From c432f701dd8c37689fec568e2471c20fa7170414 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 2 Aug 2026 15:11:08 +0200 Subject: [PATCH] gate: allowlist appexport/estimate.go named-volume -v mount (R-29 leg a) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit realVolumeSize mounts the NAMED VOLUME read-only into a throwaway alpine to du it from a container view. No host path is involved — docker resolves the volume name daemon-side — so it is the same safe class as the internal/backup/backup.go entry. The gate was right to demand review; this diff is that review, on its own, because burying an allowlist widening inside a feature commit is how an allowlist stops meaning anything. Tooling only: no Go change, no build, no deploy, no version bump. --- controller/scripts/docker_run_volume_path_gate.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/controller/scripts/docker_run_volume_path_gate.py b/controller/scripts/docker_run_volume_path_gate.py index 02a6a48..9ca77f0 100644 --- a/controller/scripts/docker_run_volume_path_gate.py +++ b/controller/scripts/docker_run_volume_path_gate.py @@ -16,6 +16,10 @@ ROOTS = ["internal", "cmd"] ALLOWLIST = [ ("internal/appbackup/dbdump.go", '"psql", "-v"', "psql's own -v flag (ON_ERROR_STOP) — not a docker mount at all"), + ("internal/appexport/estimate.go", '"-v", volumeName+":/vol:ro"', + "realVolumeSize's container-view `du`: named-volume source (no host path) mounted read-only " + "into a throwaway alpine — docker resolves the volume name daemon-side, exactly the class of " + "the internal/backup/backup.go entry below. Reviewed 2026-08-02 (R-29 leg a)"), ("internal/appexport/export.go", '"create", "-v", volName+":/vol"', "named-volume mount (no host path): docker resolves volume names daemon-side; the tar " "itself streams via docker cp (v0.125.0)"),