Migrate to unified volume handling code

Unify handling for the --volume, --mount, --volumes-from, --tmpfs
and --init flags into a single file and set of functions. This
will greatly improve readability and maintainability.

Further, properly handle superceding and conflicting mounts. Our
current patchwork has serious issues when mounts conflict, or
when a mount from --volumes-from or an image volume should be
overwritten by a user volume or named volume.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>

1 files changed, 765 insertions, 0 deletions

diff --git a/pkg/spec/storage.go b/pkg/spec/storage.go
new file mode 100644
index 000000000..7806a8c72
--- /dev/null
+++ b/pkg/spec/storage.go
@@ -0,0 +1,765 @@
+package createconfig
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/containers/libpod/libpod"
+	"github.com/containers/storage/pkg/stringid"
+	spec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+const (
+	// TypeBind is the type for mounting host dir
+	TypeBind = "bind"
+	// TypeVolume is the type for named volumes
+	TypeVolume = "volume"
+	// TypeTmpfs is the type for mounting tmpfs
+	TypeTmpfs = "tmpfs"
+)
+
+var (
+	errDuplicateDest = errors.Errorf("duplicate mount destination")
+	badOptionError   = errors.Errorf("invalid mount option")
+	optionArgError   = errors.Errorf("must provide an argument for option")
+	noDestError      = errors.Errorf("must set volume destination")
+)
+
+// Parse all volume-related options in the create config into a set of mounts
+// and named volumes to add to the container.
+// Handles --volumes-from, --volumes, --tmpfs, --init, and --init-path flags.
+// TODO: Named volume options -  should we default to rprivate? It bakes into a
+// bind mount under the hood...
+// TODO: Tmpfs options - we should probably check user-given ones, provide sane
+// defaults even if the user provides a few...
+func (config *CreateConfig) parseVolumes(runtime *libpod.Runtime) ([]spec.Mount, []*libpod.ContainerNamedVolume, error) {
+	// Add image volumes.
+	baseMounts, baseVolumes, err := config.getImageVolumes()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Add --volumes-from.
+	// Overrides image volumes unconditionally.
+	vFromMounts, vFromVolumes, err := config.getVolumesFrom(runtime)
+	if err != nil {
+		return nil, nil, err
+	}
+	for dest, mount := range vFromMounts {
+		baseMounts[dest] = mount
+	}
+	for dest, volume := range vFromVolumes {
+		baseVolumes[dest] = volume
+	}
+
+	// Next mounts from the --mounts flag.
+	// Do not override yet.
+	unifiedMounts, unifiedVolumes, err := config.getMounts()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Next --volumes flag.
+	// Do not override yet.
+	volumeMounts, volumeVolumes, err := config.getVolumeMounts()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Next --tmpfs flag.
+	// Do not override yet.
+	tmpfsMounts, err := config.getTmpfsMounts()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Unify mounts from --mount, --volume, --tmpfs.
+	// Start with --volume.
+	for dest, mount := range volumeMounts {
+		if _, ok := unifiedMounts[dest]; ok {
+			return nil, nil, errors.Wrapf(errDuplicateDest, dest)
+		}
+		unifiedMounts[dest] = mount
+	}
+	for dest, volume := range volumeVolumes {
+		if _, ok := unifiedVolumes[dest]; ok {
+			return nil, nil, errors.Wrapf(errDuplicateDest, dest)
+		}
+		unifiedVolumes[dest] = volume
+	}
+	// Now --tmpfs
+	for dest, tmpfs := range tmpfsMounts {
+		if _, ok := unifiedMounts[dest]; ok {
+			return nil, nil, errors.Wrapf(errDuplicateDest, dest)
+		}
+		unifiedMounts[dest] = tmpfs
+	}
+
+	// If requested, add container init binary
+	if config.Init {
+		initPath := config.InitPath
+		if initPath == "" {
+			rtc, err := runtime.GetConfig()
+			if err != nil {
+				return nil, nil, err
+			}
+			initPath = rtc.InitPath
+		}
+		initMount, err := config.addContainerInitBinary(initPath)
+		if err != nil {
+			return nil, nil, err
+		}
+		if _, ok := unifiedMounts[initMount.Destination]; ok {
+			return nil, nil, errors.Wrapf(errDuplicateDest, "conflict with mount added by --init to %q", initMount.Destination)
+		}
+		unifiedMounts[initMount.Destination] = initMount
+	}
+
+	// Supercede volumes-from/image volumes with unified volumes from above.
