fix(delivery): support rootless Podman in volume direct copy#275
Conversation
Rootless Podman volumes have mountpoints inside a user namespace that the host process cannot write to directly. When the helper-container path fails and we fall back to populateVolumeDirectCopy, detect Podman via filepath.Base and pipe the binary through `podman unshare sh -c` instead of os.WriteFile. Docker behavior is unchanged.
Pass destPath as a positional argument ($1) to sh -c instead of interpolating it into the script string, preventing shell injection if the volume mountpoint contains metacharacters.
✅ Deploy Preview for devsydev canceled.
|
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
podman unsharefallback inpopulateVolumeDirectCopyso the direct-copy path works with rootless Podman volumes whose mountpoints are inside a user namespacefilepath.Base(dockerCommand())and route topopulateVolumeViaUnsharewhich pipes binary data throughpodman unshare sh -c 'cat > "$1" && chmod 755 "$1"' -- <path>$1) to prevent shell injection from volume mountpoint paths