Summary
Found during review of #287.
plugins/services/transfer/service.go:97 — the ttrpc Transfer handler returns errors raw (return nil, err) instead of wrapping them with errgrpc.ToGRPC, unlike every other ttrpc service in this repo. This means the errdefs.ErrPermissionDenied that #287 introduces for read-only mount/rootfs enforcement never survives the RPC boundary as a classifiable gRPC status.
Failure scenario
A client issues a copy-to against a read-only bind mount or read-only rootfs. containerFSTransferrer.Transfer correctly returns an error wrapping errdefs.ErrPermissionDenied, but ttrpc's dispatch (status.FromError(err)) only recovers a real code when the error implements GRPCStatus() — otherwise it degrades to codes.Unknown. Any client-side errdefs.IsPermissionDenied check after errgrpc.ToNative fails to classify the rejection, so the read-only-enforcement feature is unobservable through the actual RPC path and is only verified by in-process unit tests.
Suggested fix
Wrap the returned error in the ttrpc handler with errgrpc.ToGRPC (matching the pattern used by other ttrpc services in the repo) so errdefs-based error classification works for RPC clients, not just in-process callers.
Summary
Found during review of #287.
plugins/services/transfer/service.go:97— the ttrpcTransferhandler returns errors raw (return nil, err) instead of wrapping them witherrgrpc.ToGRPC, unlike every other ttrpc service in this repo. This means theerrdefs.ErrPermissionDeniedthat #287 introduces for read-only mount/rootfs enforcement never survives the RPC boundary as a classifiable gRPC status.Failure scenario
A client issues a copy-to against a read-only bind mount or read-only rootfs.
containerFSTransferrer.Transfercorrectly returns an error wrappingerrdefs.ErrPermissionDenied, but ttrpc's dispatch (status.FromError(err)) only recovers a real code when the error implementsGRPCStatus()— otherwise it degrades tocodes.Unknown. Any client-sideerrdefs.IsPermissionDeniedcheck aftererrgrpc.ToNativefails to classify the rejection, so the read-only-enforcement feature is unobservable through the actual RPC path and is only verified by in-process unit tests.Suggested fix
Wrap the returned error in the ttrpc handler with
errgrpc.ToGRPC(matching the pattern used by other ttrpc services in the repo) soerrdefs-based error classification works for RPC clients, not just in-process callers.