nextflow-io/nextflow

Option to disable volume mount optimisation

Open

#3,688 创建于 2023年2月25日

在 GitHub 查看
 (3 评论) (0 反应) (0 负责人)Groovy (784 fork)batch import
good first issuesoftware/docker

仓库指标

Star
 (3,382 star)
PR 合并指标
 (平均合并 16天 9小时) (30 天内合并 54 个 PR)

描述

New feature

I found that Nextflow is failing to run some pipelines on various systems where I have constrained the file system paths that docker can see.

When I investigated the code, I discovered that this is happening because Nextflow is trying to optimise how many volume mount arguments it issues to the docker command, by reducing overlapping entries to their "lowest common path". The problem here is that it means the containers are seeing far outside the file system that they are meant to be. Even if this didn't cause an error (as it does for me), it would be suboptimal from a security point of view that the containers are given access outside the part of the file system they are explicitly being given access to.

Usage scenario

Running pipelines on systems where there is a desire to control the scope of the file system visible to the container.

Suggest implementation

Add an an option and an if statement or two inside the ContainerBuilder to prevent container mount path optimisation from taking place and just use the raw volumes added by the user.

贡献者指南