docker: fix delimiter for selinux label for read-only volumes

[tgross]

The Docker driver's volume field to specify bind-mounts takes a list of strings that consist of three :-delimited fields: source, destination, and options. We append the SELinux label from the plugin configuration as the third field. But when the user has already specified the volume is read-only with :ro, we're incorrectly appending the SELinux label with another : instead of the required ,.

Combine the options into a single field value before appending them to the bind mounts configuration. Updated the tests to split out Windows behavior (which has a different volume specification format) and to ensure the test task has the expected environment for bind mounts.

Fixes: #23690

[tgross]

Tested end-to-end on Amazon Linux (which has SELinux) with the following agent configuration:

agent.hcl

bind_addr    = "0.0.0.0"
enable_debug = true
log_level    = "debug"
data_dir     = "/var/run/nomad"

server {
  enabled = true
}

client {
  enabled = true
}

plugin "docker" {
  config {
    allow_privileged = true
    volumes {
      enabled      = true
      selinuxlabel = "z"
    }
    gc {
      image = false
    }
  }
}

and the following jobspec:

example.nomad.hcl

job "example" {

  group "group" {

    task "task" {

      driver = "docker"

      config {
        image   = "busybox:1"
        command = "httpd"
        args    = ["-vv", "-f", "-p", "8001", "-h", "/local"]
        volumes = ["/etc/ssl/certs:/etc/ssl/certs:ro"]
      }

      resources {
        cpu    = 50
        memory = 50
      }

    }
  }
}

Logs from the client:

2024-08-06T17:31:39.726Z [DEBUG] client.driver_mgr.docker: binding directories: driver=docker task_name=task binds="[]string{"/run/nomad/data/alloc/69dbe88e-1409-24fa-29cf-f872ff1fc0ef/alloc:/alloc:z", "/run/nomad/data/alloc/69dbe88e-1409-24fa-29cf-f872ff1fc0ef/task/local:/local:z", "/run/nomad/data/alloc/69dbe88e-1409-24fa-29cf-f872ff1fc0ef/task/secrets:/secrets:z", "/etc/ssl/certs:/etc/ssl/certs:ro,z"}"

And resulting mounts on the Docker container:

$ sudo docker inspect 34f5 | jq '.[0].Mounts'
[
  {
    "Type": "bind",
    "Source": "/run/nomad/data/alloc/69dbe88e-1409-24fa-29cf-f872ff1fc0ef/alloc",
    "Destination": "/alloc",
    "Mode": "z",
    "RW": true,
    "Propagation": "rprivate"
  },
  {
    "Type": "bind",
    "Source": "/run/nomad/data/alloc/69dbe88e-1409-24fa-29cf-f872ff1fc0ef/task/local",
    "Destination": "/local",
    "Mode": "z",
    "RW": true,
    "Propagation": "rprivate"
  },
  {
    "Type": "bind",
    "Source": "/run/nomad/data/alloc/69dbe88e-1409-24fa-29cf-f872ff1fc0ef/task/secrets",
    "Destination": "/secrets",
    "Mode": "z",
    "RW": true,
    "Propagation": "rprivate"
  },
  {
    "Type": "bind",
    "Source": "/etc/ssl/certs",
    "Destination": "/etc/ssl/certs",
    "Mode": "ro,z",
    "RW": false,
    "Propagation": "rprivate"
  }
]

[pkazmierczak]

LGTM!