Merge pull request #14613 from stefanberger/nohidevols2

Do not hide user provided network mounts [v2]

daemon/container_unix.go

@@ -363,6 +363,26 @@ func (container *Container) GetSize() (int64, int64) {
 	return sizeRw, sizeRootfs
 }
 
+// Attempt to set the network mounts given a provided destination and
+// the path to use for it; return true if the given destination was a
+// network mount file
+func (container *Container) trySetNetworkMount(destination string, path string) bool {
+	if destination == "/etc/resolv.conf" {
+		container.ResolvConfPath = path
+		return true
+	}
+	if destination == "/etc/hostname" {
+		container.HostnamePath = path
+		return true
+	}
+	if destination == "/etc/hosts" {
+		container.HostsPath = path
+		return true
+	}
+
+	return false
+}
+
 func (container *Container) buildHostnameFile() error {
 	hostnamePath, err := container.GetRootResourcePath("hostname")
 	if err != nil {

daemon/volumes_linux.go

@@ -36,12 +36,13 @@ func (container *Container) setupMounts() ([]execdriver.Mount, error) {
 		if err != nil {
 			return nil, err
 		}
-
-		mounts = append(mounts, execdriver.Mount{
-			Source:      path,
-			Destination: m.Destination,
-			Writable:    m.RW,
-		})
+		if !container.trySetNetworkMount(m.Destination, path) {
+			mounts = append(mounts, execdriver.Mount{
+				Source:      path,
+				Destination: m.Destination,
+				Writable:    m.RW,
+			})
+		}
 	}
 
 	mounts = sortMounts(mounts)

integration-cli/docker_cli_run_test.go

@@ -2516,3 +2516,25 @@ func (s *DockerSuite) TestRunWriteFilteredProc(c *check.C) {
 		}
 	}
 }
+
+func (s *DockerSuite) TestRunNetworkFilesBindMount(c *check.C) {
+	testRequires(c, SameHostDaemon)
+	name := "test-nwfiles-mount"
+
+	f, err := ioutil.TempFile("", name)
+	c.Assert(err, check.IsNil)
+
+	filename := f.Name()
+	defer os.Remove(filename)
+
+	expected := "test123"
+
+	err = ioutil.WriteFile(filename, []byte(expected), 0644)
+	c.Assert(err, check.IsNil)
+
+	var actual string
+	actual, _ = dockerCmd(c, "run", "-v", filename+":/etc/resolv.conf", "busybox", "cat", "/etc/resolv.conf")
+	if actual != expected {
+		c.Fatalf("expected resolv.conf be: %q, but was: %q", expected, actual)
+	}
+}