:ro/:rw volume mode suffixes were being embedded into the container path instead of being extracted as a separate read_only

Author: vsilent

src/cli/stacker_client.rs

@@ -997,12 +997,21 @@ fn parse_port_mapping(port_str: &str) -> (String, String) {
 }
 
 /// Parse a volume mapping string like "./dist:/usr/share/nginx/html" or "data:/var/lib/db"
-/// into (host_path, container_path) tuple.
-fn parse_volume_mapping(vol_str: &str) -> (String, String) {
-    if let Some((host, container)) = vol_str.split_once(':') {
-        (host.to_string(), container.to_string())
-    } else {
-        (vol_str.to_string(), vol_str.to_string())
+/// into (host_path, container_path, read_only) tuple.
+/// Handles optional `:ro` / `:rw` suffix (e.g. "/var/run/docker.sock:/var/run/docker.sock:ro").
+fn parse_volume_mapping(vol_str: &str) -> (String, String, bool) {
+    let parts: Vec<&str> = vol_str.split(':').collect();
+    match parts.len() {
+        // "source:target:mode" (e.g. "/host:/container:ro")
+        3 => (
+            parts[0].to_string(),
+            parts[1].to_string(),
+            parts[2] == "ro",
+        ),
+        // "source:target"
+        2 => (parts[0].to_string(), parts[1].to_string(), false),
+        // bare path
+        _ => (vol_str.to_string(), vol_str.to_string(), false),
     }
 }
 
@@ -1028,10 +1037,11 @@ fn service_to_app_json(svc: &ServiceDefinition, network_ids: &[String]) -> serde
         .volumes
         .iter()
         .map(|v| {
-            let (host, container) = parse_volume_mapping(v);
+            let (host, container, read_only) = parse_volume_mapping(v);
             serde_json::json!({
                 "host_path": host,
                 "container_path": container,
+                "read_only": read_only,
             })
         })
         .collect();
@@ -1116,10 +1126,11 @@ fn app_source_to_app_json(
         .volumes
         .iter()
         .map(|v| {
-            let (host, container) = parse_volume_mapping(v);
+            let (host, container, read_only) = parse_volume_mapping(v);
             serde_json::json!({
                 "host_path": host,
                 "container_path": container,
+                "read_only": read_only,
             })
         })
         .collect();

src/forms/project/volume.rs

@@ -27,11 +27,23 @@ impl TryInto<dctypes::AdvancedVolumes> for &Volume {
     type Error = String;
     fn try_into(self) -> Result<dctypes::AdvancedVolumes, Self::Error> {
         let source = self.host_path.clone();
-        let target = self.container_path.clone();
+        let raw_target = self.container_path.clone().unwrap_or_default();
+
+        // Strip `:ro` / `:rw` suffix from container_path and extract read_only flag.
+        // Data may arrive with the mode embedded (e.g. "/var/run/docker.sock:ro").
+        let (target, read_only) = if raw_target.ends_with(":ro") {
+            (raw_target.trim_end_matches(":ro").to_string(), true)
+        } else if raw_target.ends_with(":rw") {
+            (raw_target.trim_end_matches(":rw").to_string(), false)
+        } else {
+            (raw_target, false)
+        };
+
         tracing::debug!(
-            "Volume conversion result: source: {:?} target: {:?}",
+            "Volume conversion result: source: {:?} target: {:?} read_only: {}",
             source,
-            target
+            target,
+            read_only
         );
 
         let _type = if self.is_named_docker_volume() {
@@ -42,9 +54,9 @@ impl TryInto<dctypes::AdvancedVolumes> for &Volume {
 
         Ok(dctypes::AdvancedVolumes {
             source: source,
-            target: target.unwrap_or("".to_string()),
+            target: target,
             _type: _type.to_string(),
-            read_only: false,
+            read_only,
             bind: None,
             volume: None,
             tmpfs: None,

src/services/config_renderer.rs

@@ -344,20 +344,33 @@ impl ConfigRenderer {
                 let mut result = Vec::new();
                 for item in arr {
                     if let Value::Object(map) = item {
+                        // Support both "source"/"target" and "host_path"/"container_path" keys
                         let source = map
                             .get("source")
+                            .or_else(|| map.get("host_path"))
                             .and_then(|v| v.as_str())
                             .unwrap_or("")
                             .to_string();
-                        let target = map
+                        let raw_target = map
                             .get("target")
+                            .or_else(|| map.get("container_path"))
                             .and_then(|v| v.as_str())
                             .unwrap_or("")
                             .to_string();
+
+                        // Strip `:ro` / `:rw` suffix that may be embedded in the target path
+                        let (target, suffix_ro) = if raw_target.ends_with(":ro") {
+                            (raw_target.trim_end_matches(":ro").to_string(), true)
+                        } else if raw_target.ends_with(":rw") {
+                            (raw_target.trim_end_matches(":rw").to_string(), false)
+                        } else {
+                            (raw_target, false)
+                        };
+
                         let read_only = map
                             .get("read_only")
                             .and_then(|v| v.as_bool())
-                            .unwrap_or(false);
+                            .unwrap_or(suffix_ro);
                         if !source.is_empty() && !target.is_empty() {
                             result.push(VolumeMount {
                                 source,