Add Warning for Sharing Volumes Not Mounted to Machine

[Banana-Cultist]

On macOS and Windows, podman runs in remote mode, which uses a VM to run containers. Volume sharing is done using this VM's filesystem, rather than the host filesystem. However, since the VM default mounts include some common folders, this might not be clear to some users.

To address this, when a user tries to share a volume that isn't mounted to the podman machine, a warning is generated linking to the podman machine docs.

Example (macOS):

podman run -it --rm -v /tmp/a:/mnt alpine /bin/ash
WARN[0000] The following bind mount sources are not shared with the Podman machine and may not work: /tmp/a. See https://docs.podman.io/en/latest/markdown/podman-machine-init.1.html#volume for details on configuring machine volumes.

Fixes: #27468

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

• Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
  commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
  the sign-off email address. See CONTRIBUTING.md
  for more information.
• Referenced issues using Fixes: #00000 in commit message (if applicable)
• Tests have been added/updated (or no tests are needed)
• Documentation has been updated (or no documentation changes are needed)
• All commits pass make validatepr (format/lint checks)
• Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Add a warning for when `podman run/create -v` references host paths not shared with the active Podman machine.

[Honny1]

I like the idea of adding a warning. I have a suggestion to make this more DRY, but I have some concerns about symlink evaluation. For example, on Mac, /tmp is actually /private/tmp.

[mheon]

@baude Feelings on this one?

[Banana-Cultist]

I like the idea of adding a warning. I have a suggestion to make this more DRY, but I have some concerns about symlink evaluation. For example, on Mac, /tmp is actually /private/tmp.

What are you thinking of for symlink evaluation?

From my understanding, symlinks aren't evaluated in the actual volume share codepath. If we evaluated symlinks before checking their machine path, then the original example would have its path evaluated to /private/tmp/a, which is mounted and wouldn't emit a warning. However, the machine would still try to mount /tmp/a from its own file system and fail.

Conversely, if we evaluated symlinks after checking the machine path, I think the warning would say that /private/tmp/a isn't shared with the podman machine, which would be confusing.

I could definitely be missing something, though.

[Honny1]

I like the idea of adding a warning. I have a suggestion to make this more DRY, but I have some concerns about symlink evaluation. For example, on Mac, /tmp is actually /private/tmp.

What are you thinking of for symlink evaluation?

From my understanding, symlinks aren't evaluated in the actual volume share codepath. If we evaluated symlinks before checking their machine path, then the original example would have its path evaluated to /private/tmp/a, which is mounted and wouldn't emit a warning. However, the machine would still try to mount /tmp/a from its own file system and fail.

Conversely, if we evaluated symlinks after checking the machine path, I think the warning would say that /private/tmp/a isn't shared with the podman machine, which would be confusing.

I could definitely be missing something, though.

I checked the implementation, and it seems that EvalSymlinks is only performed on relative paths and relative path is converted to ablolute path. I would at least warn the user if the host path contains a symlink, as it might not work on the remote system/machine as expected.

[Banana-Cultist]

If I'm understanding this correctly, then trying to mount from "./filepath" and "/filepath" could result in two different outcomes. In fact, by being at the root directory, podman run -it --rm -v ./tmp/a:/mnt alpine /bin/ash seems to correctly mount /private/tmp on macOS.

I've updated the warning check with the eval symlinks, but the behavior I described above feels weird, so I wanted to check in.

[Honny1]

I would wrap CheckPathOnRunningMachine inside the WarnIfMachineVolumesUnavailable function. You can get the context with registry.context(). This will simplify the code for the caller and reduce the overall function size.

[Banana-Cultist]

When I tried this, it seemed that CheckPathOnRunningMachine didn't recognize that podman was running in machine mode. I have a hunch that the registry context at the current call site isn't fully set up at that point.