Support bind and tmpfs docker mounts #4924
Conversation
notnoop
force-pushed
the
f-docker-mounts
branch
from
631b3db to
cb453e7
Compare
| "target": hclspec.NewAttr("target", "string", false), | ||
| "source": hclspec.NewAttr("source", "string", false), | ||
| "readonly": hclspec.NewAttr("readonly", "bool", false), | ||
| "volume_options": hclspec.NewBlockSet("volume_options", hclspec.NewObject(map[string]*hclspec.Spec{ |
There was a problem hiding this comment.
Not related to PR - but noticed that volume_options is expected to be a single block not a collection.
| // FIXME: This needs to be true but we have a bug with security implications. | ||
| // The relative paths check should restrict access to alloc-dir subtree | ||
| // documenting existing behavior in test here and need to follow up in another commit | ||
| requiresVolumes: false, |
There was a problem hiding this comment.
Can we just get this fixed up now with a call to PathEscapesAllocDir?
There was a problem hiding this comment.
Intend to follow up in a separate PR to audit all paths where it's a possibility and to add dedicated CHANGELOG item for it.
Co-Authored-By: notnoop <[email protected]>
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Adds support for more docker mount types, namely "bind" and "tmpfs".