Skip to content

Disallow mounting folders on the guest's root for WASIX modules #5475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Arshia001 merged 2 commits into from
Jan 8, 2026
Merged

Disallow mounting folders on the guest's root for WASIX modules #5475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
db04d04
Disallow mounting folders on the guest's root for WASIX modules
Arshia001 Mar 12, 2025
105fa1f
Turn the hard error into a warning in the name of backwards compatibi…
Arshia001 Jan 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions lib/cli/src/commands/run/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,7 +423,8 @@ impl Run {
uses: Vec<BinaryPackage>,
runtime: Arc<dyn Runtime + Send + Sync>,
) -> Result<(), Error> {
let mut runner = self.build_wasi_runner(&runtime)?;
// Assume webcs are always WASIX
let mut runner = self.build_wasi_runner(&runtime, true)?;
Runner::run_command(&mut runner, command_name, pkg, runtime)
}

Expand Down Expand Up @@ -506,7 +507,7 @@ impl Run {
pkg: &BinaryPackage,
runtime: Arc<dyn Runtime + Send + Sync>,
) -> Result<(), Error> {
let mut inner = self.build_wasi_runner(&runtime)?;
let mut inner = self.build_wasi_runner(&runtime, true)?;
let mut runner = wasmer_wasix::runners::dproxy::DProxyRunner::new(inner, pkg);
runner.run_command(command_name, pkg, runtime)
}
Expand Down Expand Up @@ -555,12 +556,13 @@ impl Run {
fn build_wasi_runner(
&self,
runtime: &Arc<dyn Runtime + Send + Sync>,
is_wasix: bool,
) -> Result<WasiRunner, anyhow::Error> {
let packages = self.load_injected_packages(runtime)?;

let mut runner = WasiRunner::new();

let (is_home_mapped, mapped_diretories) = self.wasi.build_mapped_directories()?;
let (is_home_mapped, mapped_diretories) = self.wasi.build_mapped_directories(is_wasix)?;

runner
.with_args(&self.args)
Expand Down Expand Up @@ -625,7 +627,7 @@ impl Run {
) -> Result<(), Error> {
let program_name = wasm_path.display().to_string();

let runner = self.build_wasi_runner(&runtime)?;
let runner = self.build_wasi_runner(&runtime, wasmer_wasix::is_wasix_module(&module))?;
runner.run_wasm(
RuntimeOrEngine::Runtime(runtime),
&program_name,
Expand Down
32 changes: 28 additions & 4 deletions lib/cli/src/commands/run/wasi.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,7 +495,10 @@ impl Wasi {
Ok(Vec::new())
}

pub fn build_mapped_directories(&self) -> Result<(bool, Vec<MappedDirectory>), anyhow::Error> {
pub fn build_mapped_directories(
&self,
is_wasix: bool,
) -> Result<(bool, Vec<MappedDirectory>), anyhow::Error> {
let mut mapped_dirs = Vec::new();

// Process the --dirs flag and merge it with --mapdir.
Expand All @@ -514,9 +517,19 @@ impl Wasi {

MappedDirectory {
host: current_dir,
guest: MAPPED_CURRENT_DIR_DEFAULT_PATH.to_string(),
guest: if is_wasix {
MAPPED_CURRENT_DIR_DEFAULT_PATH.to_string()
} else {
"/".to_string()
},
}
} else {
if dir == Path::new("/") && is_wasix {
tracing::warn!(
"Pre-opening the root directory with --dir=/ breaks WASIX modules' filesystems"
);
}

let resolved = dir.canonicalize().with_context(|| {
format!(
"could not canonicalize path for argument '--dir {}'",
Expand Down Expand Up @@ -551,11 +564,18 @@ impl Wasi {
}

for MappedDirectory { host, guest } in &self.mapped_dirs {
if guest == "/" && is_wasix {
// Note: it appears we canonicalize the path before this point and showing the value of
// `host` in the error message may throw users off, so we use a placeholder.
tracing::warn!(
"Mounting on the guest's virtual root with --mapdir /:<HOST_PATH> breaks WASIX modules' filesystems"
);
}
let resolved_host = host.canonicalize().with_context(|| {
format!(
"could not canonicalize path for argument '--mapdir {}:{}'",
host.display(),
guest,
host.display(),
)
})?;

