internal/pkg: respect mount order for overlay temp

Setting it up after everything else prevents covering files in /tmp.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/pkg/exec.go

@@ -186,11 +186,15 @@ func (a *execArtifact) cure(c *CureContext, hostNet bool) (err error) {
 		cures = runtime.NumCPU()
 	}
 
+	overlayTempIndex := -1
 	paths := make([][2]*check.Absolute, len(a.paths))
 	for i, p := range a.paths {
 		if p.P == nil || p.A == nil {
 			return os.ErrInvalid
 		}
+		if p.P.Is(fhs.AbsTmp) {
+			overlayTempIndex = i
+		}
 		paths[i][1] = p.P
 	}
 
@@ -275,31 +279,11 @@ func (a *execArtifact) cure(c *CureContext, hostNet bool) (err error) {
 	if len(paths) > 0 && paths[0][1].Is(fhs.AbsRoot) {
 		z.OverlayEphemeral(fhs.AbsRoot, paths[0][0])
 		paths = paths[1:]
+		overlayTempIndex--
 	}
-	var overlayTemp *check.Absolute
+
-	for _, b := range paths {
+	for i, b := range paths {
-		if b[1].Is(fhs.AbsTmp) {
+		if i == overlayTempIndex {
-			if overlayTemp != nil {
-				z.Bind(overlayTemp, fhs.AbsTmp, 0)
-			}
-			overlayTemp = b[0]
-			continue
-		}
-		z.Bind(b[0], b[1], 0)
-	}
-	work := c.GetWorkDir()
-	z.Bind(
-		work,
-		fhs.AbsRoot.Append("work"),
-		std.BindWritable|std.BindEnsure,
-	)
-	if overlayTemp == nil {
-		z.Bind(
-			c.GetTempDir(),
-			fhs.AbsTmp,
-			std.BindWritable|std.BindEnsure,
-		)
-	} else {
 			temp := c.GetTempDir()
 			tempUpper := temp.Append("upper")
 			if err = os.MkdirAll(tempUpper.String(), 0700); err != nil {
@@ -313,7 +297,23 @@ func (a *execArtifact) cure(c *CureContext, hostNet bool) (err error) {
 				fhs.AbsTmp,
 				tempUpper,
 				tempWork,
-			overlayTemp,
+				b[0],
+			)
+			continue
+		}
+		z.Bind(b[0], b[1], 0)
+	}
+	work := c.GetWorkDir()
+	z.Bind(
+		work,
+		fhs.AbsRoot.Append("work"),
+		std.BindWritable|std.BindEnsure,
+	)
+	if overlayTempIndex < 0 {
+		z.Bind(
+			c.GetTempDir(),
+			fhs.AbsTmp,
+			std.BindWritable|std.BindEnsure,
 		)
 	}
 	z.Proc(fhs.AbsProc).Dev(fhs.AbsDev, true)

internal/pkg/testdata/main.go

@@ -144,22 +144,24 @@ func main() {
 		}
 	}
 
+	if overlayTmp {
+		next() // testtool artifact
+		if m.Root != "/" || m.Target != "/tmp" ||
+			m.Source != "overlay" || m.FsType != "overlay" {
+			log.Fatal("unexpected temp mount entry")
+		}
+	}
+
 	next()
 	if path.Base(m.Root) != ident || m.Target != "/work" {
 		log.Fatal("unexpected work mount entry")
 	}
 
-	next()
 	if !overlayTmp {
+		next()
 		if path.Base(m.Root) != ident || m.Target != "/tmp" {
 			log.Fatal("unexpected temp mount entry")
 		}
-	} else {
-		// testtool artifact
-		if m.Root != "/" || m.Target != "/tmp" ||
-			m.Source != "overlay" || m.FsType != "overlay" {
-			log.Fatal("unexpected temp mount entry")
-		}
 	}
 
 	next()