fix(compose): preserve named-volume access mode when adding suffix

The randomize/isolated-deployment volume transform split mount strings
on ':' and kept only the first two segments, so an access mode like
:ro, :z or :Z was silently dropped and read-only mounts became
read-write. Keep the full path+mode remainder when rebuilding the
mount string.

Fixes #4818
This commit is contained in:
Mauricio Siu
2026-07-14 11:34:46 -06:00
parent 7ba9818894
commit bc22d05f8d
2 changed files with 39 additions and 3 deletions

View File

@@ -26,11 +26,14 @@ export const addSuffixToVolumesInServices = (
if (_.has(newServiceConfig, "volumes")) {
newServiceConfig.volumes = _.map(newServiceConfig.volumes, (volume) => {
if (_.isString(volume)) {
const [volumeName, path] = volume.split(":");
// remainder is the container path plus optional access mode (:ro, :z, :Z)
const [volumeName, ...pathAndMode] = volume.split(":");
const remainder = pathAndMode.join(":");
// skip bind mounts and variables (e.g. $PWD)
if (
!volumeName ||
!remainder ||
volumeName.startsWith(".") ||
volumeName.startsWith("/") ||
volumeName.startsWith("$")
@@ -43,10 +46,10 @@ export const addSuffixToVolumesInServices = (
if (parts.length > 1) {
const baseName = parts[0];
const rest = parts.slice(1).join("/");
return `${baseName}-${suffix}/${rest}:${path}`;
return `${baseName}-${suffix}/${rest}:${remainder}`;
}
return `${volumeName}-${suffix}:${path}`;
return `${volumeName}-${suffix}:${remainder}`;
}
if (_.isObject(volume) && volume.type === "volume" && volume.source) {
return {