+	// This is an unconditional replacement.
+	for dest, mount := range unifiedMounts {
+		baseMounts[dest] = mount
+	}
+	for dest, volume := range unifiedVolumes {
+		baseVolumes[dest] = volume
+	}
+
+	// TODO: Allow an explicit list of named volumes and spec mounts in the
+	// createconfig. Podman doesn't need them, but other libpod consumers
+	// might want them.
+
+	// Final step: maps to arrays
+	finalMounts := make([]spec.Mount, 0, len(baseMounts))
+	for _, mount := range baseMounts {
+		finalMounts = append(finalMounts, mount)
+	}
+	finalVolumes := make([]*libpod.ContainerNamedVolume, 0, len(baseVolumes))
+	for _, volume := range baseVolumes {
+		finalVolumes = append(finalVolumes, volume)
+	}
+
+	return finalMounts, finalVolumes, nil
+}
+
+// Parse volumes from - a set of containers whose volumes we will mount in.
+// Grab the containers, retrieve any user-created spec mounts and all named
+// volumes, and return a list of them.
+// Conflicts are resolved simply - the last container specified wins.
+// Container names may be suffixed by mount options after a colon.
+func (config *CreateConfig) getVolumesFrom(runtime *libpod.Runtime) (map[string]spec.Mount, map[string]*libpod.ContainerNamedVolume, error) {
+	// TODO: This can probably be disabled now
+	if os.Geteuid() != 0 {
+		return nil, nil, nil
+	}
+
+	// Both of these are maps of mount destination to mount type.
+	// We ensure that each destination is only mounted to once in this way.
+	// We tiebreak only within each category; we'll let libpod tiebreak
+	// between mounts and named volumes.
+	// TODO: Should we unmount subtree mounts? E.g., if /tmp/ is mounted by
+	// one mount, and we already have /tmp/a and /tmp/b, should we remove
+	// the /tmp/a and /tmp/b mounts in favor of the more general /tmp?
+	finalMounts := make(map[string]spec.Mount)
+	finalNamedVolumes := make(map[string]*libpod.ContainerNamedVolume)
+
+	for _, vol := range config.VolumesFrom {
+		options := []string{}
+		// TODO: now that container names may contain colons this is no
+		// longer safe.
+		// I don't know if there's much we can do here...
+		splitVol := strings.SplitN(vol, ":", 2)
+		if len(splitVol) == 2 {
+			if strings.Contains(splitVol[1], "Z") ||
+				strings.Contains(splitVol[1], "private") ||
+				strings.Contains(splitVol[1], "slave") ||
+				strings.Contains(splitVol[1], "shared") {
+				return nil, nil, errors.Errorf("invalid options %q, can only specify 'ro', 'rw', and 'z", splitVol[1])
+			}
+			if err := ValidateVolumeOpts(splitVol[1]); err != nil {
+				return nil, nil, err
+			}
+			options = strings.Split(splitVol[1], ",")
+		}
+		ctr, err := runtime.LookupContainer(splitVol[0])
+		if err != nil {
+			return nil, nil, errors.Wrapf(err, "error looking up container %q for volumes-from", splitVol[0])
+		}
+
+		logrus.Debugf("Adding volumes from container %s", ctr.ID())
+
+		// Look up the container's user volumes. This gets us the
+		// destinations of all mounts the user added to the container.