Expand All @@ -569,7 +589,11 @@ impl Wasi {

MappedDirectory {
host: resolved_host,
guest: MAPPED_CURRENT_DIR_DEFAULT_PATH.to_string(),
guest: if is_wasix {
MAPPED_CURRENT_DIR_DEFAULT_PATH.to_string()
} else {
"/".to_string()
},
Comment on lines -572 to +596
Copy link
Contributor

@zebreus zebreus Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the only thing that really changed. I don't understand why this change is made and if it is an improvement.

Copy link
Contributor

@zebreus zebreus Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Arshia001 If you are 100% certain this is a good idea, then go ahead and merge

Copy link
Member Author

@Arshia001 Arshia001 Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zebreus this is kind of the main issue! With WASI modules, nothing is mounted in the module's FS by default, so it's OK to mount wherever. With WASIX, we mount a lot of stuff in by default, so you don't want a mount on the root.

Now, with WASI, since there is no host-side CWD and you're at / by default, you just have to mount directly in / to make the files available to the module with relative paths. With WASIX, we mount into /home and cd into it.

Copy link
Contributor

@zebreus zebreus Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What I don't understand is that when MAPPED_CURRENT_DIR_DEFAULT_PATH is already defined to /home and that seems to work just fine.

If I understand you correctly the reason for the change is to make sure that the mountpoint is always the CWD, which it can't be for WASI. But we also can't always mount to / because that won't work for WASIX...

Copy link
Contributor

@zebreus zebreus Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So in the past, the dir was just mounted to /home for WASI and now it isn't anymore. While this could be breaking, it's probably an improvement. However I don't like that it's one more inconsistency.

}
} else {
MappedDirectory {
Expand Down
18 changes: 12 additions & 6 deletions lib/wasix/src/runtime/package_loader/load_package_tree.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -466,9 +466,6 @@ fn filesystem_v3(
) -> Result<UnionFileSystem, Error> {
let mut volumes: HashMap<&PackageId, BTreeMap<String, Volume>> = HashMap::new();

let mut mountings: Vec<_> = pkg.filesystem.iter().collect();
mountings.sort_by_key(|m| std::cmp::Reverse(m.mount_path.as_path()));

let union_fs = UnionFileSystem::new();

for ResolvedFileSystemMapping {
Expand All @@ -482,6 +479,12 @@ fn filesystem_v3(
continue;
}

if mount_path.as_path() == Path::new("/") {
tracing::warn!(
"The \"{package}\" package wants to mount a volume at \"/\", which breaks WASIX modules' filesystems",
);
}

// Note: We want to reuse existing Volume instances if we can. That way
// we can keep the memory usage down. A webc::compat::Volume is
// reference-counted, anyway.
Expand Down Expand Up @@ -538,9 +541,6 @@ fn filesystem_v2(
) -> Result<UnionFileSystem, Error> {
let mut volumes: HashMap<&PackageId, BTreeMap<String, Volume>> = HashMap::new();

let mut mountings: Vec<_> = pkg.filesystem.iter().collect();
mountings.sort_by_key(|m| std::cmp::Reverse(m.mount_path.as_path()));

let union_fs = UnionFileSystem::new();

for ResolvedFileSystemMapping {
Expand All @@ -554,6 +554,12 @@ fn filesystem_v2(
continue;
}

if mount_path.as_path() == Path::new("/") {
tracing::warn!(
"The \"{package}\" package wants to mount a volume at \"/\", which breaks WASIX modules' filesystems",
);
}

// Note: We want to reuse existing Volume instances if we can. That way
// we can keep the memory usage down. A webc::compat::Volume is
// reference-counted, anyway.
Expand Down
Loading