fix(agent): minimal env and explicit project dir for compose, resolve every config file's symlinks (#7)

2026-10-12 19:13:25 +02:00
parent 8b2c10cc05
commit 93ba6915b9
8 changed files with 86 additions and 25 deletions
@@ -185,6 +185,11 @@ func TestComposeFiles(t *testing.T) {
 		_, _, err := composeFiles([]string{root}, filepath.Join(root, "evil", "compose.yaml"))
 		assert.EqualError(t, err, "stack directory "+filepath.Join(root, "evil")+" is not mounted into the agent at the same path (read-write)")
 	})
+	t.Run("second file under a symlink escaping the root", func(t *testing.T) {
+		label := filepath.Join(a, "compose.yaml") + "," + filepath.Join(root, "evil", "extra.yaml")
+		_, _, err := composeFiles([]string{root}, label)
+		assert.ErrorContains(t, err, "not mounted")
+	})
 	t.Run("prefix trick", func(t *testing.T) {
 		evil := root + "-evil"
 		require.NoError(t, os.MkdirAll(evil, 0o755))