+		userVolumesArr := ctr.UserVolumes()
+
+		// We're going to need to access them a lot, so convert to a map
+		// to reduce looping.
+		// We'll also use the map to indicate if we missed any volumes along the way.
+		userVolumes := make(map[string]bool)
+		for _, dest := range userVolumesArr {
+			userVolumes[dest] = false
+		}
+
+		// Now we get the container's spec and loop through its volumes
+		// and append them in if we can find them.
+		spec := ctr.Spec()
+		if spec == nil {
+			return nil, nil, errors.Errorf("error retrieving container %s spec for volumes-from", ctr.ID())
+		}
+		for _, mnt := range spec.Mounts {
+			if mnt.Type != TypeBind {
+				continue
+			}
+			if _, exists := userVolumes[mnt.Destination]; exists {
+				userVolumes[mnt.Destination] = true
+
+				if len(options) != 0 {
+					mnt.Options = options
+				}
+
+				if _, ok := finalMounts[mnt.Destination]; ok {
+					logrus.Debugf("Overriding mount to %s with new mount from container %s", mnt.Destination, ctr.ID())
+				}
+				finalMounts[mnt.Destination] = mnt
+			}
+		}
+
+		// We're done with the spec mounts. Add named volumes.
+		// Add these unconditionally - none of them are automatically
+		// part of the container, as some spec mounts are.
+		namedVolumes := ctr.NamedVolumes()
+		for _, namedVol := range namedVolumes {
+			if _, exists := userVolumes[namedVol.Dest]; exists {
+				userVolumes[namedVol.Dest] = true
+			}
+
+			if len(options) != 0 {
+				namedVol.Options = options
+			}
+
+			if _, ok := finalMounts[namedVol.Dest]; ok {
+				logrus.Debugf("Overriding named volume mount to %s with new named volume from container %s", namedVol.Dest, ctr.ID())
+			}
+			finalNamedVolumes[namedVol.Dest] = namedVol
+		}
+
+		// Check if we missed any volumes
+		for volDest, found := range userVolumes {
+			if !found {
+				logrus.Warnf("Unable to match volume %s from container %s for volumes-from", volDest, ctr.ID())
+			}
+		}
+	}
+
+	return finalMounts, finalNamedVolumes, nil
+}
+
+// getMounts takes user-provided input from the --mount flag and creates OCI
+// spec mounts and Libpod named volumes.
+// podman run --mount type=bind,src=/etc/resolv.conf,target=/etc/resolv.conf ...
+// podman run --mount type=tmpfs,target=/dev/shm ...
+// podman run --mount type=volume,source=test-volume, ...
+func (config *CreateConfig) getMounts() (map[string]spec.Mount, map[string]*libpod.ContainerNamedVolume, error) {
+	finalMounts := make(map[string]spec.Mount)
+	finalNamedVolumes := make(map[string]*libpod.ContainerNamedVolume)
+
+	errInvalidSyntax := errors.Errorf("incorrect mount format: should be --mount type=<bind|tmpfs|volume>,[src=<host-dir|volume-name>,]target=<ctr-dir>[,options]")
+
+	// TODO(vrothberg): the manual parsing can be replaced with a regular expression
+	//                  to allow a more robust parsing of the mount format and to give
+	//                  precise errors regarding supported format versus suppored options.
+	for _, mount := range config.MountsFlag {
+		arr := strings.SplitN(mount, ",", 2)
+		if len(arr) < 2 {
+			return nil, nil, errors.Wrapf(errInvalidSyntax, "%q", mount)
+		}
+		kv := strings.Split(arr[0], "=")
+		// TODO: type is not explicitly required in Docker.
+		// If not specified, it defaults to "volume".
