volumes: Implement subpath mount #45687
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vvoland
added
area/api
kind/feature
vvoland
force-pushed
the
volume-mount-subpath
branch
6 times, most recently
from
162300a to
e346dc5
Compare
vvoland
commented
Jun 2, 2023
vvoland
force-pushed
the
volume-mount-subpath
branch
2 times, most recently
from
0176b5a to
1765550
Compare
vvoland
force-pushed
the
volume-mount-subpath
branch
14 times, most recently
from
b301fa1 to
ac302cb
Compare
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
vvoland
force-pushed
the
volume-mount-subpath
branch
from
26ea50b to
5bbcc41
Compare
thaJeztah
approved these changes
Jan 19, 2024
This was referenced Mar 11, 2024
This was referenced Apr 6, 2024
|
is the long syntax required or would it be possible to utilize short syntax? It currently seems to only work with long syntax but it would make sense to me that if a named volume exists with a subpath, it should work. If a named volume doesn't exist, it will look for folders in ./ See: https://docs.docker.com/compose/compose-file/05-services/#volumes services:
example:
image: example:latest
volumes:
- named-volume/subpath:/internal/dir:rw # would utilize a named volume that exists in the compose file already
- local-dir/subpath:/internal/dir:rw # would use a local dir as no named volume exists
- ./local-dir2/subpath:/internal/dir2:rw # functionally the same as above
...
volumes:
named-volume:
driver_opts:
type: cifs
o: "uid=1000,username=username,password=${CIFS_PWD},iocharset=utf8,noperm,nobrl,vers=3.0"
device: "//192.168.10.10/example/storage"Thoughts? |
|
This is the wrong issue to discuss Compose's implementation. That being said, we're deliberately avoiding short/ambiguous formats (e.g. the implicit behavior you describe) for new features like this, for (hopefully obvious) reasons of explicit being better than implicit. Less typing sounds nice, until it leads to a bevy of issue reports, wasted hours debugging, or (in the worst case) security issues. Please open a discussion on https://github.com/compose-spec/compose-spec for questions, or open an issue if you have a concrete proposal/change to suggest. |
|
Yeah, I don't think we want to overload the short-form syntax more. Also not sure if such a format should be defined by the compose-spec first (as there's an expectation for the short-form format to be the same as is used for |
thaJeztah
added a commit
to thaJeztah/docker
that referenced
this pull request
Oct 27, 2024
This workaround was added in 9a0cde6 to work around an issue on Docker Desktop with ECI (Enhanced Container Isolation) enabled, which uses the Sysbox runtime under the hood. A comment was added during review of the PR that added it (see [1]), and the internal discussion on Slack tracked down the issue to code in [nestybox/sysfs]. That issue was resolved Sysbox EE, and upstreamed to Sysbox CE through [nestybox/sysbox-fs@9cf74e4], which is part of Sysbox CE v0.6.3, so we can remove this workaround. [1]: moby#45687 (comment) [nestybox/sysfs]: https://github.com/nestybox/sysbox-fs/blob/30fd49edbd51048fed8b2ad0af327598d30b29eb/process/process.go#L644-L684 [nestybox/sysbox-fs@9cf74e4]: nestybox/sysbox-fs@9cf74e4 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/docker
that referenced
this pull request
Oct 27, 2024
This workaround was added in 9a0cde6 to work around an issue on Docker Desktop with ECI (Enhanced Container Isolation) enabled, which uses the Sysbox runtime under the hood. A comment was added during review of the PR that added it (see [1]), and the internal discussion on Slack tracked down the issue to code in [nestybox/sysfs]. That issue was resolved Sysbox EE, and upstreamed to Sysbox CE through [nestybox/sysbox-fs@9cf74e4], which is part of Sysbox CE v0.6.3, so we can remove this workaround. [1]: moby#45687 (comment) [nestybox/sysfs]: https://github.com/nestybox/sysbox-fs/blob/30fd49edbd51048fed8b2ad0af327598d30b29eb/process/process.go#L644-L684 [nestybox/sysbox-fs@9cf74e4]: nestybox/sysbox-fs@9cf74e4 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/docker
