Browse code

Do not parse config.Volumes for named volumes

Fixes an issue where `VOLUME some_name:/foo` would be parsed as a named
volume, allowing access from the builder to any volume on the host.

This makes sure that named volumes must always be passed in as a bind.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>

Brian Goff authored on 2015/09/29 23:01:57
Showing 2 changed files
... ...
@@ -5,7 +5,6 @@ package daemon
5 5
 import (
6 6
 	"os"
7 7
 	"path/filepath"
8
-	"strings"
9 8
 
10 9
 	derr "github.com/docker/docker/errors"
11 10
 	"github.com/docker/docker/image"
... ...
@@ -18,17 +17,9 @@ import (
18 18
 // createContainerPlatformSpecificSettings performs platform specific container create functionality
19 19
 func createContainerPlatformSpecificSettings(container *Container, config *runconfig.Config, hostConfig *runconfig.HostConfig, img *image.Image) error {
20 20
 	for spec := range config.Volumes {
21
-		var (
22
-			name, destination string
23
-			parts             = strings.Split(spec, ":")
24
-		)
25
-		switch len(parts) {
26
-		case 2:
27
-			name, destination = parts[0], filepath.Clean(parts[1])
28
-		default:
29
-			name = stringid.GenerateNonCryptoID()
30
-			destination = filepath.Clean(parts[0])
31
-		}
21
+		name := stringid.GenerateNonCryptoID()
22
+		destination := filepath.Clean(spec)
23
+
32 24
 		// Skip volumes for which we already have something mounted on that
33 25
 		// destination because of a --volume-from.
34 26
 		if container.isDestinationMounted(destination) {
... ...
@@ -5641,7 +5641,7 @@ func (s *DockerSuite) TestBuildNullStringInAddCopyVolume(c *check.C) {
5641 5641
 
5642 5642
 	ctx, err := fakeContext(`
5643 5643
 		FROM busybox
5644
-		
5644
+
5645 5645
 		ADD null /
5646 5646
 		COPY nullfile /
5647 5647
 		VOLUME nullvolume
... ...
@@ -6194,3 +6194,15 @@ func (s *DockerSuite) TestBuildBuildTimeArgDefintionWithNoEnvInjection(c *check.
6194 6194
 		c.Fatalf("unexpected number of occurrences of the arg in output: %q expected: 1", out)
6195 6195
 	}
6196 6196
 }
6197
+
6198
+func (s *DockerSuite) TestBuildNoNamedVolume(c *check.C) {
6199
+	testRequires(c, DaemonIsLinux)
6200
+	dockerCmd(c, "run", "-v", "testname:/foo", "busybox", "sh", "-c", "touch /foo/oops")
6201
+
6202
+	dockerFile := `FROM busybox
6203
+	VOLUME testname:/foo
6204
+	RUN ls /foo/oops
6205
+	`
6206
+	_, err := buildImage("test", dockerFile, false)
6207
+	c.Assert(err, check.NotNil, check.Commentf("image build should have failed"))
6208
+}