+		if len(kv) != 2 || kv[0] != "type" {
+			return nil, nil, errors.Wrapf(errInvalidSyntax, "%q", mount)
+		}
+
+		tokens := strings.Split(arr[1], ",")
+		switch kv[1] {
+		case TypeBind:
+			mount, err := getBindMount(tokens)
+			if err != nil {
+				return nil, nil, err
+			}
+			if _, ok := finalMounts[mount.Destination]; ok {
+				return nil, nil, errors.Wrapf(errDuplicateDest, mount.Destination)
+			}
+			finalMounts[mount.Destination] = mount
+		case TypeTmpfs:
+			mount, err := getTmpfsMount(tokens)
+			if err != nil {
+				return nil, nil, err
+			}
+			if _, ok := finalMounts[mount.Destination]; ok {
+				return nil, nil, errors.Wrapf(errDuplicateDest, mount.Destination)
+			}
+			finalMounts[mount.Destination] = mount
+		case "volume":
+			volume, err := getNamedVolume(tokens)
+			if err != nil {
+				return nil, nil, err
+			}
+			if _, ok := finalNamedVolumes[volume.Dest]; ok {
+				return nil, nil, errors.Wrapf(errDuplicateDest, volume.Dest)
+			}
+			finalNamedVolumes[volume.Dest] = volume
+		default:
+			return nil, nil, errors.Errorf("invalid fylesystem type %q", kv[1])
+		}
+	}
+
+	return finalMounts, finalNamedVolumes, nil
+}
+
+// Parse a single bind mount entry from the --mount flag.
+func getBindMount(args []string) (spec.Mount, error) {
+	newMount := spec.Mount{
+		Type: TypeBind,
+	}
+
+	setSource := false
+	setDest := false
+
+	for _, val := range args {
+		kv := strings.Split(val, "=")
+		switch kv[0] {
+		case "ro", "nosuid", "nodev", "noexec":
+			// TODO: detect duplication of these options
+			newMount.Options = append(newMount.Options, kv[0])
+		case "shared", "rshared", "private", "rprivate", "slave", "rslave", "Z", "z":
+			// TODO: detect duplicate mount propagation options
+			newMount.Options = append(newMount.Options, kv[0])
+		case "bind-propagation":
+			// TODO: this should conflict with the mount propagation
+			// options above.
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			newMount.Options = append(newMount.Options, kv[1])
+		case "src", "source":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := ValidateVolumeHostDir(kv[1]); err != nil {
+				return newMount, err
+			}
+			newMount.Source = kv[1]
+			setSource = true
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := ValidateVolumeCtrDir(kv[1]); err != nil {
+				return newMount, err
+			}
+			newMount.Destination = kv[1]
+			setDest = true
+		default:
+			return newMount, errors.Wrapf(badOptionError, kv[0])
+		}
+	}
+
+	if !setDest {
+		return newMount, noDestError
+	}
+
+	if !setSource {
+		newMount.Source = newMount.Destination
+	}
+
+	// Process options
+	newMount.Options = processOptions(newMount.Options)
+
+	return newMount, nil
+}
+
+// Parse a single tmpfs mount entry from the --mount flag
+func getTmpfsMount(args []string) (spec.Mount, error) {
+	newMount := spec.Mount{
+		Type:   TypeTmpfs,
+		Source: TypeTmpfs,
+	}
+
+	setDest := false
+
+	for _, val := range args {
+		kv := strings.Split(val, "=")
+		switch kv[0] {
+		case "ro", "nosuid", "nodev", "noexec":
+			// TODO: detect duplication of these options
+			newMount.Options = append(newMount.Options, kv[0])
+		case "tmpfs-mode":
+			// TODO: detect duplicate modes
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			newMount.Options = append(newMount.Options, fmt.Sprintf("mode=%s", kv[1]))
+		case "tmpfs-size":
+			// TODO: detect duplicate sizes
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			newMount.Options = append(newMount.Options, fmt.Sprintf("size=%s", kv[1]))
+		case "src", "source":
+			return newMount, errors.Errorf("source is not supported with tmpfs mounts")
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := ValidateVolumeCtrDir(kv[1]); err != nil {
+				return newMount, err
+			}
+			newMount.Destination = kv[1]
+			setDest = true
+		default:
+			return newMount, errors.Wrapf(badOptionError, kv[0])
+		}
+	}
+
+	if !setDest {
+		return newMount, noDestError
+	}
+
+	return newMount, nil
+}
+
+// Parse a single volume mount entry from the --mount flag.
