controller: .fab volume legs stream via docker cp (fixes the containerized path-strand data loss, IA finding 1 HIGH) — zero shared paths both deployment shapes; export fails LOUD on any missing/empty claimed tar (no hollow bundles); import validates BEFORE it destroys (hollow bundle → app untouched); docker_run_volume_path_gate.py extinguishes the class (Tier-1/2 mounts documented host-visible)

Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC
2026-07-13 10:42:02 +02:00
parent 811a0ef7a7
commit 466f42708e
5 changed files with 489 additions and 46 deletions
@@ -0,0 +1,70 @@
+# -*- coding: utf-8 -*-
+"""docker-run volume-path gate (v0.125.0, scenario D) — the class behind the v0.124.0 HIGH
+finding: a `docker … -v <path>` mount whose host side is a CONTROLLER-LOCAL path (os.MkdirTemp
+etc.) resolves against the GUEST filesystem when the controller runs containerized, silently
+stranding data. Every `"-v"` argument in non-test Go code must be on the explicit allowlist
+below; anything new fails the gate until it is reviewed and either rewritten (docker cp
+streaming — appexport's pattern) or proven host-visible and allowlisted WITH ITS WHY.
+
+Run from controller/:  python scripts/docker_run_volume_path_gate.py
+"""
+import io, os, re, sys
+
+ROOTS = ["internal", "cmd"]
+
+# (file suffix, substring that must appear on the "-v" line, why it is safe)
+ALLOWLIST = [
+    ("internal/appbackup/dbdump.go", '"psql", "-v"',
+     "psql's own -v flag (ON_ERROR_STOP) — not a docker mount at all"),
+    ("internal/appexport/export.go", '"create", "-v", volName+":/vol"',
+     "named-volume mount (no host path): docker resolves volume names daemon-side; the tar "
+     "itself streams via docker cp (v0.125.0)"),
+    ("internal/backup/backup.go", '"-v", volName+":/vol:ro"',
+     "Tier-1 volume dump, named-volume source — daemon-side, no host path"),
+    ("internal/backup/backup.go", '"-v", dumpDir+":/out"',
+     "Tier-1 volume dump target: dumpDir is ALWAYS a registered-drive namespace path "
+     "(/mnt/** or /opt/docker/** — the golden deployment bind-mounts these into the "
+     "controller container at IDENTICAL paths, so the daemon resolves them correctly; "
+     "verified by container-inspect 2026-07-13)"),
+    ("internal/backup/restore.go", '"-v", volName+":/vol"',
+     "Tier-1 volume restore, named-volume dest — daemon-side"),
+    ("internal/backup/restore.go", '"-v", dumpDir+":/in:ro"',
+     "Tier-1 volume restore source: same registered-drive namespace argument as the dump "
+     "target above — host-visible by the identical binds"),
+    ("internal/web/handlers.go", '"compose", "down", "-v"',
+     "docker compose's own --volumes flag (DR reset wipes the stack's volumes) — not a mount"),
+]
+
+VLINE = re.compile(r'"-v"')
+
+
+def allowed(path, line):
+    p = path.replace("\\", "/")
+    for suffix, marker, _why in ALLOWLIST:
+        if p.endswith(suffix) and marker in line:
+            return True
+    return False
+
+
+def main():
+    hits = 0
+    for root in ROOTS:
+        for dirpath, _dirs, files in os.walk(root):
+            for fn in files:
+                if not fn.endswith(".go") or fn.endswith("_test.go"):
+                    continue
+                path = os.path.join(dirpath, fn)
+                for lineno, line in enumerate(io.open(path, encoding="utf-8"), 1):
+                    if VLINE.search(line) and not allowed(path, line):
+                        hits += 1
+                        print("%s:%d  %s" % (path, lineno,
+                              line.strip()[:100].encode("ascii", "backslashreplace").decode()))
+    if hits:
+        print("DOCKER -v GATE FAILED: %d unreviewed '-v' argument(s) — rewrite as docker cp "
+              "streaming or allowlist with a WHY" % hits)
+        sys.exit(1)
+    print("docker -v gate OK — every volume mount is named-volume or proven host-visible")
+
+
+if __name__ == "__main__":
+    main()