Skip to content

fix(docker): prevent root-owned bind mount directories #160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kubuxu wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(docker): prevent root-owned bind mount directories #160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 13 additions & 9 deletions src/commands/build/docker.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,15 @@
//!
//! This module handles Docker image building and container execution for project builds.

use crate::docker::push_bind_mount;
use crate::docker::{
build::build_docker_image,
core::{get_current_gid, get_current_uid, image_exists},
};
use crate::embedded_assets;
use crate::paths::foc_devnet_docker_volumes_cache;
use std::collections::HashMap;
use std::fs;
use std::path::Path;
use tracing::info;

use super::Project;
Expand Down Expand Up @@ -89,11 +90,17 @@ pub fn setup_docker_run_args(
container_name,
"-e".to_string(),
"HOME=/home/foc-user".to_string(),
"-v".to_string(),
format!("{}:{}", source_dir, container_source_dir),
"-v".to_string(),
format!("{}:{}", output_dir, container_output_dir),
];
push_bind_mount(
&mut docker_run_args,
Path::new(source_dir),
container_source_dir,
)?;
push_bind_mount(
&mut docker_run_args,
Path::new(output_dir),
container_output_dir,
)?;
Comment on lines +94 to +103

@Kubuxu Kubuxu Jul 30, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The point of this is to create these directories in general. Yes, we could special case source directories but that is nitpicking.


// Load and apply volume mappings for this image
let volume_map = load_volume_map("builder")?;
Expand All @@ -103,10 +110,7 @@ pub fn setup_docker_run_args(

for (host_subdir, container_path) in volume_map {
let host_path = image_volumes_dir.join(&host_subdir);
// Ensure the directory exists
fs::create_dir_all(&host_path)?;
docker_run_args.push("-v".to_string());
docker_run_args.push(format!("{}:{}", host_path.display(), container_path));
push_bind_mount(&mut docker_run_args, &host_path, &container_path)?;
}
}

Expand Down
60 changes: 30 additions & 30 deletions src/commands/start/curio/daemon.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,9 @@ use crate::commands::start::curio::constants::CURIO_LAYERS;
use crate::docker::command_logger::run_and_log_command_strings;
use crate::docker::init::set_volume_ownership;
use crate::docker::network::{lotus_network_name, pdp_miner_network_name};
use crate::docker::{container_exists, stop_and_remove_container};
use crate::docker::{
container_exists, push_bind_mount, push_read_only_bind_mount, stop_and_remove_container,
};
use crate::paths::{
foc_devnet_bin, foc_devnet_curio_sp_volume, foc_devnet_genesis_sectors_pdp_sp,
foc_devnet_proof_parameters, CONTAINER_FILECOIN_PROOF_PARAMS_PATH,
Expand Down Expand Up @@ -201,35 +203,33 @@ fn build_docker_create_args(
format!("{}:4702", pdp_port),
]);

// Volume mounts
let volume_mounts = vec![
format!(
"{}:/home/foc-user/.curio",
curio_sp_dir.join(".curio").display()
),
format!(
"{}:/home/foc-user/curio/fast-storage",
curio_sp_dir.join("fast-storage").display()
),
format!(
"{}:/home/foc-user/curio/long-term-storage",
curio_sp_dir.join("long-term-storage").display()
),
format!("{}:/usr/local/bin/lotus-bins", bin_dir.display()),
format!(
"{}:/home/foc-user/genesis-sectors:ro",
genesis_sectors_dir.display()
),
format!(
"{}:{}",
proof_params_dir.display(),
CONTAINER_FILECOIN_PROOF_PARAMS_PATH
),
];

for mount in volume_mounts {
docker_args.extend_from_slice(&["-v".to_string(), mount]);
}
// Validated bind mounts
push_bind_mount(
&mut docker_args,
&curio_sp_dir.join(".curio"),
"/home/foc-user/.curio",
)?;
push_bind_mount(
&mut docker_args,
&curio_sp_dir.join("fast-storage"),
"/home/foc-user/curio/fast-storage",
)?;
push_bind_mount(
&mut docker_args,
&curio_sp_dir.join("long-term-storage"),
"/home/foc-user/curio/long-term-storage",
)?;
push_bind_mount(&mut docker_args, &bin_dir, "/usr/local/bin/lotus-bins")?;
push_read_only_bind_mount(
&mut docker_args,
&genesis_sectors_dir,
"/home/foc-user/genesis-sectors",
)?;
push_bind_mount(
&mut docker_args,
&proof_params_dir,
CONTAINER_FILECOIN_PROOF_PARAMS_PATH,
)?;

