Repository navigation
fix(container): inherit only user mounts with volumes-from - #5250
Conversation
The source container's complete OCI mount list includes default mounts, which can replace the target container's own /dev/shm configuration. Select only destinations recorded in the source container's mount labels, while preserving their OCI mount options and volume metadata. Add a runtime regression that combines an inherited read-only bind mount with a separate /dev/shm bind mount on the target container. Signed-off-by: xinjun.jiang <xinjun.jiang@daocloud.io> Assisted-by: Codex
There was a problem hiding this comment.
🟢 Approval recommended
The focused implementation preserves user mount options, avoids system-mount inheritance, and includes an effective regression test.
0 open findings
What changed in this PR
Restricts --volumes-from to user-defined mounts, preventing source system mounts from overriding target mounts.
Changes:
- Filters inherited OCI mounts using source mount metadata.
- Scopes mount and anonymous-volume metadata per source container.
- Adds a
/dev/shmregression test.
| File | Description |
|---|---|
pkg/cmd/container/run_mount.go |
Filters and scopes inherited mounts. |
cmd/nerdctl/container/container_run_mount_linux_test.go |
Tests preservation of the target /dev/shm bind mount. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
The remaining failed gomodjail job reports only |
--volumes-fromcurrently copies the source container's complete OCI mount list, so its default/dev/shmmount replaces a bind mount configured on the target container. Restrict inherited mounts to destinations recorded in the source container's user mount metadata, preserving their original OCI options. Keep mount and anonymous-volume metadata scoped to each source container.Fixes #2667.
Validation: the new runtime regression fails before the change and passes afterward; the existing
TestRunVolumesFrom,make test, builds, and changed-code Go lint pass. YAML, module, confinement, license, and commit checks also pass. Full lint reports the same existing Go formatting and shellcheck failures on the clean upstream baseline.AI assistance: Codex assisted with the implementation, regression test, and PR description.