Documentation
¶
Overview ¶
Package hostmount defines the fixed, allow-listed set of host bind mounts a privileged workspace may attach to a container. The host source path is owned by the server and resolved from a preset key — it is never supplied by the client — so the blast radius can never widen beyond these presets.
Index ¶
Constants ¶
const CustomHostRoot = "/mnt"
CustomHostRoot is the only host tree a privileged workspace may bind a custom path under. It is deliberately narrow: /mnt is the conventional mount point for operator-managed external storage (a NAS mounted at the same path on every node), so a bind under it can't reach system paths (/etc, /var/run, the Docker or Miabi data dirs) and stays useful for the shared-storage use case.
Variables ¶
var ErrInvalidHostPath = errors.New("host path must be an absolute path under " + CustomHostRoot + "/ (e.g. " + CustomHostRoot + "/nas/app)")
ErrInvalidHostPath is returned when a custom host path is not a clean absolute path strictly under CustomHostRoot.
Functions ¶
func ValidateCustomHostPath ¶
ValidateCustomHostPath cleans p and verifies it is an absolute path strictly inside CustomHostRoot (a real subpath, not the root itself), with no traversal. Returns the cleaned path to store/bind. The source-under-/mnt rule is the trust boundary: it can never widen beyond operator-mounted external storage.
Types ¶
type Preset ¶
type Preset struct {
Key string `json:"key"`
Label string `json:"label"`
Description string `json:"description"`
Source string `json:"source"` // host path bound into the container
DefaultTarget string `json:"default_target"` // container path used when none is given
DefaultReadOnly bool `json:"default_read_only"` // UI default for the read-only toggle
AllowReadOnly bool `json:"allow_read_only"` // whether read-only is meaningful/toggleable
Danger string `json:"danger"` // warning shown to the operator
}
Preset is one allow-listed host bind. Source is the host path (server-owned); callers never accept a raw source from the client.
Source Files