reiabreu opened a new pull request, #9010: URL: https://github.com/apache/storm/pull/9010
run-oci-container parses the launch command file before setup_dir_permissions changes the worker directory's ownership, and requires the command file's username to match the user passed to the worker-launcher. run_oci_container now takes the parsed oci_launch_cmd, which main owns and frees. Bind-mount sources must be absolute paths with no "." or ".." component, equal to or under a directory listed in the new `worker.launcher.oci.allowed.mount.source.dirs` config key; if none are configured, all sources are rejected. ## How this was tested Built the worker-launcher native tree with `autoreconf -i && ./configure && make check` (autotools, compiled with `-Werror`); the test suite passes. Adds `test_mount_path_helpers` and `test_mount_source_allowed_dirs`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
