app containers can break weave and inject code by overwriting /w/w

[rade]

$ weave launch
$ eval $(weave env)
$ docker run --rm -ti ubuntu
root@65a8d6e07d6b:/# rm /w/w
root@65a8d6e07d6b:/# exit
exit
$ docker run --rm -ti ubuntu
exec: "/w/w": stat /w/w: no such file or directory
Error response from daemon: 87a39af540d39d0bf6bfc9e9b9facb22aba5f2ab2aea2efbe08ed8c9bff8c5fd container is not running.

And instead of removing /w/w I could also inject arbitrary code that will execute next time any container executes /w/w.

Solution: mount the volume read-only with -v ...:ro.

[joserivca]

Hi rade,
Weave inyect all my containers with "/w/w",
i cant execute any container
how can roll back in all my containers??

[rade]

@joserivca that is not what this issue is about. Please open a new one.