// Add environment variables using shared builders
let foc_env = build_foc_contract_env_vars(context)?;
Expand Down
17 changes: 9 additions & 8 deletions src/commands/start/curio/db_setup.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ use crate::commands::start::lotus_utils::{build_fullnode_api_info, read_lotus_to
use crate::constants::{
DB_NAME, DB_PASSWORD, DB_USER, POSTGRES_CONTAINER_PORT, SCYLLA_CQL_CONTAINER_PORT,
};
use crate::docker::bind_mount;
use crate::docker::command_logger::run_and_log_command;
use crate::docker::containers::{
lotus_container_name, postgres_container_name, scylla_container_name,
Expand Down Expand Up @@ -172,11 +173,11 @@ fn create_base_cluster(

// Get binary directory for volume mount
let bin_dir = foc_devnet_bin();
let bin_mount = format!("{}:/usr/local/bin/lotus-bins", bin_dir.display());
let bin_mount = bind_mount(&bin_dir, "/usr/local/bin/lotus-bins")?;

// Get lotus-data directory for volume mount (needed for token and LOTUS_PATH)
let lotus_data_dir = foc_devnet_docker_volumes().join("lotus-data");
let lotus_data_mount = format!("{}:/lotus-data", lotus_data_dir.display());
let lotus_data_mount = bind_mount(&lotus_data_dir, "/lotus-data")?;

// Create a unique container name for this operation
let container_name = format!("foc-{}-curio-db-setup-{}", run_id, sp_index);
Expand All @@ -189,9 +190,9 @@ fn create_base_cluster(
&container_name,
"--network",
&pdp_network,
"-v",
"--mount",
&bin_mount,
"-v",
"--mount",
&lotus_data_mount,
];

Expand Down Expand Up @@ -282,11 +283,11 @@ fn create_pdp_layer(context: &SetupContext, sp_index: usize) -> Result<(), Box<d

// Get binary directory for volume mount
let bin_dir = foc_devnet_bin();
let bin_mount = format!("{}:/usr/local/bin/lotus-bins", bin_dir.display());
let bin_mount = bind_mount(&bin_dir, "/usr/local/bin/lotus-bins")?;

// Get lotus-data directory for volume mount (needed for token and LOTUS_PATH)
let lotus_data_dir = foc_devnet_docker_volumes().join("lotus-data");
let lotus_data_mount = format!("{}:/lotus-data", lotus_data_dir.display());
let lotus_data_mount = bind_mount(&lotus_data_dir, "/lotus-data")?;

// Generate PDP layer config with sp_index
let pdp_config = PDP_LAYER_CONFIG_TEMPLATE.replace("{sp_index}", &sp_index.to_string());
Expand All @@ -302,9 +303,9 @@ fn create_pdp_layer(context: &SetupContext, sp_index: usize) -> Result<(), Box<d
&container_name,
"--network",
&pdp_network,
"-v",
"--mount",
&bin_mount,
"-v",
"--mount",
&lotus_data_mount,
];

Expand Down
11 changes: 7 additions & 4 deletions src/commands/start/curio/verification.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

use super::super::step::SetupContext;
use super::constants::TEST_FILE_SIZE_BYTES;
use crate::docker::bind_mount;
use rand::Rng;
use std::error::Error;
use std::fs;
Expand Down Expand Up @@ -124,16 +125,18 @@ fn upload_test_file(

// Mount bin directory where pdptool is located
let bin_dir = crate::paths::foc_devnet_bin();
let file_mount = bind_mount(file_dir, "/tmp/test-data")?;
let bin_mount = bind_mount(&bin_dir, "/usr/local/bin/lotus-bins")?;

let args = [
"run",
"--rm",
"--network",
"host",
"-v",
&format!("{}:/tmp/test-data", file_dir.display()),
"-v",
&format!("{}:/usr/local/bin/lotus-bins", bin_dir.display()),
"--mount",
&file_mount,
"--mount",
&bin_mount,
crate::constants::BUILDER_DOCKER_IMAGE,
"/usr/local/bin/lotus-bins/pdptool",
"upload-piece",
Expand Down
21 changes: 6 additions & 15 deletions src/commands/start/foc_deployer/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,8 @@
use super::foc_metadata::FOCMetadata;
use crate::constants::*;
use crate::docker::core::docker_command;
use crate::paths::{foc_devnet_bin, foc_devnet_docker_volumes_cache};
use crate::docker::push_bind_mount;
use crate::paths::foc_devnet_bin;
use std::error::Error;
use tracing::{info, warn};

