Repository navigation
Nothing measures that an accepted form runs: the oracle only covers refusals #118
Description
tests/integration/refusals.py measures one direction only. REFUSALS proves podman will not make a mount we refuse; LIMITATIONS proves it would. Neither says anything about the forms compose2pod accepts, and that is the direction #104 and #114 both failed in: a document passes the gate, emits a flag, and the script dies at podman run.
#114 is closed, but only the instance. The class is open.
The gap, measured
Of the nested option keys that reach a --mount, the scenario suite executes exactly one against real podman:
| key | renders as | executed on podman? |
|---|---|---|
bind.propagation |
bind-propagation= |
yes, tests/integration/test_volume_nested_options.py |
bind.selinux |
relabel= |
no |
tmpfs.size |
tmpfs-size= |
no |
tmpfs.mode |
tmpfs-mode= |
no |
subpath sat in that same column until #117 refused it. It was accepted, emitted, covered 100% by unit tests, and unrunnable on the podman in this repo's own CI, for two releases.
Unit coverage cannot find this. test_emit.py asserts the string compose2pod produces, which is a fact about compose2pod, not about podman. The conformance harness asks docker compose config, which is happy. The only oracle that would have caught it is the one that runs the flag.
What would close it
A table with the shape REFUSALS already has, inverted: for each option compose2pod emits, one podman run that carries the flag, asserted to exit 0. Same fixture (probe_podman), same "assert the exit code, print the message" discipline, same terminal-summary section.
That gives the floor declared in ADR-0006 a test. Today the floor is a claim in the README; with an acceptance table it becomes a measurement, and raising the floor becomes an experiment rather than an argument.
Scope notes
- The gate that every rule-two refusal has a row is #109 phase 3. This is its mirror, and the two want the same exemption vocabulary, so they should probably be designed together even if they land apart.
- Start with the nested
--mountoptions above, because that is where the two known escapes happened. Widening to every flagkeys.pyrenders is a separate decision: most are long-established podman flags, and I checked during fix: declare podman 4.9 the floor and refuse every subpath above it #117 that none of them sits above the 4.9 floor. - A row here asserts exit 0, so it goes red when a newer podman drops or renames an option. That is the same maintenance trigger the
subpathrefusal rows carry, pointing the other way.
Activity
lesnik512 commentedon Sep 20, 2026
Measured, podman 4.9.3, CI (run 35509724204)
Every nested
--mountoption compose2pod can emit, plus the service-level--tmpfs, run once against the floor:No bugs found. That is the outcome this issue wanted either way: the four unexecuted keys turn out to work, and all six
_PROPAGATION_VALUESwork, includingshared/rshared, which I half-expected to fail on a bind whose source is not itself a shared mount.The value is not in today's verdict, it is in having somewhere for it to go red. So the table is still worth writing, now with the reassurance that it starts green.
Row shape I will use, mirroring
Refusal's three assertions rather than inventing a fourth idiom:validate()accepts the document,emitproduces equals the row's expectation — this is the assertion that stops the row drifting away from what the tool actually emits, which is the driftsubpathhid behind,podman runwith that flag exits 0.Note (2) is deliberately the opposite of
refusals.py's rule, where the argv is hand-written so that an emit bug cannot hide behind a parity claim. Here the emitted flag is the thing under test, so it has to come from emit.test: measure that an accepted mount compiles to a flag podman runs