GitList

Browse code

client: add API-version dependent validation for mount options

[docker/cli@fc6976d] added support for recursive readonly mounts in the
CLI, adding a ValidateMountWithAPIVersion utility to verify if options
used were supported by the API version.

We usually keep API-version dependent checks in the client, so that
docker/cli (and other users of the client) don't have to implement
their own validation for these.

This patch moves the functionality of ValidateMountWithAPIVersion to
the client.

Once the docker/cli vendoring was updated, we can remove the utility
there.

[docker/cli@fc6976d]: https://github.com/docker/cli/commit/fc6976db45e24cc2baff50d806402ae2a8468a13

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Sebastiaan van Stijn authored on 2025/03/10 06:03:00
Showing 2 changed files

client/container_create.go index 9b8616f..9bb106f 100644
client/service_create.go index fb12dd5..54c03b1 100644

client/container_create.go

History View file @ 5d6b566

@@ -3,6 +3,7 @@ package client // import "github.com/docker/docker/client"
                      import (
                      	"context"
                      	"encoding/json"
                     +	"errors"
                      	"net/url"
                      	"path"
                      	"sort"
@@ -54,6 +55,19 @@ func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config
                      			// When using API under 1.42, the Linux daemon doesn't respect the ConsoleSize
                      			hostConfig.ConsoleSize = [2]uint{0, 0}
+                     		}
                     +		if versions.LessThan(cli.ClientVersion(), "1.44") {
                     +			for _, m := range hostConfig.Mounts {
                     +				if m.BindOptions != nil {
                     +					// ReadOnlyNonRecursive can be safely ignored when API < 1.44
                     +					if m.BindOptions.ReadOnlyForceRecursive {
                     +						return response, errors.New("bind-recursive=readonly requires API v1.44 or later")
                     +					}
                     +					if m.BindOptions.NonRecursive && versions.LessThan(cli.ClientVersion(), "1.40") {
                     +						return response, errors.New("bind-recursive=disabled requires API v1.40 or later")
                     +					}
                     +				}
                     +			}
                     +		}
                      		hostConfig.CapAdd = normalizeCapabilities(hostConfig.CapAdd)
                      		hostConfig.CapDrop = normalizeCapabilities(hostConfig.CapDrop)

client/service_create.go

History View file @ 5d6b566

@@ -37,6 +37,11 @@ func (cli *Client) ServiceCreate(ctx context.Context, service swarm.ServiceSpec,
                      	if err := validateServiceSpec(service); err != nil {
                      		return response, err
+                     	}
                     +	if versions.LessThan(cli.version, "1.30") {
                     +		if err := validateAPIVersion(service, cli.version); err != nil {
                     +			return response, err
                     +		}
                     +	}
                      	// ensure that the image is tagged
                      	var resolveWarning string
@@ -191,3 +196,18 @@ func validateServiceSpec(s swarm.ServiceSpec) error {
+                     	}
                      	return nil
+                     }
+                    +
                     +func validateAPIVersion(c swarm.ServiceSpec, apiVersion string) error {
                     +	for _, m := range c.TaskTemplate.ContainerSpec.Mounts {
                     +		if m.BindOptions != nil {
                     +			if m.BindOptions.NonRecursive && versions.LessThan(apiVersion, "1.40") {
                     +				return errors.Errorf("bind-recursive=disabled requires API v1.40 or later")
                     +			}
                     +			// ReadOnlyNonRecursive can be safely ignored when API < 1.44
                     +			if m.BindOptions.ReadOnlyForceRecursive && versions.LessThan(apiVersion, "1.44") {
                     +				return errors.Errorf("bind-recursive=readonly requires API v1.44 or later")
                     +			}
                     +		}
                     +	}
                     +	return nil
                     +}