R-1214: the capped copy refuses any path with a symlink in it (security review: a link under /mnt pointing outside resolves elsewhere for the daemon); red-proved; unreleased

controller/internal/backup/r1214_capped_copy_test.go

@@ -91,3 +91,24 @@ func TestR1214_ANotStartedContainerFallsBackAnRsyncErrorDoesNot(t *testing.T) {
 		t.Fatalf("no readable image → the plain copy: %v", err)
 	}
 }
+
+// A symlink under the capped root that points elsewhere must never reach the container (the daemon would resolve it
+// somewhere else, and `--delete` would mirror that over the copy) — the security review's case.
+// RED-PROOF: with the EvalSymlinks check removed, this fails — seen failing 2026-10-22.
+func TestR1214_ASymlinkedPathNeverGoesToDocker(t *testing.T) {
+	root := t.TempDir() + "/"
+	elsewhere := t.TempDir()
+	os.WriteFile(filepath.Join(elsewhere, "f"), []byte("x"), 0644)
+	link := filepath.Join(root, "drive1", "unit")
+	os.MkdirAll(filepath.Dir(link), 0755)
+	if err := os.Symlink(elsewhere, link); err != nil {
+		t.Fatal(err)
+	}
+	rec := withSeams(t, root, "img", func([]string) ([]byte, int, error) { return nil, 0, nil })
+	if err := rsyncMirror(link, filepath.Join(root, "drive2", "unit")); err != nil {
+		t.Fatal(err)
+	}
+	if len(rec.calls) != 0 {
+		t.Fatalf("a symlinked path went to the container: %v", rec.calls)
+	}
+}

controller/internal/backup/tier2.go

@@ -818,9 +818,15 @@ func rsyncMirror(src, dst string) error {
 const tier2CopyMemCap = "512m"
 
 // tier2CappedPath: a path the controller and the Docker daemon see identically (the guest's /mnt is bind-mounted into
-// the controller at /mnt). Never a relative path, never `..`.
+// the controller at /mnt). Never a relative path, never `..`, and NO SYMLINK anywhere in it: a link under /mnt that
+// points outside /mnt resolves to a different place for the daemon (found by the commit's security review,
+// 2026-10-22) — the path must resolve to itself. The path must exist (rsyncMirror creates dst first).
 func tier2CappedPath(p string) bool {
-	return strings.HasPrefix(p, tier2CappedRoot) && filepath.Clean(p) == p
+	if !strings.HasPrefix(p, tier2CappedRoot) || filepath.Clean(p) != p {
+		return false
+	}
+	real, err := filepath.EvalSymlinks(p)
+	return err == nil && real == p
 }
 
 // tier2CappedRoot is "/mnt/" in production (a test seam: tests point it at a temp dir).