fix(agent): minimal env and explicit project dir for compose, resolve every config file's symlinks (#7)

internal/agent/updater/override.go

@@ -133,7 +133,7 @@ func MountRoots(ctx context.Context, cli SelfInspector, selfID string) ([]string
 
 // composeFiles returns the -f arguments for a job: the stack's config files
 // from the container label with any copy of the override removed, then the
-// override last so it wins. Every file, and the real location of the stack
+// override last so it wins. Every file, and the real location of its
 // directory after resolving symlinks, must be inside one of roots.
 func composeFiles(roots []string, configFilesLabel string) (files []string, dir string, err error) {
 	if len(roots) == 0 {
@@ -149,19 +149,7 @@ func composeFiles(roots []string, configFilesLabel string) (files []string, dir
 	}
 	dir = filepath.Dir(files[0])
 	override := filepath.Join(dir, OverrideName)
-	out := files[:0]
-	for _, f := range files {
-		if !filepath.IsAbs(f) || !insideAny(roots, f) {
-			return nil, "", notMounted(filepath.Dir(f))
-		}
-		if filepath.Clean(f) != override {
-			out = append(out, f)
-		}
-	}
-	real, err := filepath.EvalSymlinks(dir)
-	if err != nil {
-		return nil, "", fmt.Errorf("resolve %s: %w", dir, err)
-	}
+
 	// Only directories count once resolved: this drops a same-path mount of
 	// a single file such as /var/run/docker.sock.
 	var realRoots []string
@@ -172,8 +160,21 @@ func composeFiles(roots []string, configFilesLabel string) (files []string, dir
 			}
 		}
 	}
-	if !insideAny(realRoots, real) {
-		return nil, "", notMounted(dir)
+	out := files[:0]
+	for _, f := range files {
+		if !filepath.IsAbs(f) || !insideAny(roots, f) {
+			return nil, "", notMounted(filepath.Dir(f))
+		}
+		real, err := filepath.EvalSymlinks(filepath.Dir(f))
+		if err != nil {
+			return nil, "", fmt.Errorf("resolve %s: %w", filepath.Dir(f), err)
+		}
+		if !insideAny(realRoots, real) {
+			return nil, "", notMounted(filepath.Dir(f))
+		}
+		if filepath.Clean(f) != override {
+			out = append(out, f)
+		}
 	}
 	return append(out, override), dir, nil
 }