+// Note that the volume-label option for named volumes is currently NOT supported.
+// TODO: add support for --volume-label
+func getNamedVolume(args []string) (*libpod.ContainerNamedVolume, error) {
+	newVolume := new(libpod.ContainerNamedVolume)
+
+	setSource := false
+	setDest := false
+
+	for _, val := range args {
+		kv := strings.Split(val, "=")
+		switch kv[0] {
+		case "ro", "nosuid", "nodev", "noexec":
+			// TODO: detect duplication of these options
+			newVolume.Options = append(newVolume.Options, kv[0])
+		case "volume-label":
+			return nil, errors.Errorf("the --volume-label option is not presently implemented")
+		case "src", "source":
+			if len(kv) == 1 {
+				return nil, errors.Wrapf(optionArgError, kv[0])
+			}
+			newVolume.Name = kv[1]
+			setSource = true
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return nil, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := ValidateVolumeCtrDir(kv[1]); err != nil {
+				return nil, err
+			}
+			newVolume.Dest = kv[1]
+			setDest = true
+		default:
+			return nil, errors.Wrapf(badOptionError, kv[0])
+		}
+	}
+
+	if !setSource {
+		return nil, errors.Errorf("must set source volume")
+	}
+	if !setDest {
+		return nil, noDestError
+	}
+
+	return newVolume, nil
+}
+
+// ValidateVolumeHostDir validates a volume mount's source directory
+func ValidateVolumeHostDir(hostDir string) error {
+	if len(hostDir) == 0 {
+		return errors.Errorf("host directory cannot be empty")
+	}
+	if filepath.IsAbs(hostDir) {
+		if _, err := os.Stat(hostDir); err != nil {
+			return errors.Wrapf(err, "error checking path %q", hostDir)
+		}
+	}
+	// If hostDir is not an absolute path, that means the user wants to create a
+	// named volume. This will be done later on in the code.
+	return nil
+}
+
+// ValidateVolumeCtrDir validates a volume mount's destination directory.
+func ValidateVolumeCtrDir(ctrDir string) error {
+	if len(ctrDir) == 0 {
+		return errors.Errorf("container directory cannot be empty")
+	}
+	if !filepath.IsAbs(ctrDir) {
+		return errors.Errorf("invalid container path %q, must be an absolute path", ctrDir)
+	}
+	return nil
+}
+
+// ValidateVolumeOpts validates a volume's options
+func ValidateVolumeOpts(option string) error {
+	var foundRootPropagation, foundRWRO, foundLabelChange int
+	options := strings.Split(option, ",")
+	for _, opt := range options {
+		switch opt {
+		case "rw", "ro":
+			foundRWRO++
+			if foundRWRO > 1 {
+				return errors.Errorf("invalid options %q, can only specify 1 'rw' or 'ro' option", option)
+			}
+		case "z", "Z":
+			foundLabelChange++
+			if foundLabelChange > 1 {
+				return errors.Errorf("invalid options %q, can only specify 1 'z' or 'Z' option", option)
+			}
+		case "private", "rprivate", "shared", "rshared", "slave", "rslave":
+			foundRootPropagation++
+			if foundRootPropagation > 1 {
+				return errors.Errorf("invalid options %q, can only specify 1 '[r]shared', '[r]private' or '[r]slave' option", option)
+			}
+		default:
+			return errors.Errorf("invalid option type %q", option)
+		}
+	}
+	return nil
+}
+
+// GetVolumeMounts takes user provided input for bind mounts and creates Mount structs
+func (config *CreateConfig) getVolumeMounts() (map[string]spec.Mount, map[string]*libpod.ContainerNamedVolume, error) {
+	mounts := make(map[string]spec.Mount)
+	volumes := make(map[string]*libpod.ContainerNamedVolume)
