Fixes an issue where `VOLUME some_name:/foo` would be parsed as a named
volume, allowing access from the builder to any volume on the host.
This makes sure that named volumes must always be passed in as a bind.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
| ... | ... |
@@ -5,7 +5,6 @@ package daemon |
| 5 | 5 |
import ( |
| 6 | 6 |
"os" |
| 7 | 7 |
"path/filepath" |
| 8 |
- "strings" |
|
| 9 | 8 |
|
| 10 | 9 |
derr "github.com/docker/docker/errors" |
| 11 | 10 |
"github.com/docker/docker/image" |
| ... | ... |
@@ -18,17 +17,9 @@ import ( |
| 18 | 18 |
// createContainerPlatformSpecificSettings performs platform specific container create functionality |
| 19 | 19 |
func createContainerPlatformSpecificSettings(container *Container, config *runconfig.Config, hostConfig *runconfig.HostConfig, img *image.Image) error {
|
| 20 | 20 |
for spec := range config.Volumes {
|
| 21 |
- var ( |
|
| 22 |
- name, destination string |
|
| 23 |
- parts = strings.Split(spec, ":") |
|
| 24 |
- ) |
|
| 25 |
- switch len(parts) {
|
|
| 26 |
- case 2: |
|
| 27 |
- name, destination = parts[0], filepath.Clean(parts[1]) |
|
| 28 |
- default: |
|
| 29 |
- name = stringid.GenerateNonCryptoID() |
|
| 30 |
- destination = filepath.Clean(parts[0]) |
|
| 31 |
- } |
|
| 21 |
+ name := stringid.GenerateNonCryptoID() |
|
| 22 |
+ destination := filepath.Clean(spec) |
|
| 23 |
+ |
|
| 32 | 24 |
// Skip volumes for which we already have something mounted on that |
| 33 | 25 |
// destination because of a --volume-from. |
| 34 | 26 |
if container.isDestinationMounted(destination) {
|
| ... | ... |
@@ -5641,7 +5641,7 @@ func (s *DockerSuite) TestBuildNullStringInAddCopyVolume(c *check.C) {
|
| 5641 | 5641 |
|
| 5642 | 5642 |
ctx, err := fakeContext(` |
| 5643 | 5643 |
FROM busybox |
| 5644 |
- |
|
| 5644 |
+ |
|
| 5645 | 5645 |
ADD null / |
| 5646 | 5646 |
COPY nullfile / |
| 5647 | 5647 |
VOLUME nullvolume |
| ... | ... |
@@ -6194,3 +6194,15 @@ func (s *DockerSuite) TestBuildBuildTimeArgDefintionWithNoEnvInjection(c *check. |
| 6194 | 6194 |
c.Fatalf("unexpected number of occurrences of the arg in output: %q expected: 1", out)
|
| 6195 | 6195 |
} |
| 6196 | 6196 |
} |
| 6197 |
+ |
|
| 6198 |
+func (s *DockerSuite) TestBuildNoNamedVolume(c *check.C) {
|
|
| 6199 |
+ testRequires(c, DaemonIsLinux) |
|
| 6200 |
+ dockerCmd(c, "run", "-v", "testname:/foo", "busybox", "sh", "-c", "touch /foo/oops") |
|
| 6201 |
+ |
|
| 6202 |
+ dockerFile := `FROM busybox |
|
| 6203 |
+ VOLUME testname:/foo |
|
| 6204 |
+ RUN ls /foo/oops |
|
| 6205 |
+ ` |
|
| 6206 |
+ _, err := buildImage("test", dockerFile, false)
|
|
| 6207 |
+ c.Assert(err, check.NotNil, check.Commentf("image build should have failed"))
|
|
| 6208 |
+} |