container/autoroot: filter dentry with empty name

This is unreachable, but nice to have just in case.

Signed-off-by: Ophestra <cat@gensokyo.uk>

container/autoroot.go

@@ -89,6 +89,8 @@ func IsAutoRootBindable(name string) bool {
 	case "mnt":
 	case "etc":
 
+	case "": // guard against accidentally binding /
+
 	default:
 		return true
 	}

container/autoroot_test.go

@@ -0,0 +1,26 @@
+package container
+
+import "testing"
+
+func TestIsAutoRootBindable(t *testing.T) {
+	testCases := []struct {
+		name string
+		want bool
+	}{
+		{"proc", false},
+		{"dev", false},
+		{"tmp", false},
+		{"mnt", false},
+		{"etc", false},
+		{"", false},
+
+		{"var", true},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := IsAutoRootBindable(tc.name); got != tc.want {
+				t.Errorf("IsAutoRootBindable: %v, want %v", got, tc.want)
+			}
+		})
+	}
+}