genpolicy: add bind mounts for image volumes

[danmihai1]

Add bind mounts for volumes defined by docker container images, unless those mounts have been defined in the input K8s YAML file too.

For example, quay.io/opstree/redis defines two mounts:
/data
/node-conf
Before these changes, if these mounts were not defined in the YAML file too, the auto-generated policy did not allow this container image to start.

[katexochen]

Thanks Dan, that's an issue I recently ran into. Afaik containerd will try to mount a tmpfs in case the the volume isn't specified in the YAML. I was wondering if we could allow this mount of a tmpfs at that location in case the volume isn't specified instead of requiring the volume to be explicitly defined. It should be safe as the tmpfs is in the guest, so whatever we write there won't be accessible by the host. Also, I think is quite a common case (the redis image defines such VOLUME, for example) and many users will likely run into it often.

[danmihai1]

Thanks Dan, that's an issue I recently ran into. Afaik containerd will try to mount a tmpfs in case the the volume isn't specified in the YAML. I was wondering if we could allow this mount of a tmpfs at that location in case the volume isn't specified instead of requiring the volume to be explicitly defined. It should be safe as the tmpfs is in the guest, so whatever we write there won't be accessible by the host. Also, I think is quite a common case (the redis image defines such VOLUME, for example) and many users will likely run into it often.

Good to know - thanks @katexochen ! I made that genpolicy change and added a test for redis.