Expand Down Expand Up @@ -101,8 +102,6 @@ pub fn deploy_foc_contracts(
}

let bin_dir = foc_devnet_bin();
let builder_volumes_dir =
foc_devnet_docker_volumes_cache().join(crate::constants::BUILDER_CONTAINER);

// Get the private key from lotus for the deployer address
let private_key = get_private_key(params.foc_deployer, params.lotus_container)?;
Expand Down Expand Up @@ -196,22 +195,14 @@ bash /service_contracts/tools/warm-storage-deploy-all.sh 2>&1 | tee /tmp/foc-dep
docker_args.push(format!("{}={}", key, value));
}

// Add volumes
docker_args.push("-v".to_string());
docker_args.push(format!("{}:/opt/bin", bin_dir.display()));
docker_args.push("-v".to_string());
docker_args.push(format!(
"{}:/home/foc-user/.cargo",
builder_volumes_dir.join("cargo").display()
));
docker_args.push("-v".to_string());
docker_args.push(format!("{}:/service_contracts", contracts_dir.display()));
// Add validated bind mounts
push_bind_mount(&mut docker_args, &bin_dir, "/opt/bin")?;
push_bind_mount(&mut docker_args, &contracts_dir, "/service_contracts")?;
if let Some(pdp_repo_path) = params.pdp_repo_path {
let pdp_repo = pdp_repo_path
.canonicalize()
.unwrap_or_else(|_| pdp_repo_path.to_path_buf());
docker_args.push("-v".to_string());
docker_args.push(format!("{}:/service_contracts/lib/pdp", pdp_repo.display()));
push_bind_mount(&mut docker_args, &pdp_repo, "/service_contracts/lib/pdp")?;
}

// Add image and command
Expand Down
17 changes: 6 additions & 11 deletions src/commands/start/genesis/construction/creation.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@
//! This module handles creating the initial genesis file using lotus-seed.

use crate::commands::start::genesis::constants;
use crate::paths::{foc_devnet_bin, foc_devnet_docker_volumes_cache, foc_devnet_genesis};
use crate::docker::push_bind_mount;
use crate::paths::{foc_devnet_bin, foc_devnet_genesis};
use std::fs;
use std::process::Command;
use tracing::info;
Expand Down Expand Up @@ -31,8 +32,6 @@ pub fn create_genesis_file(run_id: &str) -> Result<(), Box<dyn std::error::Error

// Run lotus-seed genesis new in builder container
let bin_dir = foc_devnet_bin();
let builder_volumes_dir =
foc_devnet_docker_volumes_cache().join(crate::constants::BUILDER_CONTAINER);

// Build docker args with network environment variables
let mut docker_args = vec![
Expand All @@ -43,14 +42,10 @@ pub fn create_genesis_file(run_id: &str) -> Result<(), Box<dyn std::error::Error
format!("foc-{}-genesis-creation", run_id),
];

// Add volume mounts and command
docker_args.extend(vec![
"-v".to_string(),
format!("{}:/opt/bin", bin_dir.display()),
"-v".to_string(),
format!("{}:/home/foc-user/.cargo", builder_volumes_dir.join("cargo").display()),
"-v".to_string(),
format!("{}:/genesis", genesis_dir.display()),
// Add validated bind mounts and command
push_bind_mount(&mut docker_args, &bin_dir, "/opt/bin")?;
push_bind_mount(&mut docker_args, &genesis_dir, "/genesis")?;
docker_args.extend([
crate::constants::BUILDER_DOCKER_IMAGE.to_string(),
"/bin/bash".to_string(),
"-c".to_string(),
Expand Down
26 changes: 12 additions & 14 deletions src/commands/start/genesis/construction/miner.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@
//! This module handles adding pre-sealed miners to the genesis file.

