Exclude /run/host-services When Using Docker Desktop on MacOS

[timway]

• Docker Desktop takes care of setting up ssh-agent forwarding from MacOS but does in a way that is only allowed to root inside the container
• As documented at the time of commit at https://docs.docker.com/desktop/networking/#ssh-agent-forwarding
• Move the None check ahead of the path checking with a specific error message to clearly differentiate that error from path checking errors

Partially addresses #1292 by exempting paths starting with /run/host-services in containerized mode on docker from the source path check.

I'd like to hear feedback on making --user root the default for docker possibly when a volume mount has a path sourced in /run/host-services on docker or in all cases on docker.

A similar fix like this one will be required in order to resolve ansible/ansible-navigator#1593 after/if this is merged into ansible-runner as well.

[timway]

Just checking in on this issue. What should I be doing to advance this?

I wrote a very targeted fix for the issue but I noticed it may be better to look holistically at the project. Would it be better to design an interface various process isolation methods could implement? That would make it easier to implement the various scenarios that runner is getting leveraged in these days. I'd be willing to take a shot at the initial design and see where it goes if necessary. I'd need to know where maintainers see things before spending substantial time on something like that though.

[wmudge]

@timway - would be a +1 if this could be an option for ansible-runner, as other container engines like Colima provide the SSH socket in other paths. See abiosoft/colima#127

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[erictoner]

+1 On this; this is absolutely needed for Docker if you want any kind of SSH forwarding from the host machine.