commit 17b33fcc544d3dc606d882100307b058734305d0
author Geoffrey Martin-Noble <gcmn@google.com> Tue Sep 13 18:19:24 2022 -0700
committer GitHub <noreply@github.com> Tue Sep 13 18:19:24 2022 -0700
tree 26b3f13a7ced83fc8854b055e00876b77f9e3c46
parent 9db55e74a392e9bc244f39a704a4dcb10c4c36b8

Use `--mount` instead of `--volume` in `docker run` (#10392)

`--mount` is the new recommended syntax. It is more verbose and
explicit. See https://docs.docker.com/storage/bind-mounts/.

The direct motivation here was trying to debug what turns out to be
unhelpful behavior if you use `--volume`: if you bind a directory, *even
a read-only one*, that does not exist, Docker will create the directory
as root. This was causing issues with binding the `.config/gcloud`
directory, which we do to allow using existing credentials when running
locally. I did not even imagine that a command with "readonly" in the
name would be writing to the filesystem, let alone as the root user. If
you end up with a `.config/gcloud` directory owned by root, basically
every `gcloud` command breaks.

The recommended fix is to not use `--volume` (see
https://github.com/moby/moby/issues/13121 ). In fact, this appears to
be the only behavior that is actually different between `--volume` and
`--mount`. The latter will do the much more sensible thing and throw an
error if you try to bind a non-existent directory.