Repository metrics
- Stars
- (3,382 stars)
- PR merge metrics
- (Avg merge 16d 9h) (54 merged PRs in 30d)
Description
New feature
I found that Nextflow is failing to run some pipelines on various systems where I have constrained the file system paths that docker can see.
When I investigated the code, I discovered that this is happening because Nextflow is trying to optimise how many volume mount arguments it issues to the docker command, by reducing overlapping entries to their "lowest common path". The problem here is that it means the containers are seeing far outside the file system that they are meant to be. Even if this didn't cause an error (as it does for me), it would be suboptimal from a security point of view that the containers are given access outside the part of the file system they are explicitly being given access to.
Usage scenario
Running pipelines on systems where there is a desire to control the scope of the file system visible to the container.
Suggest implementation
Add an an option and an if statement or two inside the ContainerBuilder to prevent container mount path optimisation from taking place and just use the raw volumes added by the user.