Merge pull request #1206 from weaveworks/1201-weavewait-ro

[proxy] Mount weavewait readonly so it can't be tampered with

Fixes #1201.

proxy/create_container_interceptor.go

@@ -53,7 +53,7 @@ func (i *createContainerInterceptor) InterceptRequest(r *http.Request) error {
 		if container.HostConfig == nil {
 			container.HostConfig = &docker.HostConfig{}
 		}
-		container.HostConfig.VolumesFrom = append(container.HostConfig.VolumesFrom, "weaveproxy")
+		container.HostConfig.VolumesFrom = append(container.HostConfig.VolumesFrom, "weaveproxy:ro")
 		if container.Config == nil {
 			container.Config = &docker.Config{}
 		}

test/610_proxy_wait_for_weave_test.sh

@@ -25,4 +25,7 @@ assert "entrypoint c2" "$(entrypoint $COMMITTED_IMAGE)"
 docker_on $HOST1 run -dit --name c3 $SMALL_IMAGE /bin/sh
 assert_raises "proxy docker_on $HOST1 exec c3 true"
 
+# Check we can't modify weavewait
+assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=10.2.1.2/24' $BASE_IMAGE touch /w/w" 1
+
 end_suite