From 5ae10bbd368904b8ffce733d4e6b575c816ee8ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Thu, 16 Jul 2026 14:25:34 +0200 Subject: [PATCH] integration/volume: Make escaping image symlink storage-independent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The image subpath test uses a fixed number of parent traversals to reach an existing path outside the image root. User namespace remapping adds another directory to the graph root, so the link instead resolves to a nonexistent path and returns ErrNotAccessible. Signed-off-by: Paweł Gronowski --- integration/volume/mount_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration/volume/mount_test.go b/integration/volume/mount_test.go index cacb863cdb..9abf5bd8de 100644 --- a/integration/volume/mount_test.go +++ b/integration/volume/mount_test.go @@ -325,7 +325,7 @@ func setupTestImage(t *testing.T, ctx context.Context, apiClient client.APIClien FROM busybox as symlink RUN mkdir /hack \ && ln -s "../subdir" /hack/good \ - && ln -s "../../../../../docker" /hack/bad + && ln -s ../../../../../ /hack/bad #-- FROM scratch COPY foo /