use crate::commands::start::genesis::constants;
use crate::docker::push_bind_mount;
use crate::paths::{
foc_devnet_bin, foc_devnet_docker_volumes_cache, foc_devnet_genesis,
foc_devnet_genesis_sectors_lotus_miner, foc_devnet_genesis_sectors_pdp_sp,
foc_devnet_bin, foc_devnet_genesis, foc_devnet_genesis_sectors_lotus_miner,
foc_devnet_genesis_sectors_pdp_sp,
};
use std::path::{Path, PathBuf};
use std::process::Command;
Expand Down Expand Up @@ -75,8 +76,6 @@ fn add_single_miner_to_genesis(
// Run lotus-seed genesis add-miner in builder container
let genesis_dir = foc_devnet_genesis(run_id);
let bin_dir = foc_devnet_bin();
let builder_volumes_dir =
foc_devnet_docker_volumes_cache().join(crate::constants::BUILDER_CONTAINER);

// Build docker args with network environment variables
let mut docker_args = vec![
Expand All @@ -87,16 +86,15 @@ fn add_single_miner_to_genesis(
format!("foc-{}-genesis-add-miner-{}", run_id, miner_id),
];

// Add volume mounts and command
docker_args.extend(vec![
"-v".to_string(),
format!("{}:/opt/bin", bin_dir.display()),
"-v".to_string(),
format!("{}:/home/foc-user/.cargo", builder_volumes_dir.join("cargo").display()),
"-v".to_string(),
format!("{}:/genesis", genesis_dir.display()),
"-v".to_string(),
format!("{}:/home/foc-user/.genesis-sectors", miner_dir.display()),
// Add validated bind mounts and command
push_bind_mount(&mut docker_args, &bin_dir, "/opt/bin")?;
push_bind_mount(&mut docker_args, &genesis_dir, "/genesis")?;
push_bind_mount(
&mut docker_args,
miner_dir,
"/home/foc-user/.genesis-sectors",
)?;
docker_args.extend([
crate::constants::BUILDER_DOCKER_IMAGE.to_string(),
"/bin/bash".to_string(),
"-c".to_string(),
Expand Down
22 changes: 7 additions & 15 deletions src/commands/start/genesis/construction/signers.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,8 @@

use crate::commands::start::genesis::constants;
use crate::commands::start::genesis::keys::get_bls_addresses;
use crate::paths::{
foc_devnet_bin, foc_devnet_docker_volumes_cache, foc_devnet_genesis, foc_devnet_lotus_keys,
};
use crate::docker::push_bind_mount;
use crate::paths::{foc_devnet_bin, foc_devnet_genesis, foc_devnet_lotus_keys};
use std::process::Command;
use tracing::info;

Expand Down Expand Up @@ -49,8 +48,6 @@ pub fn add_signers_to_genesis(run_id: &str) -> Result<(), Box<dyn std::error::Er

// Run lotus-seed genesis set-signers in builder container
let bin_dir = foc_devnet_bin();
let builder_volumes_dir =
foc_devnet_docker_volumes_cache().join(crate::constants::BUILDER_CONTAINER);

// Build docker args with network environment variables
let mut docker_args = vec![
Expand All @@ -61,16 +58,11 @@ pub fn add_signers_to_genesis(run_id: &str) -> Result<(), Box<dyn std::error::Er
format!("foc-{}-genesis-signers", run_id),
];

// Add volume mounts and command
docker_args.extend(vec![
"-v".to_string(),
format!("{}:/opt/bin", bin_dir.display()),
"-v".to_string(),
format!("{}:/home/foc-user/.cargo", builder_volumes_dir.join("cargo").display()),
"-v".to_string(),
format!("{}:/genesis", genesis_dir.display()),
"-v".to_string(),
format!("{}:/keys", keys_dir.display()),
// Add validated bind mounts and command
push_bind_mount(&mut docker_args, &bin_dir, "/opt/bin")?;
push_bind_mount(&mut docker_args, &genesis_dir, "/genesis")?;
push_bind_mount(&mut docker_args, &keys_dir, "/keys")?;
docker_args.extend([
crate::constants::BUILDER_DOCKER_IMAGE.to_string(),
"/bin/bash".to_string(),
"-c".to_string(),
Expand Down
Loading