diff --git a/integration-cli/docker_cli_run_test.go b/integration-cli/docker_cli_run_test.go index a0c3903064..eda1b3f0a5 100644 --- a/integration-cli/docker_cli_run_test.go +++ b/integration-cli/docker_cli_run_test.go @@ -971,3 +971,15 @@ func TestAllowBindMountingRoot(t *testing.T) { logDone("run - bind mount / as volume") } + +func TestDisallowBindMountingRootToRoot(t *testing.T) { + cmd := exec.Command(dockerBinary, "run", "-v", "/:/", "busybox", "ls", "/host") + out, _, err := runCommandWithOutput(cmd) + if err == nil { + t.Fatal(out, err) + } + + deleteAllContainers() + + logDone("run - bind mount /:/ as volume should fail") +} diff --git a/runconfig/parse.go b/runconfig/parse.go index f057f311cc..01662fd010 100644 --- a/runconfig/parse.go +++ b/runconfig/parse.go @@ -133,7 +133,7 @@ func parseRun(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Conf for bind := range flVolumes.GetMap() { if arr := strings.Split(bind, ":"); len(arr) > 1 { if arr[1] == "/" { - return nil, nil, cmd, fmt.Errorf("Invalid bind mount: desination can't be '/'") + return nil, nil, cmd, fmt.Errorf("Invalid bind mount: destination can't be '/'") } // after creating the bind mount we want to delete it from the flVolumes values because // we do not want bind mounts being committed to image configs