k8s: extension volumeMounts leak onto all containers (shared CONTAINER_VOLUMES array)

[ohookins]

What happens

A volumeMounts entry added to any $-prefixed container in the hook extension template (ACTIONS_RUNNER_CONTAINER_HOOK_TEMPLATE) ends up on every container in the job pod, not just the one it was declared under. Same goes for a mount declared on $job leaking into the service containers.

This bit us when we needed to mount a shared volume into two containers at different paths — mounting it at the natural path in one container shadowed files that container needs, so we wanted it there only for the other container. The leak makes that impossible: the mount lands on every container.

Why

CONTAINER_VOLUMES is a module-level array, and every container gets that same array assigned by reference:

runner-container-hooks/packages/k8s/src/hooks/prepare-job.ts

Line 287 in cf62bcc

podContainer.volumeMounts = CONTAINER_VOLUMES

Then mergeContainerWithOptions appends the extension's mounts with mergeLists, which mutates base in place:

runner-container-hooks/packages/k8s/src/k8s/utils.ts

Line 196 in cf62bcc

base.volumeMounts = mergeLists(base.volumeMounts, volumeMounts)

runner-container-hooks/packages/k8s/src/k8s/utils.ts

Line 286 in cf62bcc

b.push(...from)

So the first container's merge pushes onto the shared array, and every later container starts from that already-polluted array. Net result: union of all containers' mounts on all containers.

Repro

Template:

spec:
  containers:
    - name: $job
      volumeMounts:
        - name: shared
          mountPath: /a
    - name: $mysvc
      volumeMounts:
        - name: shared
          mountPath: /b
  volumes:
    - name: shared
      emptyDir: {}

Both /a and /b show up in the job container and the service container.

Fix

Give each container its own copy, e.g. at prepare-job.ts#L287:

podContainer.volumeMounts = [...CONTAINER_VOLUMES]

(Env and ports go through the same mergeLists path but happen to start from per-container arrays, so this is the only one affected.)

Related

• k8s: optionally mount externals from an image volume instead of copying in fs-init #399 refactors CONTAINER_VOLUMES into a containerVolumes() function returning a fresh array, which would incidentally fix this.
• Merge initContainers key in mergePodSpecWithOptions for fs-init extension #335 is another mergePodSpecWithOptions merge gap (initContainers), same general area.

Seen on the kubernetes-novolume hook shipped in actions-runner:2.336.0; code above is current main.