cp does not detect that a container is `--read-only`, and lets tar fail through in some cases

[apostasie]

Description

Title says all.

Steps to reproduce the issue

Start a container read-only. cp into it

Similarly to #3313 there is a mechanism to detect that in some cases - just not for when the container is running.

Describe the results you received and expected

na

What version of nerdctl are you using?

main

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

No response

[apostasie]

I don't think it is worth the effort to create more tickets for this.

There are obviously several more issues with this - including:

• copying into a stopped, read-only container, within a rw mount, will fail claiming the destination is read-only

Pretty sure there a bunch of other cases with nested mounts, links, etc.
Furthermore, permissions are not checked on the destination either so...

The problem is very much:

• if the container is running, we do not check anything
• if it is NOT running, we check if the rootfs is read-only and stops there if it is, regardless of whether the dest is actually rw (could be in a volume) - we only check the mounts if the rootfs is rw

I think this needs to be rewritten entirely, this is just not working.

[apostasie]

If it is any consolation, docker is also really bad at it:

$ docker cp etc/ rodeb:/blabla
Successfully copied 280kB to rodeb:/blabla
Error response from daemon: container rootfs is marked read-only

It is a success, and a failure at the same time (－‸ლ)