mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-16 01:22:00 +00:00
3bb90c9fd3
The iso job mounts a kernel-global devtmpfs under the workspace (.cache/rootfs/dev). A killed job skips its EXIT-trap unmount and leaks the bind; the verify job (same ci-single runner) then ran a bare 'rm -rf $WORKSPACE/*' that could traverse it and wipe the host /dev. Detach any mount under the workspace before deleting and add --one-file-system so rm never crosses a mount boundary. Same backstop added to the iso job's own cleanup.