Need regression tests for podman build and mounts.conf

[vrothberg]

I am currently looking at https://bugzilla.redhat.com/show_bug.cgi?id=1895027. We regressed in the 1.6.X series on mounting secrets during builds. It's fairly easy to reproduce with a Dockerfile:

FROM $IMAGE
RUN ls $MOUNT

With $MOUNT being the expected mount of the secret. For testing, we could setup a custom mounts.conf mounting a file.

Pulling in @edsantiago for input.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@vrothberg @edsantiago No movement on this issue.

[edsantiago]

So, this may be a dumb question, but, do we expect this to actually work in podman right now?

# mkdir -p /tmp/podmantest/secrets
# echo /tmp/podmantest/secrets:/run/secrets >/tmp/podmantest/mounts.conf
# echo shhhh >/tmp/podmantest/secrets/file
# printf "FROM quay.io/libpod/testimage:20200929\nRUN ls -l /run/secrets\n" | podman --default-mounts-file=/tmp/podman/mounts.conf build -t foo -
STEP 1: FROM quay.io/libpod/testimage:20200929
STEP 2: RUN ls -l /run/secrets
total 0
STEP 3: COMMIT foo
--> 0acf9c0d708
0acf9c0d708255abb9ef5c1984c1558ca5d735b1fcd4619131a9b1c7254e18ed

It doesn't work via podman run either:

# podman --default-mounts-file=/tmp/podman/mounts.conf run quay.io/libpod/testimage:20200929 ls -l /run/secrets
total 0

Am I misunderstanding the --default-mounts-file option?

[rhatdan]

This worked for me as root.

# cat /tmp/podman/mounts.conf 
/tmp/dan:/run/secrets
# mkdir /tmp/dan/
# touch /tmp/dan/walsh
# podman --default-mounts-file=/tmp/podman/mounts.conf run quay.io/libpod/testimage:20200929 ls -l /run/secrets
total 0
-rw-r--r--    1 root     root             0 Jan 25 19:36 walsh

[edsantiago]

@rhatdan the podman run error was a stupid typo on my end. I confirm that podman run works as expected with a custom mounts.conf. podman build does not (for me). Can you get podman build to see your secret?

# printf "FROM quay.io/libpod/testimage:20200929\nRUN ls -l /run/secrets\n" | podman --default-mounts-file=/tmp/podman/mounts.conf build -t foo -

[edsantiago]

OK it looks like podman build is ignoring --default-mounts-file. Buildah has the equivalent option, it's just that podman isn't passing it through.

[edsantiago]

Fixed in #9091