+
+	volumeFormatErr := errors.Errorf("incorrect volume format, should be host-dir:ctr-dir[:option]")
+
+	for _, vol := range config.Volumes {
+		var (
+			options []string
+			src     string
+			dest    string
+		)
+
+		splitVol := strings.Split(vol, ":")
+		if len(splitVol) > 3 {
+			return nil, nil, errors.Wrapf(volumeFormatErr, vol)
+		}
+
+		src = splitVol[0]
+		if len(splitVol) == 1 {
+			dest = src
+		} else if len(splitVol) > 1 {
+			dest = splitVol[1]
+		}
+		if len(splitVol) > 2 {
+			if err := ValidateVolumeOpts(splitVol[2]); err != nil {
+				return nil, nil, err
+			}
+			options = strings.Split(splitVol[2], ",")
+		}
+
+		if err := ValidateVolumeHostDir(src); err != nil {
+			return nil, nil, err
+		}
+		if err := ValidateVolumeCtrDir(dest); err != nil {
+			return nil, nil, err
+		}
+
+		if strings.HasPrefix(src, "/") || strings.HasPrefix(src, ".") {
+			// This is not a named volume
+			newMount := spec.Mount{
+				Destination: dest,
+				Type:        string(TypeBind),
+				Source:      src,
+				Options:     processOptions(options),
+			}
+			if _, ok := mounts[newMount.Destination]; ok {
+				return nil, nil, errors.Wrapf(errDuplicateDest, newMount.Destination)
+			}
+			mounts[newMount.Destination] = newMount
+		} else {
+			// This is a named volume
+			newNamedVol := new(libpod.ContainerNamedVolume)
+			newNamedVol.Name = src
+			newNamedVol.Dest = dest
+			newNamedVol.Options = options
+
+			if _, ok := volumes[newNamedVol.Dest]; ok {
+				return nil, nil, errors.Wrapf(errDuplicateDest, newNamedVol.Dest)
+			}
+			volumes[newNamedVol.Dest] = newNamedVol
+		}
+
+		logrus.Debugf("User mount %s:%s options %v", src, dest, options)
+	}
+
+	return mounts, volumes, nil
+}
+
+// Get mounts for container's image volumes
+func (config *CreateConfig) getImageVolumes() (map[string]spec.Mount, map[string]*libpod.ContainerNamedVolume, error) {
+	mounts := make(map[string]spec.Mount)
+	volumes := make(map[string]*libpod.ContainerNamedVolume)
+
+	if config.ImageVolumeType == "ignore" {
+		return mounts, volumes, nil
+	}
+
+	for vol := range config.BuiltinImgVolumes {
+		if config.ImageVolumeType == "tmpfs" {
+			// Tmpfs image volumes are handled as mounts
+			mount := spec.Mount{
+				Destination: vol,
+				Source:      TypeTmpfs,
+				Type:        TypeTmpfs,
+				Options:     []string{"rprivate", "rw", "nodev"},
+			}
+			mounts[vol] = mount
+		} else {
+			namedVolume := new(libpod.ContainerNamedVolume)
+			namedVolume.Name = stringid.GenerateNonCryptoID()
+			namedVolume.Options = []string{"rprivate", "rw", "nodev"}
+			namedVolume.Dest = vol
+			volumes[vol] = namedVolume
+		}
+	}
+
+	return mounts, volumes, nil
+}
+
+// GetTmpfsMounts creates spec.Mount structs for user-requested tmpfs mounts
+func (config *CreateConfig) getTmpfsMounts() (map[string]spec.Mount, error) {
+	m := make(map[string]spec.Mount)
+	for _, i := range config.Tmpfs {
+		// Default options if nothing passed
+		options := []string{"rprivate", "rw", "noexec", "nosuid", "nodev", "size=65536k"}
+		spliti := strings.Split(i, ":")
+		destPath := spliti[0]
+		if len(spliti) > 1 {
+			options = strings.Split(spliti[1], ",")
+		}
+
+		if _, ok := m[destPath]; ok {
+			return nil, errors.Wrapf(errDuplicateDest, destPath)
+		}
+
+		// TODO: Do we want to set some default options if the user
+		// passed options?
