71 lines
3.2 KiB
Python
71 lines
3.2 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""docker-run volume-path gate (v0.125.0, scenario D) — the class behind the v0.124.0 HIGH
|
|
finding: a `docker … -v <path>` mount whose host side is a CONTROLLER-LOCAL path (os.MkdirTemp
|
|
etc.) resolves against the GUEST filesystem when the controller runs containerized, silently
|
|
stranding data. Every `"-v"` argument in non-test Go code must be on the explicit allowlist
|
|
below; anything new fails the gate until it is reviewed and either rewritten (docker cp
|
|
streaming — appexport's pattern) or proven host-visible and allowlisted WITH ITS WHY.
|
|
|
|
Run from controller/: python scripts/docker_run_volume_path_gate.py
|
|
"""
|
|
import io, os, re, sys
|
|
|
|
ROOTS = ["internal", "cmd"]
|
|
|
|
# (file suffix, substring that must appear on the "-v" line, why it is safe)
|
|
ALLOWLIST = [
|
|
("internal/appbackup/dbdump.go", '"psql", "-v"',
|
|
"psql's own -v flag (ON_ERROR_STOP) — not a docker mount at all"),
|
|
("internal/appexport/export.go", '"create", "-v", volName+":/vol"',
|
|
"named-volume mount (no host path): docker resolves volume names daemon-side; the tar "
|
|
"itself streams via docker cp (v0.125.0)"),
|
|
("internal/backup/backup.go", '"-v", volName+":/vol:ro"',
|
|
"Tier-1 volume dump, named-volume source — daemon-side, no host path"),
|
|
("internal/backup/backup.go", '"-v", dumpDir+":/out"',
|
|
"Tier-1 volume dump target: dumpDir is ALWAYS a registered-drive namespace path "
|
|
"(/mnt/** or /opt/docker/** — the golden deployment bind-mounts these into the "
|
|
"controller container at IDENTICAL paths, so the daemon resolves them correctly; "
|
|
"verified by container-inspect 2026-07-13)"),
|
|
("internal/backup/restore.go", '"-v", volName+":/vol"',
|
|
"Tier-1 volume restore, named-volume dest — daemon-side"),
|
|
("internal/backup/restore.go", '"-v", dumpDir+":/in:ro"',
|
|
"Tier-1 volume restore source: same registered-drive namespace argument as the dump "
|
|
"target above — host-visible by the identical binds"),
|
|
("internal/web/handlers.go", '"compose", "down", "-v"',
|
|
"docker compose's own --volumes flag (DR reset wipes the stack's volumes) — not a mount"),
|
|
]
|
|
|
|
VLINE = re.compile(r'"-v"')
|
|
|
|
|
|
def allowed(path, line):
|
|
p = path.replace("\\", "/")
|
|
for suffix, marker, _why in ALLOWLIST:
|
|
if p.endswith(suffix) and marker in line:
|
|
return True
|
|
return False
|
|
|
|
|
|
def main():
|
|
hits = 0
|
|
for root in ROOTS:
|
|
for dirpath, _dirs, files in os.walk(root):
|
|
for fn in files:
|
|
if not fn.endswith(".go") or fn.endswith("_test.go"):
|
|
continue
|
|
path = os.path.join(dirpath, fn)
|
|
for lineno, line in enumerate(io.open(path, encoding="utf-8"), 1):
|
|
if VLINE.search(line) and not allowed(path, line):
|
|
hits += 1
|
|
print("%s:%d %s" % (path, lineno,
|
|
line.strip()[:100].encode("ascii", "backslashreplace").decode()))
|
|
if hits:
|
|
print("DOCKER -v GATE FAILED: %d unreviewed '-v' argument(s) — rewrite as docker cp "
|
|
"streaming or allowlist with a WHY" % hits)
|
|
sys.exit(1)
|
|
print("docker -v gate OK — every volume mount is named-volume or proven host-visible")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|