Remove colons in VOLUME mappings on Windows.

Attempting to run Windows images with VOLUME declarations which are
absolute paths would lead to `securejoin.SecureJoin()` concatenating
two absolute paths when determining the host mount dir and then
failing to `os.Lstat()` the resulting path, as it contained an
illegal second `:`.

Signed-off-by: Nashwan Azhari <nazhari@cloudbasesolutions.com>

cmd/nerdctl/container_run_mount.go

@@ -37,7 +37,6 @@ import (
 	"github.com/containerd/nerdctl/pkg/mountutil"
 	"github.com/containerd/nerdctl/pkg/mountutil/volumestore"
 	"github.com/containerd/nerdctl/pkg/strutil"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/opencontainers/image-spec/identity"
 	"github.com/opencontainers/runtime-spec/specs-go"
 
@@ -228,7 +227,7 @@ func generateMountOpts(ctx context.Context, cmd *cobra.Command, client *containe
 			ociMounts[i] = x.Mount
 			mounted[filepath.Clean(x.Mount.Destination)] = struct{}{}
 
-			target, err := securejoin.SecureJoin(tempDir, x.Mount.Destination)
+			target, err := joinHostPath(tempDir, x.Mount.Destination)
 			if err != nil {
 				return nil, nil, nil, err
 			}
@@ -269,7 +268,7 @@ func generateMountOpts(ctx context.Context, cmd *cobra.Command, client *containe
 			return nil, nil, nil, err
 		}
 
-		target, err := securejoin.SecureJoin(tempDir, imgVol)
+		target, err := joinHostPath(tempDir, imgVol)
 		if err != nil {
 			return nil, nil, nil, err
 		}

cmd/nerdctl/container_run_mount_other.go

@@ -0,0 +1,30 @@
+//go:build !windows
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	securejoin "github.com/cyphar/filepath-securejoin"
+)
+
+// Joins the given host path with the given guest path while guaranteeing the provided
+// path is scoped within the host path. (i.e. joining with `../..` or symlinks cannot
+// lead to a higher level path than the provided hostPath, and are simply ignored)
+func joinHostPath(hostPath string, guestPath string) (string, error) {
+	return securejoin.SecureJoin(hostPath, guestPath)
+}

cmd/nerdctl/container_run_mount_windows.go

@@ -0,0 +1,40 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"path/filepath"
+	"strings"
+
+	securejoin "github.com/cyphar/filepath-securejoin"
+)
+
+// Joins the given host path with the given guest path while guaranteeing the provided
+// path is scoped within the host path. (i.e. joining with `../..` or symlinks cannot
+// lead to a higher level path than the provided hostPath, and are simply ignored)
+// Any colons in the guest path will be removed completely in order to have a valid
+// host path while maining the guest path's drive letter.
+func joinHostPath(hostPath string, guestPath string) (string, error) {
+	if filepath.IsAbs(guestPath) {
+		// NOTE: both `filepath.Join()` and `securepath.SecureJoin()` concatenate
+		// absolute paths on Windows, so we must check and substitute the imfVol drive.
+		// This will lead to SecureJoin("C:\c1\c2", "D\d1\d2") => "C:\c1\c2\D\d1\d2".
+		guestPath = strings.ReplaceAll(guestPath, ":", "")
+	}
+
+	return securejoin.SecureJoin(hostPath, guestPath)
+}