Toolbox: Mount only `pwd` for writing

[abitrolly]

I just found out that toolbox allows to modify files outside of directory where I invoked it. I expected it to maybe allow modification outside of pwd but at least discard them. Now I see that it doesn't protect my files outside of pwd from modifications.

Maybe there are some options that I missed?

UPDATE: This hack from https://github.com/containers/toolbox/issues/348#issuecomment-568938467 seems to work ok for now.

$ HOME=`pwd` toolbox create
$ HOME=`pwd` toolbox enter

It does create new files in project dir, but doesn't touch parents, which is good.

[njam]

I agree it would be nice if toolbox would allow _not_ to mount the home directory, but only the "pwd" instead!

Programs installed in the toolbox will store many files in $HOME (eg $HOME/.cache, $HOME/.config etc), and those can be conflicting between different toolboxes, or between the host and a toolbox.

How about an option to use a home directory inside the container, and mount the current directory as for example $HOME/Workdir?

[abitrolly]

It is kind of nice to be able to jump into toolbox and back without having to switch paths mentally, and having clean $HOME in toolbox by default.

[abitrolly]

@njam on the second though I think that would be a good solution. At least a good option,

[njam]

I've experimented with this idea in a experimental toolbox implementation (source). I added a parameter to define which folder to mount:

$ toolbox-njam create foo --mount ~/Downloads

The ~/Downloads folder is mounted into the container and set as the working directory when using "enter". The mount path is stored on the container using a label, so it can be displayed in "list":

$ toolbox-njam list
NAME    IMAGE                                                      MOUNT
foo     registry.gitlab.com/njam/toolbox-njam/arch-toolbox:latest  /home/reto/Downloads

For basic use cases it works well. But I haven't extensively tested it. For example, what will/should happen if a folder _outside_ of $HOME is mounted?

[markstos]

tlbx fork has a -n option to not bind-mount the home directory.

[abitrolly]

@markstos what bind-mount does in comparison with standard podman volumes?

[debarshiray]

Duplicate of #183

[abitrolly]

@debarshiray hey, the #183 is closed, but what is the solution?