fix: avoid deleting root filesystem when KANIKO_DIR not set #160
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
johnstcn
force-pushed
the
cj/check-kaniko-dir
branch
from
e334b62 to
ee43ba7
Compare
mafredri
approved these changes
Apr 29, 2024
| > **Note:** Envbuilder performs destructive filesystem operations! To guard against accidental data | ||
| > loss, it will refuse to run if it detects that KANIKO_DIR is not set to a specific value. | ||
| > If you need to bypass this behaviour for any reason, you can bypass this safety check by setting | ||
| > `FORCE_SAFE=true`. |
There was a problem hiding this comment.
I'd love for us to start using the ENVBUILDER_ prefix for our envs, can we start now?
There was a problem hiding this comment.
I'll do this in a separate PR. This isn't a new option, it's been there all the time but not doing anything.
|
|
||
| // maybeDeleteFilesystem wraps util.DeleteFilesystem with a guard to hopefully stop | ||
| // folks from unwittingly deleting their entire root directory. | ||
| func maybeDeleteFilesystem(force bool) error { |
There was a problem hiding this comment.
It's technically correct!
Co-authored-by: Mathias Fredriksson <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #144
Running
envbuilderoutside of a container as root can result in it nuking your entire FS if you're not careful.Adds a check if
KANIKO_DIRis not set toMagicDir(a.k.a./.envbuilder) and bails early.This behaviour can be overridden with
FORCE_SAFE=true.