Publish curated Unraid-AppOps-Gateway source from 0f89e1506065c5365c48968b1d7845d666a18be8

backend/tests/test_runner_resource_envelope.py

@@ -478,7 +478,7 @@ def test_host_probe_contract_is_bounded_and_never_mounts_host_proc_or_docker_soc
     assert "target=/host-cgroup" in mount
     assert "readonly" in mount
     assert mounts[1] == (
-        f"type=bind,source={code_source},target=/opt/gitea-deploy,readonly,bind-propagation=rprivate"
+        f"type=bind,source={code_source},target=/opt/gitea-deploy,readonly,bind-propagation=rslave"
     )
     assert not any("/proc" in item or "docker.sock" in item for item in args)
     assert args[-3:] == [image_id, "/opt/gitea-deploy/runner_resource_envelope.py", "--host-probe"]
@@ -528,7 +528,7 @@ def test_host_probe_inspection_rejects_namespace_mount_and_resource_drift():
                     "Source": code_source,
                     "Target": "/opt/gitea-deploy",
                     "ReadOnly": True,
-                    "BindOptions": {"Propagation": "rprivate"},
+                    "BindOptions": {"Propagation": "rslave"},
                 },
             ],
         },
@@ -547,7 +547,7 @@ def test_host_probe_inspection_rejects_namespace_mount_and_resource_drift():
                 "Destination": "/opt/gitea-deploy",
                 "Mode": "",
                 "RW": False,
-                "Propagation": "rprivate",
+                "Propagation": "rslave",
             },
         ],
     }
@@ -585,6 +585,12 @@ def test_host_probe_inspection_rejects_namespace_mount_and_resource_drift():
         ),
         lambda item: item["Mounts"][0].update(RW=True),
         lambda item: item["Mounts"][1].update(RW=True),
+        lambda item: item["Mounts"][0].update(Propagation="rslave"),
+        lambda item: item["Mounts"][1].update(Propagation="rprivate"),
+        lambda item: item["Mounts"][1].update(Propagation="rshared"),
+        lambda item: item["Mounts"][1].update(Propagation="slave"),
+        lambda item: item["HostConfig"]["Mounts"][0]["BindOptions"].update(Propagation="rslave"),
+        lambda item: item["HostConfig"]["Mounts"][1]["BindOptions"].update(Propagation="rprivate"),
         lambda item: item["Mounts"][0].update(Mode="ro"),
         lambda item: item["Mounts"][1].update(Mode="ro"),
         lambda item: item["Mounts"][1].update(Source="/mnt/shared/code"),
@@ -734,7 +740,7 @@ def test_host_probe_rw_modes_are_fixed_and_limited_to_ensure_or_rollback():
     )
     assert all(
         code_mount
-        == f"type=bind,source={code_source},target=/opt/gitea-deploy,readonly,bind-propagation=rprivate"
+        == f"type=bind,source={code_source},target=/opt/gitea-deploy,readonly,bind-propagation=rslave"
         for code_mount in (snapshot_code_mount, ensure_code_mount, rollback_code_mount, family_code_mount)
     )
     for args in (snapshot, ensure, rollback, family):