docker.Makefile: Use active context socket#7112
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
Two CONFIRMED medium-severity findings on the new DOCKER_SOCK variable assignment introduced by this PR:
- Non-unix endpoint passes raw URL as bind-mount source — when the active Docker context uses a TCP, SSH, or named-pipe endpoint,
patsubst unix://%,%finds no match and the raw scheme URL is used assrc=for--mount type=bind, which Docker will reject. - Context inspect failure yields empty DOCKER_SOCK — if
docker context inspectfails (missing binary, unknown context, etc.), Make swallows stderr andDOCKER_SOCKbecomes empty, producing an opaque "field src must not be empty" error with no indication of the root cause.
Both findings include a suggested fix: wrapping the expression with `` so a safe default is always present.
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
The PR correctly replaces hardcoded /var/run/docker.sock with a dynamically resolved socket path from the active Docker context. The core logic using patsubst + filter + or fallback is sound for the common unix-socket case. Two edge cases are introduced: non-unix context endpoints (tcp://, ssh://, npipe://) silently fall back to the hardcoded default, and docker context inspect failures are silently swallowed.
The development and e2e containers hard-code /var/run/docker.sock, so rootless and other local contexts cannot expose their daemon socket. Resolve the active context's Docker endpoint and strip the unix scheme before using it as the bind source. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The PR correctly resolves the active Docker context's socket path, strips the unix:// scheme, and uses it as the bind-mount source — with a safe fallback to /var/run/docker.sock for non-unix contexts and failure cases. The $(shell ...) / filter / patsubst / or chain is correct Make idiom, Make trims trailing newlines from shell output, and the single-quoting of the --mount argument is valid because Make expands variables before the shell sees the command. All three bind-mount sites are updated consistently.
thaJeztah
left a comment
There was a problem hiding this comment.
LGTM
we should have a flag for that 😜
The development and e2e containers hard-code /var/run/docker.sock, so rootless and other local contexts cannot expose their daemon socket. Resolve the active context's Docker endpoint and strip the unix scheme before using it as the bind source.
- What I did
- How I did it
- How to verify it
- Human readable description for the release notes
- A picture of a cute animal (not mandatory but encouraged)