Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased

controller/internal/backup/r1214_capped_copy_test.go

@@ -20,7 +20,9 @@ type cappedRec struct{ calls [][]string }
 func withSeams(t *testing.T, root string, img string, run func(args []string) ([]byte, int, error)) *cappedRec {
 	t.Helper()
 	rec := &cappedRec{}
-	oldRoot, oldImg, oldRun, oldLog := tier2CappedRoot, tier2SelfImage, tier2RunCapped, tier2Logf
+	oldRoot, oldImg, oldRun, oldLog, oldDocker := tier2CappedRoot, tier2SelfImage, tier2RunCapped, tier2Logf, tier2Docker
+	// The copy's lifecycle commands (rm -f by name) never reach Docker from a test (they would act on the host).
+	tier2Docker = func(context.Context, ...string) ([]byte, error) { return nil, nil }
 	tier2CappedRoot = root
 	tier2SelfImage = func() string { return img }
 	tier2RunCapped = func(_ context.Context, args []string) ([]byte, int, error) {
@@ -28,7 +30,9 @@ func withSeams(t *testing.T, root string, img string, run func(args []string) ([
 		return run(args)
 	}
 	tier2Logf = func(string, ...any) {}
-	t.Cleanup(func() { tier2CappedRoot, tier2SelfImage, tier2RunCapped, tier2Logf = oldRoot, oldImg, oldRun, oldLog })
+	t.Cleanup(func() {
+		tier2CappedRoot, tier2SelfImage, tier2RunCapped, tier2Logf, tier2Docker = oldRoot, oldImg, oldRun, oldLog, oldDocker
+	})
 	return rec
 }
 
@@ -44,8 +48,9 @@ func TestR1214_MntPathsAreCopiedCapped(t *testing.T) {
 		t.Fatalf("docker calls = %d, want 1", len(rec.calls))
 	}
 	got := strings.Join(rec.calls[0], " ")
-	for _, want := range []string{"run --rm", "--memory 512m", "--memory-swap 512m", "--network none",
-		"-v " + src + ":" + src + ":ro", "-v " + dst + ":" + dst + " ", "--entrypoint rsync gitea.dooplex.hu/admin/felhom-controller:9.9.9 -a --delete " + src + "/ " + dst + "/"} {
+	for _, want := range []string{"run --rm", "--memory 512m", "--memory-swap 512m", "--network none", "--pull never",
+		"--mount type=bind,src=" + src + ",dst=" + src + ",readonly", "--mount type=bind,src=" + dst + ",dst=" + dst + " ",
+		"--entrypoint rsync gitea.dooplex.hu/admin/felhom-controller:9.9.9 -a --delete " + src + "/ " + dst + "/"} {
 		if !strings.Contains(got, want) {
 			t.Fatalf("the capped copy lacks %q:\n%s", want, got)
 		}