diff options
Diffstat (limited to 'internal/pkg/exec.go')
| -rw-r--r-- | internal/pkg/exec.go | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/internal/pkg/exec.go b/internal/pkg/exec.go index 930624fc..c1e0cc34 100644 --- a/internal/pkg/exec.go +++ b/internal/pkg/exec.go @@ -91,6 +91,13 @@ func (a *execNetArtifact) Cure(c *CureContext) error { // The working and temporary directories are both created and mounted writable // on /work and /tmp respectively. // +// If the first path targets [fhs.AbsRoot], it is made writable via an overlay +// mount with writes going to an ephemeral tmpfs bound to the lifetime of the +// container. This is primarily to make it possible for [container] to set up +// mount points targeting paths not available in the [Artifact] backing root, +// and to accommodate poorly written programs that insist on writing to awkward +// paths, it must not be used as scratch space. +// // If checksum is non-nil, the resulting [Artifact] implements [KnownChecksum] // and its container runs in the host net namespace. // @@ -262,6 +269,10 @@ func (a *execArtifact) cure(c *CureContext, hostNet bool) (err error) { z.Dir, z.Env, z.Path, z.Args = a.dir, a.env, a.path, a.args z.Grow(len(paths) + 4) + if len(paths) > 0 && paths[0][1].Is(fhs.AbsRoot) { + z.OverlayEphemeral(fhs.AbsRoot, paths[0][0]) + paths = paths[1:] + } for _, b := range paths { z.Bind(b[0], b[1], 0) } |