fix(hooks): mount cargo target outside bind mount via CARGO_TARGET_DIR #53

Merged

David merged 1 commit from fix/dev-371-precommit-host-owned-target into main

2026-06-19 09:59:06 +02:00

David commented

2026-06-18 17:18:38 +02:00

Owner

What

Change the pre-commit recipe in justfile so the cargo target cache named volume mounts at /cargo-target (outside the /build bind mount) and cargo writes there via CARGO_TARGET_DIR=/cargo-target, instead of nesting it at /build/target.

Why (DEV-371)

Nesting the named volume under the /build bind mount makes the Docker daemon materialize a root-owned target/ directory on the host, which then needs sudo to remove. Moving the mount off the bind mount keeps the host working tree clean. The build cache still persists in the unchanged dev-forgejo-cli-cargo-target named volume.

Governance Option A

Implements Option A: mount the cargo-target volume outside the bind mount and set CARGO_TARGET_DIR, the canonical fix for the pre-commit root-owned-target class of issue.

## What Change the `pre-commit` recipe in `justfile` so the cargo target cache named volume mounts at `/cargo-target` (outside the `/build` bind mount) and cargo writes there via `CARGO_TARGET_DIR=/cargo-target`, instead of nesting it at `/build/target`. ## Why (DEV-371) Nesting the named volume under the `/build` bind mount makes the Docker daemon materialize a root-owned `target/` directory on the host, which then needs `sudo` to remove. Moving the mount off the bind mount keeps the host working tree clean. The build cache still persists in the unchanged `dev-forgejo-cli-cargo-target` named volume. ## Governance Option A Implements Option A: mount the cargo-target volume outside the bind mount and set `CARGO_TARGET_DIR`, the canonical fix for the pre-commit root-owned-target class of issue.

David added 1 commit

2026-06-18 17:18:38 +02:00

fix(hooks): mount cargo target outside bind mount via CARGO_TARGET_DIR

Check / fmt + clippy + build + tests (pull_request) Successful in 1m4s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

b69ac57394

Mount the cargo target cache at /cargo-target (outside the /build bind mount) and point cargo at it with CARGO_TARGET_DIR, instead of nesting the named volume at /build/target, which makes the Docker daemon create a root-owned target/ on the host that needs sudo to remove. The cache still persists in the named volume; only its mount path moves off the bind mount. Aligns with the governance Option A standard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

#DEV-371