that referenced
this pull request
Oct 27, 2024
This workaround was added in 9a0cde6 to work around an issue on Docker Desktop with ECI (Enhanced Container Isolation) enabled, which uses the Sysbox runtime under the hood. A comment was added during review of the PR that added it (see [1]), and the internal discussion on Slack tracked down the issue to code in [nestybox/sysfs]. That issue was resolved Sysbox EE, and upstreamed to Sysbox CE through [nestybox/sysbox-fs@9cf74e4], which is part of Sysbox CE v0.6.3, so we can remove this workaround. [1]: moby#45687 (comment) [nestybox/sysfs]: https://github.com/nestybox/sysbox-fs/blob/30fd49edbd51048fed8b2ad0af327598d30b29eb/process/process.go#L644-L684 [nestybox/sysbox-fs@9cf74e4]: nestybox/sysbox-fs@9cf74e4 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was referenced Oct 27, 2024
CharityKathure
pushed a commit
to CharityKathure/moby
that referenced
this pull request
Nov 6, 2024
This workaround was added in 9a0cde6 to work around an issue on Docker Desktop with ECI (Enhanced Container Isolation) enabled, which uses the Sysbox runtime under the hood. A comment was added during review of the PR that added it (see [1]), and the internal discussion on Slack tracked down the issue to code in [nestybox/sysfs]. That issue was resolved Sysbox EE, and upstreamed to Sysbox CE through [nestybox/sysbox-fs@9cf74e4], which is part of Sysbox CE v0.6.3, so we can remove this workaround. [1]: moby#45687 (comment) [nestybox/sysfs]: https://github.com/nestybox/sysbox-fs/blob/30fd49edbd51048fed8b2ad0af327598d30b29eb/process/process.go#L644-L684 [nestybox/sysbox-fs@9cf74e4]: nestybox/sysbox-fs@9cf74e4 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
maggie44
pushed a commit
to maggie44/moby
that referenced
this pull request
Dec 8, 2024
This workaround was added in 9a0cde6 to work around an issue on Docker Desktop with ECI (Enhanced Container Isolation) enabled, which uses the Sysbox runtime under the hood. A comment was added during review of the PR that added it (see [1]), and the internal discussion on Slack tracked down the issue to code in [nestybox/sysfs]. That issue was resolved Sysbox EE, and upstreamed to Sysbox CE through [nestybox/sysbox-fs@9cf74e4], which is part of Sysbox CE v0.6.3, so we can remove this workaround. [1]: moby#45687 (comment) [nestybox/sysfs]: https://github.com/nestybox/sysbox-fs/blob/30fd49edbd51048fed8b2ad0af327598d30b29eb/process/process.go#L644-L684 [nestybox/sysbox-fs@9cf74e4]: nestybox/sysbox-fs@9cf74e4 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Depends on: contrib/busybox: Update to FRP-5007-g82accfc19 #45784
Fixes [feature] Allow mounting sub-directories of named volumes #32582
Supersedes, closes Allow mounting a sub-directory of a named volume #39041
- What I did
Make it possible to mount subdirectory of a named volume.
- How I did it
VolumeOptionsnow has aSubpathfield which allows to specify a path relative to the volume that should be mounted as a destination.Symlinks are supported, but they cannot escape the base volume directory.
A protection against the Time-of-check to Time-of-use is implemented for Linux and Windows to make it not possible to replace the mount source with a symlink that escapes the volume directory.
On Linux, all subpath components are opened with openat, relative to the base volume directory and checked against the volume escape. The final file descriptor is mounted from the /proc/self/fd/ to a temporary mount point owned by the daemon and then passed to the underlying container runtime. Temporary mountpoint is removed after the container is started.
On Windows, all components of the path are locked before the check, and released once the path is already mounted.
- How to verify it
TestRunMountVolumeSubdirintegration test- Description for the changelog
Add
Subpathfield to theVolumeOptionsmaking it possible to mount a subpath of a volume.- A picture of a cute animal (not mandatory but encouraged)
