upstream/terraform-provider-docker
1
0
Fork 0
mirror of https://github.com/kreuzwerker/terraform-provider-docker.git synced 2026-02-02 11:49:29 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(container): omit sending systempaths=unconfied to daemon (#796)

Browse source
This commit is contained in:
Martin 2025-09-28 22:35:16 +02:00 committed by GitHub
parent 9a17ba0670
commit 949a709069
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 23 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
internal/provider/resource_docker_container_funcs.go
View file

@ -304,7 +304,10 @@ func resourceDockerContainerCreate(ctx context.Context, d *schema.ResourceData,
}
if v, ok := d.GetOk("security_opts"); ok {
hostConfig.SecurityOpt = stringSetToStringSlice(v.(*schema.Set))
securityOpts, maskedPaths, readonlyPaths := parseSystemPaths(stringSetToStringSlice(v.(*schema.Set)))
hostConfig.SecurityOpt = securityOpts
hostConfig.MaskedPaths = maskedPaths
hostConfig.ReadonlyPaths = readonlyPaths
}
if v, ok := d.GetOk("memory"); ok {
@ -648,6 +651,25 @@ func resourceDockerContainerCreate(ctx context.Context, d *schema.ResourceData,
return resourceDockerContainerRead(ctx, d, meta)
}
// parseSystemPaths checks if `systempaths=unconfined` security option is set,
// and returns the `MaskedPaths` and `ReadonlyPaths` accordingly. An updated
// list of security options is returned with this option removed, because the
// `unconfined` option is handled client-side, and should not be sent to the
// daemon.
func parseSystemPaths(securityOpts []string) (filtered, maskedPaths, readonlyPaths []string) {
filtered = securityOpts[:0]
for _, opt := range securityOpts {
if opt == "systempaths=unconfined" {
maskedPaths = []string{}
readonlyPaths = []string{}
} else {
filtered = append(filtered, opt)
}
}
return filtered, maskedPaths, readonlyPaths
}
func resourceDockerContainerRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
containerReadRefreshTimeoutMilliseconds := d.Get("container_read_refresh_timeout_milliseconds").(int)
// Ensure the timeout can never be 0, the default integer value.