Documentation
¶
Overview ¶
Package bindmount validates a service's bind-mount host path, shared by internal/compose and internal/spec: internal/compose imports internal/spec (a compose service expands into a spec.Service), so neither of those two packages can hold this logic without the other importing it back and cycling. This package depends on neither.
Index ¶
Constants ¶
const EnvAllowedRoots = "APP_BIND_ALLOWED_ROOTS"
EnvAllowedRoots lists colon-separated absolute directories; when set, bind mounts must sit inside one of them.
const EnvBlockCredentialDirs = "APP_BIND_BLOCK_CREDENTIAL_DIRS" //nolint:gosec // env var name, not a credential
EnvBlockCredentialDirs turns the credential directory block off when set to 0 or false.
Variables ¶
var ForbiddenPaths = []string{
"/",
"/etc",
"/root",
"/boot",
"/sys",
"/proc",
"/var/lib/docker",
"/var/run/docker.sock",
"/var/run",
"/run",
"/dev",
"/lib/modules",
"/var/lib/containerd",
"/var/lib/kubelet",
"/var/lib/levelrail-data",
"/var/lib/levelrail-agent-data",
"/bin",
"/sbin",
"/lib",
"/lib64",
"/usr/bin",
"/usr/sbin",
"/usr/lib",
"/usr/local/bin",
"/usr/local/sbin",
"/var/spool/cron",
"/var/log",
"/usr/local/etc",
}
ForbiddenPaths are host paths a bind mount may never target, enforced even for an AbilityRoot caller (internal/api's ability gate, not this list, is the primary boundary; this is defense in depth): an exact match or a match of clean+"/" as a prefix. Each one grants something categorically worse than ordinary bind-mount access, host root compromise for most of these. /var/run/docker.sock (and /var/run generally, since a socket can be bind-mounted from anywhere under it) is deliberately excluded from this feature by design, not an oversight: Docker-socket access is a full container-escape-to-host- root vector via the Docker API, a categorically different and unreviewed capability that needs its own explicit design decision later, not bundled into general bind-mount support here.
Functions ¶
func SetProvider ¶
func SetProvider(fn func() Settings)
SetProvider injects the runtime settings source at boot; nil restores the env fallback.
func ValidateHostPath ¶
ValidateHostPath rejects a relative path and every path ForbiddenPaths covers; anything else is a real, operator-owned host directory this feature exists to allow.
Source Files