Fix: allow directories for --device and in-container path (fix #2985)

cmd/nerdctl/container_run_cgroup_linux_test.go

@@ -212,39 +212,46 @@ func TestRunDevice(t *testing.T) {
 func TestParseDevice(t *testing.T) {
 	t.Parallel()
 	type testCase struct {
-		s               string
-		expectedDevPath string
-		expectedMode    string
-		err             string
+		s                     string
+		expectedDevPath       string
+		expectedContainerPath string
+		expectedMode          string
+		err                   string
 	}
 	testCases := []testCase{
 		{
-			s:               "/dev/sda1",
-			expectedDevPath: "/dev/sda1",
-			expectedMode:    "rwm",
+			s:                     "/dev/sda1",
+			expectedDevPath:       "/dev/sda1",
+			expectedContainerPath: "/dev/sda1",
+			expectedMode:          "rwm",
 		},
 		{
-			s:               "/dev/sda2:r",
-			expectedDevPath: "/dev/sda2",
-			expectedMode:    "r",
+			s:                     "/dev/sda2:r",
+			expectedDevPath:       "/dev/sda2",
+			expectedContainerPath: "/dev/sda2",
+			expectedMode:          "r",
 		},
 		{
-			s:               "/dev/sda3:rw",
-			expectedDevPath: "/dev/sda3",
-			expectedMode:    "rw",
+			s:                     "/dev/sda3:rw",
+			expectedDevPath:       "/dev/sda3",
+			expectedContainerPath: "/dev/sda3",
+			expectedMode:          "rw",
 		},
 		{
 			s:   "sda4",
 			err: "not an absolute path",
 		},
 		{
-			s:               "/dev/sda5:/dev/sda5",
-			expectedDevPath: "/dev/sda5",
-			expectedMode:    "rwm",
+			s:                     "/dev/sda5:/dev/sda5",
+			expectedDevPath:       "/dev/sda5",
+			expectedContainerPath: "/dev/sda5",
+			expectedMode:          "rwm",
 		},
 		{
-			s:   "/dev/sda6:/dev/foo6",
-			err: "not supported yet",
+			s:                     "/dev/sda6:/dev/foo6",
+			expectedDevPath:       "/dev/sda6",
+			expectedContainerPath: "/dev/foo6",
+			expectedMode:          "rwm",
 		},
 		{
 			s:   "/dev/sda7:/dev/sda7:rwmx",
@@ -254,10 +261,11 @@ func TestParseDevice(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Log(tc.s)
-		devPath, mode, err := container.ParseDevice(tc.s)
+		devPath, containerPath, mode, err := container.ParseDevice(tc.s)
 		if tc.err == "" {
 			assert.NilError(t, err)
 			assert.Equal(t, tc.expectedDevPath, devPath)
+			assert.Equal(t, tc.expectedContainerPath, containerPath)
 			assert.Equal(t, tc.expectedMode, mode)
 		} else {
 			assert.ErrorContains(t, err, tc.err)

pkg/cmd/container/run_cgroup_linux.go

@@ -199,12 +199,13 @@ func generateCgroupOpts(id string, options types.ContainerCreateOptions) ([]oci.
 	}
 
 	for _, f := range options.Device {
-		devPath, mode, err := ParseDevice(f)
+		devPath, conPath, mode, err := ParseDevice(f)
 		if err != nil {
 			return nil, fmt.Errorf("failed to parse device %q: %w", f, err)
 		}
-		opts = append(opts, oci.WithLinuxDevice(devPath, mode))
+		opts = append(opts, oci.WithDevices(devPath, conPath, mode))
 	}
+
 	return opts, nil
 }
 
@@ -246,8 +247,8 @@ func generateCgroupPath(id, cgroupManager, cgroupParent string) (string, error)
 	return path, nil
 }
 
-// ParseDevice parses the give device string into hostDevPath and mode(defaults: "rwm").
-func ParseDevice(s string) (hostDevPath string, mode string, err error) {
+// ParseDevice parses the give device string into hostDevPath, containerPath and mode(defaults: "rwm").
+func ParseDevice(s string) (hostDevPath string, containerPath string, mode string, err error) {
 	mode = "rwm"
 	split := strings.Split(s, ":")
 	var containerDevPath string
@@ -268,21 +269,17 @@ func ParseDevice(s string) (hostDevPath string, mode string, err error) {
 		containerDevPath = split[1]
 		mode = split[2]
 	default:
-		return "", "", errors.New("too many `:` symbols")
-	}
-
-	if containerDevPath != hostDevPath {
-		return "", "", errors.New("changing the path inside the container is not supported yet")
+		return "", "", "", errors.New("too many `:` symbols")
 	}
 
 	if !filepath.IsAbs(hostDevPath) {
-		return "", "", fmt.Errorf("%q is not an absolute path", hostDevPath)
+		return "", "", "", fmt.Errorf("%q is not an absolute path", hostDevPath)
 	}
 
 	if err := validateDeviceMode(mode); err != nil {
-		return "", "", err
+		return "", "", "", err
 	}
-	return hostDevPath, mode, nil
+	return hostDevPath, containerDevPath, mode, nil
 }
 
 func validateDeviceMode(mode string) error {