container/volumes¶

Mount specs for a container created by the generic containerStart action.

A semicolon-separated list of --mount specs passed to container create, one --mount flag per entry, e.g. "type=bind,source=/host/data,target=/data;type=volume,source=myvol,target=/vol".

Each entry follows the container engine's own --mount syntax and is passed through unmodified. This is in addition to the plugin's own automatic bind mounts of drpcli and its helpers into the container.

The default is empty, which adds no extra mounts.

Security: the right to set this is equivalent to root on the plugin host. The mount specs are passed through unmodified and no path is refused, so a caller can mount any part of the host filesystem into the container -- type=bind,source=/,target=/host mounts the whole root, and mounting the container engine's own socket hands over control of every container on the box. Either is a complete escape onto the host that runs dr-provision.

Treat the claim that authorizes containerStart as a host-root claim, not as an ordinary container-management permission, and see container/startup-options for the same warning about runtime flags.

Objects that Reference container/volumes¶

Not used in current content packs

Objects used by container/volumes¶

Not used in current content packs