VOLUME contains data added after declaration about imagebuilder HOT 5 CLOSED

This is a known issue, there's really no way to fix it without executing things in the container, which we can only do if we know that the image has a shell in it or we can inject an arbitrary binary. So we can only fix part of the problem easily.

from imagebuilder.

How critical is this?

from imagebuilder.

Injecting a static rm binary was the proposal I had.

Short of that, if imagebuilder could at least warn when the volume content ends up different than at declaration time, it would at least enable any tooling using it to re-build the container image a different way if it wants full compatibility for VOLUME.

from imagebuilder.

Mostly fixed, but see #30 for the gap with owner permissions. I will add a --strict-volume-ownership flag to prevent this accidentally being lost.

from imagebuilder.

Added a check in #31 which will fail if RUN follows VOLUME. ADD following VOLUME is successful.

from imagebuilder.