Incorrect "mount" in config.json is either silently ignored or crashes runsc

[stepancheg]

Description

    "mounts": [
        {
            "destination": "/ddd",
            "source": "/",
            // and if we specify here "type": "bind", runsc crashes
        }
    ]

does not do anything except creating empty directory.

Moreover, specifying "type": "bind" causes runsc to crash.

This is correct version, but this issue is about missing validation, if this configuration is not correct.

"mounts": [
    {
      "destination": "/ddd",
      "source": "/",
      "type": "bind",
      "options": ["rbind", "rw"]
    }
  ]

Steps to reproduce

{
    "process": {
        "args": ["/bin/bash"],
        "terminal": true
    },
    "root": {
        "path": "/"
    },
    "mounts": [
        {
            "destination": "/ddd",
            "source": "/"
        }
    ]
}

$ sudo bazel-bin/runsc/runsc_/runsc run --bundle ~/bu2 cont-x

root@:/# ls -l /ddd 
total 0

root@:/# mount
none on / type overlay (rw)
none on /sys type sysfs (rw,dentry_cache_limit=1000)
none on /dev type tmpfs (rw,mode=0755)
none on /proc type proc (rw,dentry_cache_limit=1000)
none on /dev/pts type devpts (rw)

Log: https://gist.github.com/stepancheg/82cee1f2095405d1c5b790240ad62564

{
    "process": {
        "args": ["/bin/bash"],
        "terminal": true
    },
    "root": {
        "path": "/"
    },
    "mounts": [
        {
            "destination": "/ddd",
            "source": "/",
            "type": "bind"
        }
    ]
}

$ sudo bazel-bin/runsc/runsc_/runsc run --bundle ~/bu2 cont-x

running container: creating container: cannot create sandbox: cannot read client sync file: waiting for sandbox to start: EOF

Log: https://gist.github.com/stepancheg/81c05a3b18909e28716f6cee945c456e

runsc version

runsc version release-20250505.0-31-gd30c58e5b8a4
spec: 1.2.0

uname

Linux w-st 6.6.72+ #1 SMP PREEMPT_DYNAMIC Sat Apr 19 09:07:01 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

repo state (if built from source)

release-20250505.0-31-gd30c58e5b

[ayushr2]

When the mount type is not specified, gVisor just ignores the mount:

gvisor/runsc/boot/vfs.go

Lines 929 to 931 in d30c58e

	default:
	log.Warningf("ignoring unknown filesystem type %q", m.mount.Type)
	return "", nil, nil

In this case, runc attempts to mount it and fails with:

WARN[0000] freezer not supported: openat2 /sys/fs/cgroup/user.slice/user-676784.slice/cont/cgroup.freeze: no such file or directory 
WARN[0000] lstat /sys/fs/cgroup/user.slice/user-676784.slice/cont: no such file or directory 
ERRO[0000] runc run failed: unable to start container process: error during container init: error mounting "/" to rootfs at "/ddd": mount /:/ddd (via /proc/self/fd/7): no such device 

After adding "type": "bind" but without the options, the failure happens with gVisor because the gofer fails with:

FATAL ERROR: error setting up FS: mounting {Destination:/ddd Type:bind Source:/ Options:[] UIDMappings:[] GIDMappings:[]}: mount("/", "/proc/fs/root/ddd", 4096) failed: mount("/", "/proc/fs/proc/self/fd/14", "bind", 0x1000, "") failed: invalid argument

This failure is WAI I think.

BTW don't try this reproducer with runc (after adding type=bind), because it can brick your system: opencontainers/runc#4767.