fix(box): single-file bind mount no longer clobbers parent dir

A '-v /host/file:/etc/app.conf' mount destroyed the entire target parent
directory (/etc lost hostname/passwd/etc.). The shim correctly converts a
file mount to a temp-dir virtio-fs share, but the guest mounted that share
*over the parent dir* (/etc), and the two sides decided file-vs-dir with
disagreeing heuristics (shim: host_path.is_file(); guest: dot-in-name).

- Host (spec.rs) is now authoritative: emits an explicit ':file' flag on
  BOX_VOL_<i> when the source path stats as a file.
- Guest (init) obeys the flag: mounts the share at a private mountpoint,
  then bind-mounts only the file onto guest_path, preserving the parent.
  Honors :ro via an MS_REMOUNT pass. Dir mounts unchanged.
- Shim: per-mount temp dir keyed by tag so two file mounts sharing a
  basename don't collide.

Verified on KVM: file content present at target; /etc intact (37 entries,
hostname present) vs clobbered (1 entry) before; :ro rejects writes and
leaves host file unchanged; dir mounts still read+write-back. Known limit:
rw single-file writes are guest-isolated (share is a copy), not written
back to the host file.

Author: Roy Lin

src/guest/init/src/main.rs

@@ -692,71 +692,87 @@ fn mount_user_volumes() -> Result<(), Box<dyn std::error::Error>> {
 
                 let tag = parts[0];
                 let guest_path = parts[1];
-                let read_only = parts.get(2).map(|&m| m == "ro").unwrap_or(false);
-
-                // Check if guest_path is a file (has an extension) or a directory
-                // virtio-fs can only mount directories, so if guest_path is a file,
-                // we need to mount at the parent directory instead
-                let mount_path: &str;
-                let file_name: Option<&str>;
-
-                if guest_path
-                    .rsplit('/')
-                    .next()
-                    .map(|s| s.contains('.'))
-                    .unwrap_or(false)
-                {
-                    // guest_path looks like a file (has extension)
-                    // Extract parent directory and file name
+                // Flags after the guest path may appear in any order: "ro", "file".
+                // The host decides "file" (it can stat the source); the guest obeys.
+                let read_only = parts[2..].iter().any(|&m| m == "ro");
+                let is_file = parts[2..].iter().any(|&m| m == "file");
+
+                let flags = if read_only {
+                    MsFlags::MS_RDONLY
+                } else {
+                    MsFlags::empty()
+                };
+
+                if is_file {
+                    // Single-file bind mount. The shim shares a temp DIRECTORY
+                    // containing the file (virtio-fs cannot share a bare file), so
+                    // mount that share at a private location and bind just the file
+                    // onto guest_path. This preserves the target's parent directory
+                    // (e.g. /etc) instead of clobbering it with the share.
+                    let file_name = guest_path.rsplit('/').next().unwrap_or(guest_path);
+                    let private_mp = format!("/run/.a3s-filemounts/{}", index);
+                    std::fs::create_dir_all(&private_mp)?;
+                    mount(
+                        Some(tag),
+                        private_mp.as_str(),
+                        Some("virtiofs"),
+                        MsFlags::empty(),
+                        None::<&str>,
+                    )?;
+
+                    let src = format!("{}/{}", private_mp, file_name);
+                    if !std::path::Path::new(&src).exists() {
+                        warn!("File mount source {} missing in share {}", src, tag);
+                    }
+
+                    // Ensure the target parent and an (empty) target file exist so
+                    // the bind has somewhere to land.
                     if let Some(last_slash) = guest_path.rfind('/') {
-                        mount_path = &guest_path[..last_slash];
-                        file_name = Some(&guest_path[last_slash + 1..]);
-                    } else {
-                        // No slash, just a filename - mount at current directory
-                        mount_path = ".";
-                        file_name = Some(guest_path);
+                        let parent = &guest_path[..last_slash];
+                        if !parent.is_empty() {
+                            std::fs::create_dir_all(parent)?;
+                        }
+                    }
+                    if !std::path::Path::new(guest_path).exists() {
+                        std::fs::File::create(guest_path)?;
+                    }
+
+                    // Bind the file, then remount read-only if requested (a bind
+                    // mount needs a separate MS_REMOUNT pass to apply MS_RDONLY).
+                    mount(
+                        Some(src.as_str()),
+                        guest_path,
+                        None::<&str>,
+                        MsFlags::MS_BIND,
+                        None::<&str>,
+                    )?;
+                    if read_only {
+                        mount(
+                            None::<&str>,
+                            guest_path,
+                            None::<&str>,
+                            MsFlags::MS_BIND | MsFlags::MS_REMOUNT | MsFlags::MS_RDONLY,
+                            None::<&str>,
+                        )?;
                     }
                     info!(
                         tag = tag,
                         guest_path = guest_path,
-                        mount_path = mount_path,
-                        file_name = file_name.unwrap_or(""),
                         read_only = read_only,
-                        "Mounting user volume (file mount detected, will mount parent directory)"
+                        "Mounted file volume (bind; parent directory preserved)"
                     );
                 } else {
-                    // guest_path is a directory
-                    mount_path = guest_path;
-                    file_name = None;
+                    // Directory mount: mount the virtio-fs share directly at guest_path.
+                    std::fs::create_dir_all(guest_path)?;
+                    mount(Some(tag), guest_path, Some("virtiofs"), flags, None::<&str>)?;
                     info!(
                         tag = tag,
                         guest_path = guest_path,
                         read_only = read_only,
-                        "Mounting user volume"
+                        "Mounted user volume"
                     );
                 }
 