+		// TODO: should we validate the options passed in?
+		mount := spec.Mount{
+			Destination: destPath,
+			Type:        string(TypeTmpfs),
+			Options:     options,
+			Source:      string(TypeTmpfs),
+		}
+		m[destPath] = mount
+	}
+	return m, nil
+}
+
+// AddContainerInitBinary adds the init binary specified by path iff the
+// container will run in a private PID namespace that is not shared with the
+// host or another pre-existing container, where an init-like process is
+// already running.
+//
+// Note that AddContainerInitBinary prepends "/dev/init" "--" to the command
+// to execute the bind-mounted binary as PID 1.
+func (config *CreateConfig) addContainerInitBinary(path string) (spec.Mount, error) {
+	mount := spec.Mount{
+		Destination: "/dev/init",
+		Type:        TypeBind,
+		Source:      path,
+		Options:     []string{TypeBind, "ro"},
+	}
+
+	if path == "" {
+		return mount, fmt.Errorf("please specify a path to the container-init binary")
+	}
+	if !config.PidMode.IsPrivate() {
+		return mount, fmt.Errorf("cannot add init binary as PID 1 (PID namespace isn't private)")
+	}
+	if config.Systemd {
+		return mount, fmt.Errorf("cannot use container-init binary with systemd")
+	}
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		return mount, errors.Wrap(err, "container-init binary not found on the host")
+	}
+	config.Command = append([]string{"/dev/init", "--"}, config.Command...)
+	return mount, nil
+}
+
+// Handle options for volume mounts
+func processOptions(options []string) []string {
+	var (
+		foundrw, foundro bool
+		rootProp         string
+	)
+	options = append(options, "rbind")
+	for _, opt := range options {
+		switch opt {
+		case "rw":
+			foundrw = true
+		case "ro":
+			foundro = true
+		case "private", "rprivate", "slave", "rslave", "shared", "rshared":
+			rootProp = opt
+		}
+	}
+	if !foundrw && !foundro {
+		options = append(options, "rw")
+	}
+	if rootProp == "" {
+		options = append(options, "rprivate")
+	}
+	return options
+}
+
+func supercedeUserMounts(mounts []spec.Mount, configMount []spec.Mount) []spec.Mount {
+	if len(mounts) > 0 {
+		// If we have overlappings mounts, remove them from the spec in favor of
+		// the user-added volume mounts
+		destinations := make(map[string]bool)
+		for _, mount := range mounts {
+			destinations[path.Clean(mount.Destination)] = true
+		}
+		// Copy all mounts from spec to defaultMounts, except for
+		//  - mounts overridden by a user supplied mount;
+		//  - all mounts under /dev if a user supplied /dev is present;
+		mountDev := destinations["/dev"]
+		for _, mount := range configMount {
+			if _, ok := destinations[path.Clean(mount.Destination)]; !ok {
+				if mountDev && strings.HasPrefix(mount.Destination, "/dev/") {
+					// filter out everything under /dev if /dev is user-mounted
+					continue
+				}
+
+				logrus.Debugf("Adding mount %s", mount.Destination)
+				mounts = append(mounts, mount)
+			}
+		}
+		return mounts
+	}
+	return configMount
+}
+
+// Ensure mount options on all mounts are correct
+func initFSMounts(inputMounts []spec.Mount) []spec.Mount {
+	var mounts []spec.Mount
+	for _, m := range inputMounts {
+		m.Options = processOptions(m.Options)
+		if m.Type == "tmpfs" {
+			m.Options = append(m.Options, "tmpcopyup")
+		} else {
+			mounts = append(mounts, m)
+		}
+	}
+	return mounts
+}