~followup_annotations": [
      "@@@STEP_NEST_LEVEL@2@@@",
      "@@@STEP_LOG_LINE@json.output@{@@@",
      "@@@STEP_LOG_LINE@json.output@  \"result\": {@@@",
      "@@@STEP_LOG_LINE@json.output@    \"\": [@@@",
      "@@@STEP_LOG_LINE@json.output@      {@@@",
      "@@@STEP_LOG_LINE@json.output@        \"instance_id\": \"resolved-instance_id-of-version:pinned-v\", @@@",
      "@@@STEP_LOG_LINE@json.output@        \"package\": \"path/to/dumb_init\"@@@",
      "@@@STEP_LOG_LINE@json.output@      }@@@",
      "@@@STEP_LOG_LINE@json.output@    ]@@@",
      "@@@STEP_LOG_LINE@json.output@  }@@@",
      "@@@STEP_LOG_LINE@json.output@}@@@",
      "@@@STEP_LOG_END@json.output@@@"
    ]
  },
  {
    "cmd": [
      "which",
      "awk",
      "basename",
      "cat",
      "chmod",
      "cmp",
      "comm",
      "cp",
      "cut",
      "date",
      "diff",
      "dirname",
      "egrep",
      "env",
      "expr",
      "file",
      "find",
      "grep",
      "gzip",
      "head",
      "ldd",
      "ls",
      "mkdir",
      "mktemp",
      "mv",
      "readlink",
      "rm",
      "sed",
      "sort",
      "stat",
      "tail",
      "tar",
      "tee",
      "touch",
      "tr",
      "uname",
      "wc",
      "which"
    ],
    "name": "find tool paths"
  },
  {
    "cmd": [
      "which",
      "-a",
      "git"
    ],
    "name": "find all git binaries"
  },
  {
    "cmd": [
      "[START_DIR]/cipd_tool/path/to/nsjail/version%3Apinned-version/nsjail",
      "--disable_clone_newipc",
      "--disable_clone_newuts",
      "--disable_clone_newcgroup",
      "--disable_rlimits",
      "--time_limit",
      "43200",
      "--log",
      "/path/to/tmp/",
      "--bindmount",
      "[CLEANUP]/tmp_tmp_1:/tmp",
      "--bindmount_ro",
      "/b/s/w/ir/cipd_bin_packages/bin/git",
      "--bindmount_ro",
      "/bin/bash",
      "--bindmount_ro",
      "/dev/urandom",
      "--bindmount_ro",
      "/first/level",
      "--bindmount_ro",
      "/first/level/second",
      "--bindmount_ro",
      "/lib",
      "--bindmount_ro",
      "/lib64",
      "--bindmount_ro",
      "/usr/bin/awk",
      "--bindmount_ro",
      "/usr/bin/basename",
      "--bindmount_ro",
      "/usr/bin/cat",
      "--bindmount_ro",
      "/usr/bin/chmod",
      "--bindmount_ro",
      "/usr/bin/cmp",
      "--bindmount_ro",
      "/usr/bin/comm",
      "--bindmount_ro",
      "/usr/bin/cp",
      "--bindmount_ro",
      "/usr/bin/cut",
      "--bindmount_ro",
      "/usr/bin/date",
      "--bindmount_ro",
      "/usr/bin/diff",
      "--bindmount_ro",
      "/usr/bin/dirname",
      "--bindmount_ro",
      "/usr/bin/egrep",
      "--bindmount_ro",
      "/usr/bin/env",
      "--bindmount_ro",
      "/usr/bin/expr",
      "--bindmount_ro",
      "/usr/bin/file",
      "--bindmount_ro",
      "/usr/bin/find",
      "--bindmount_ro",
      "/usr/bin/grep",
      "--bindmount_ro",
      "/usr/bin/gzip",
      "--bindmount_ro",
      "/usr/bin/head",
      "--bindmount_ro",
      "/usr/bin/ldd",
      "--bindmount_ro",
      "/usr/bin/ls",
      "--bindmount_ro",
      "/usr/bin/mkdir",
      "--bindmount_ro",
      "/usr/bin/mktemp",
      "--bindmount_ro",
      "/usr/bin/mv",
      "--bindmount_ro",
      "/usr/bin/openssl",
      "--bindmount_ro",
      "/usr/bin/readlink",
      "--bindmount_ro",
      "/usr/bin/rm",
      "--bindmount_ro",
      "/usr/bin/sed",
      "--bindmount_ro",
      "/usr/bin/sort",
      "--bindmount_ro",
      "/usr/bin/stat",
      "--bindmount_ro",
      "/usr/bin/tail",
      "--bindmount_ro",
      "/usr/bin/tar",
      "--bindmount_ro",
      "/usr/bin/tee",
      "--bindmount_ro",
      "/usr/bin/touch",
      "--bindmount_ro",
      "/usr/bin/tr",
      "--bindmount_ro",
      "/usr/bin/uname",
      "--bindmount_ro",
      "/usr/bin/wc",
      "--bindmount_ro",
      "/usr/bin/which",
      "--bindmount",
      "[CACHE]",
      "--bindmount_ro",
      "[CACHE]/incremental",
      "--bindmount_ro",
      "[START_DIR]/cipd_tool/path/to/dumb_init/version%3Apinned-version/dumb_init",
      "--symlink",
      "/usr/bin/bash:/usr/bin/sh",
      "--env",
      "HOME=/tmp",
      "--env",
      "PATH=/b/s/w/ir/cipd_bin_packages/bin:/usr/bin:/bin",
      "--env",
      "TMPDIR=/tmp",
      "--",
      "[START_DIR]/cipd_tool/path/to/dumb_init/version%3Apinned-version/dumb_init",
      "/bin/bash"
    ],
    "name": "sandboxed step",
    "timeout": 60,
    "~followup_annotations": [
      "@@@STEP_LOG_END@raw_io.output_text[nsjail_log]@@@"
    ]
  },
  {
    "name": "$result"
  }
]