Why not just do something like this? https://github.com/joepie91/cvm/blob/develop/runhelper/runhelperI'll add that to a point release after roll
I don't like enforcing the 'strong password' thing since they're hard to remember. Passing special characters to vzctl can be annoying as well so we've enforced the following policy:
Francisco
PHP passes on the to-be-run command to the Python script in base64-encoded form (so no escaping madness), Python then runs it and provides the output in JSON format (this was to deal with the lack of proper output handling in php-ssh2 when I was still using it).
You could just do the same for the root password (ie. send a base64-encoded version to a Python script that uses Popen with list syntax to actually run the vzctl command, no escaping required).