-                // Ensure mount point exists (parent directory for file mounts)
-                std::fs::create_dir_all(mount_path)?;
-
-                let flags = if read_only {
-                    MsFlags::MS_RDONLY
-                } else {
-                    MsFlags::empty()
-                };
-                mount(Some(tag), mount_path, Some("virtiofs"), flags, None::<&str>)?;
-
-                // For file mounts, verify the file exists in the mounted directory
-                if let Some(name) = file_name {
-                    let mounted_file = format!("{}/{}", mount_path, name);
-                    if !std::path::Path::new(&mounted_file).exists() {
-                        warn!(
-                            "Expected file {} after mount but it does not exist",
-                            mounted_file
-                        );
-                    }
-                }
-
                 index += 1;
             }
             Err(_) => break,

src/runtime/src/vm/spec.rs

@@ -161,9 +161,19 @@ impl VmManager {
                     } else {
                         ""
                     };
+                    // Mark single-file bind mounts so the guest binds the file onto
+                    // guest_path instead of mounting the virtio-fs share over its
+                    // parent directory (which would clobber e.g. /etc). The host is
+                    // authoritative here (it can stat the path); the guest must not
+                    // re-guess from the guest path's shape.
+                    let file_flag = if std::path::Path::new(parts[0]).is_file() {
+                        ":file"
+                    } else {
+                        ""
+                    };
                     env.push((
                         format!("BOX_VOL_{}", i),
-                        format!("vol{}:{}{}", i, guest_path, mode),
+                        format!("vol{}:{}{}{}", i, guest_path, mode, file_flag),
                     ));
                 }
             }

src/shim/src/main.rs

@@ -455,7 +455,10 @@ unsafe fn configure_and_start_vm(spec: &InstanceSpec) -> Result<()> {
 
         let mount_path: std::path::PathBuf = if host_path.is_file() {
             // Create a temporary directory to hold the file
-            let temp_dir = std::env::temp_dir().join(format!("a3s-fs-mount-{}", spec.box_id));
+            // Per-mount temp dir (keyed by tag) so two file mounts sharing a
+            // basename (e.g. two app.conf to different targets) don't collide.
+            let temp_dir =
+                std::env::temp_dir().join(format!("a3s-fs-mount-{}-{}", spec.box_id, mount.tag));
             let file_name = host_path.file_name().unwrap();
             let temp_file_path = temp_dir.join(file_name);