run.py: stop hiding sandbox and recommend --debug on sandbox failure

As discussed in systemd#3948 and systemd#3992, logging commands failing in a sandbox
without ever mentioning that a sandbox was in use is misleading and very
time-consuming; notably because paths look real but they are not.

To remove this confusion and cost, simply add one short line mentioning
that a sandbox was involved when the failure happened + recommend to
re-run with --debug to display bind mounts and other important
information.

Also separate the command and error message on different lines for
better readability and re-usability.

Just for the record: before commit 7e7a3c7 ("Don't log sandbox for
every command"), `run.py` was logging sandbox commands every time which
was too verbose and unreadable. That commit said "... but still log the
full sandbox if a command fails" and it did that do in `__init__.py` -
but not always in `run.py`. After that commit, the sandbox was logged by
`run.py` only in --debug mode and became completely invisible otherwise.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>

Author: marc-hb

mkosi/run.py

@@ -106,14 +106,22 @@ def fork_and_wait(target: Callable[..., None], *args: Any, **kwargs: Any) -> Non
         raise subprocess.CalledProcessError(rc, ["self"])
 
 
+def log_sandbox_issue(sandbox: Sequence[str], cmdline: Sequence[str], errmsg: str) -> None:
+    if ARG_DEBUG.get():
+        # Complete but very long and hard to read. It could be reusable.
+        logging.error(f"{shlex.join(['mkosi-sandbox', *sandbox, *cmdline])}")
+    else:
+        logging.error("sandbox command omitted, rerun with --debug to see full command with bind mounts")
+        logging.error(f"{shlex.join(cmdline)}")
+
+    logging.error(errmsg)
+
+
 def log_process_failure(sandbox: Sequence[str], cmdline: Sequence[str], returncode: int) -> None:
     if -returncode in (signal.SIGINT, signal.SIGTERM):
         logging.error(f"Interrupted by {signal.Signals(-returncode).name} signal")
     elif returncode < 0:
-        logging.error(
-            f'"{shlex.join(["mkosi-sandbox", *sandbox, *cmdline] if ARG_DEBUG.get() else cmdline)}"'
-            f" was killed by {signal.Signals(-returncode).name} signal."
-        )
+        log_sandbox_issue(sandbox, cmdline, f" was killed by {signal.Signals(-returncode).name} signal.")
     elif returncode == 127 and cmdline[0] != "mkosi":
         # Anything invoked beneath /work is a script that we mount into place (so we know it exists). If one
         # of these scripts fails with exit code 127, it's either because the script interpreter was not
@@ -126,10 +134,7 @@ def log_process_failure(sandbox: Sequence[str], cmdline: Sequence[str], returnco
         else:
             logging.error(f"{cmdline[0]} not found.")
     else:
-        logging.error(
-            f'"{shlex.join(["mkosi-sandbox", *sandbox, *cmdline] if ARG_DEBUG.get() else cmdline)}"'
-            f" returned non-zero exit code {returncode}."
-        )
+        log_sandbox_issue(sandbox, cmdline, f" returned non-zero exit code {returncode}.")
 
 
 def run(