cosa() {
    env | grep COREOS_ASSEMBLER
    local -r COREOS_ASSEMBLER_CONTAINER_LATEST="ghcr.io/edgelesssys/constellation-coreos-assembler:latest"
    test -t 1 && USE_TTY="-ti"
    set -x
    docker run --rm ${USE_TTY} --security-opt label=disable --privileged                                                      \
               -v ${PWD}:/srv/ --device /dev/kvm --device /dev/fuse                                                           \
               --tmpfs /tmp -v /var/tmp:/var/tmp --name constellation-cosa --pull always                                      \
               ${NETRC+-v ${NETRC}:/home/builder/.netrc:ro}                                                                   \
               ${COREOS_ASSEMBLER_CONFIG_GIT:+-v $COREOS_ASSEMBLER_CONFIG_GIT:/srv/src/config/:ro}                            \
               ${COREOS_ASSEMBLER_GIT:+-v $COREOS_ASSEMBLER_GIT/src/:/usr/lib/coreos-assembler/:ro}                           \
               ${COREOS_ASSEMBLER_CONTAINER_RUNTIME_ARGS}                                                                     \
               ${COREOS_ASSEMBLER_CONTAINER:-$COREOS_ASSEMBLER_CONTAINER_LATEST} "$@"
    rc=$?; set +x; return $rc
}