Fixes an issue where `VOLUME some_name:/foo` would be parsed as a named
volume, allowing access from the builder to any volume on the host.
This makes sure that named volumes must always be passed in as a bind.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
... | ... |
@@ -5,7 +5,6 @@ package daemon |
5 | 5 |
import ( |
6 | 6 |
"os" |
7 | 7 |
"path/filepath" |
8 |
- "strings" |
|
9 | 8 |
|
10 | 9 |
derr "github.com/docker/docker/errors" |
11 | 10 |
"github.com/docker/docker/image" |
... | ... |
@@ -18,17 +17,9 @@ import ( |
18 | 18 |
// createContainerPlatformSpecificSettings performs platform specific container create functionality |
19 | 19 |
func createContainerPlatformSpecificSettings(container *Container, config *runconfig.Config, hostConfig *runconfig.HostConfig, img *image.Image) error { |
20 | 20 |
for spec := range config.Volumes { |
21 |
- var ( |
|
22 |
- name, destination string |
|
23 |
- parts = strings.Split(spec, ":") |
|
24 |
- ) |
|
25 |
- switch len(parts) { |
|
26 |
- case 2: |
|
27 |
- name, destination = parts[0], filepath.Clean(parts[1]) |
|
28 |
- default: |
|
29 |
- name = stringid.GenerateNonCryptoID() |
|
30 |
- destination = filepath.Clean(parts[0]) |
|
31 |
- } |
|
21 |
+ name := stringid.GenerateNonCryptoID() |
|
22 |
+ destination := filepath.Clean(spec) |
|
23 |
+ |
|
32 | 24 |
// Skip volumes for which we already have something mounted on that |
33 | 25 |
// destination because of a --volume-from. |
34 | 26 |
if container.isDestinationMounted(destination) { |
... | ... |
@@ -5641,7 +5641,7 @@ func (s *DockerSuite) TestBuildNullStringInAddCopyVolume(c *check.C) { |
5641 | 5641 |
|
5642 | 5642 |
ctx, err := fakeContext(` |
5643 | 5643 |
FROM busybox |
5644 |
- |
|
5644 |
+ |
|
5645 | 5645 |
ADD null / |
5646 | 5646 |
COPY nullfile / |
5647 | 5647 |
VOLUME nullvolume |
... | ... |
@@ -6194,3 +6194,15 @@ func (s *DockerSuite) TestBuildBuildTimeArgDefintionWithNoEnvInjection(c *check. |
6194 | 6194 |
c.Fatalf("unexpected number of occurrences of the arg in output: %q expected: 1", out) |
6195 | 6195 |
} |
6196 | 6196 |
} |
6197 |
+ |
|
6198 |
+func (s *DockerSuite) TestBuildNoNamedVolume(c *check.C) { |
|
6199 |
+ testRequires(c, DaemonIsLinux) |
|
6200 |
+ dockerCmd(c, "run", "-v", "testname:/foo", "busybox", "sh", "-c", "touch /foo/oops") |
|
6201 |
+ |
|
6202 |
+ dockerFile := `FROM busybox |
|
6203 |
+ VOLUME testname:/foo |
|
6204 |
+ RUN ls /foo/oops |
|
6205 |
+ ` |
|
6206 |
+ _, err := buildImage("test", dockerFile, false) |
|
6207 |
+ c.Assert(err, check.NotNil, check.Commentf("image build should have failed")) |
|
6208 |
+} |