ronantakizawa/codereview-bench huggingface dataset:
Repository: containerd/containerd
File: core/remotes/docker/pusher.go (Go)

Code before:

	// 201 is specified return status, some registries return
	// 200, 202 or 204.
	switch resp.StatusCode {
	case http.StatusOK, http.StatusCreated, http.StatusNoContent, http.StatusAccepted:
	default:
		return remoteserrors.NewUnexpectedStatusErr(resp)
	}

	status, err := pw.tracker.GetStatus(pw.ref)
	if err != nil {
		return fmt.Errorf("failed to get status: %w", err)
	}

	if size > 0 && size != status.Offset {
		return fmt.Errorf("unexpected size %d, expected %d", status.Offset, size)
	}

	if expected == "" {
		expected = status.Expected
	} else if expected != status.Expected {
		return fmt.Errorf("unexpected digest received: got %q, expected %q", status.Expected, expected)
	}

	dgstHdr := resp.Header.Get("Docker-Content-Digest")
	if dgstHdr != "" {
		actual, err := digest.Parse(dgstHdr)
		if err != nil {
			return fmt.Errorf("invalid content digest in response: %w", err)
		}

		if actual != expected {
			return fmt.Errorf("got digest %s, expected %s", actual, expected)
		}
	} else {
		log.G(ctx).Info("registry did not send a Docker-Content-Digest header")
	}

	status.Committed = true
	status.UpdatedAt = time.Now()
	pw.tracker.SetStatus(pw.ref, status)

	return nil
}

func (pw *pushWriter) Truncate(size int64) error {
	// TODO: if blob close request and start new request at offset
	// TODO: always error on manifest
	return errors.New("cannot truncate remote upload")
}


Review comment (suggestion):
```suggestion
	if dgstHdr := resp.Header.Get("Docker-Content-Digest"); dgstHdr != "" {
```

Code after:
			return fmt.Errorf("pipe error before commit: %w", err)
		}
		if err := pw.pipe.Close(); err != nil {
			return err
		}
	}

	// TODO: timeout waiting for response
	var resp *http.Response
	select {
	case <-pw.done:
		return io.ErrClosedPipe
	case err := <-pw.errC:
		pw.Close()
		return err
	case resp = <-pw.respC:
		defer resp.Body.Close()
	case p := <-pw.pipeC:
		// check whether the pipe has changed in the commit, because sometimes Write
		// can complete successfully, but the pipe may have changed. In that case, the
		// content needs to be reset.
		return pw.replacePipe(p)
	}

	// 201 is specified return status, some registries return
	// 200, 202 or 204.
	switch resp.StatusCode {
	case http.StatusOK, http.StatusCreated, http.StatusNoContent, http.StatusAccepted:
	default:
		return unexpectedResponseErr(resp)
	}

	status, err := pw.tracker.GetStatus(pw.ref)
	if err != nil {
		return fmt.Errorf("failed to get status: %w", err)
	}

	if size > 0 && size != status.Offset {
		return fmt.Errorf("unexpected size %d, expected %d", status.Offset, size)
	}

	if expected == "" {
		expected = status.Expected
	} else if expected != status.Expected {
		return fmt.Errorf("unexpected digest received: got %q, expected %q", status.Expected, expected)
	}

	if dgstHdr := resp.Header.Get("Docker-Content-Digest"); dgstHdr != "" {
		actual, err := digest.Parse(dgstHdr)
		if err != nil {
			return fmt.Errorf("invalid content digest in response: %w", err)
Repository: containerd/containerd
File: integration/container_stats_test.go (Go)

Code before:
	cnConfigNoPrivileged := ContainerConfig(
		containerNameNoPrivileged,
		testImage,
		WithCommand("sh", "-c", "top"),
		WithSecurityContext(false),
	)
	cnNoPrivileged, err := runtimeService.CreateContainer(sb, cnConfigNoPrivileged, sbConfig)
	require.NoError(t, err)
	defer func() {
		assert.NoError(t, runtimeService.RemoveContainer(cnNoPrivileged))
	}()

	t.Log("Start the container")
	require.NoError(t, runtimeService.StartContainer(cnNoPrivileged))
	defer func() {
		assert.NoError(t, runtimeService.StopContainer(cnNoPrivileged, 10))
	}()

	t.Logf("Execute cmd in container by sync")
	mountinfoNoPrivileged, _, err := runtimeService.ExecSync(cnNoPrivileged, []string{
		"sh",
		"-c",
		"mount |grep sysfs",
	}, 10)
	assert.NoError(t, err)
	assert.Contains(t, string(mountinfoNoPrivileged), "ro")
}


Review comment (security):
nit: line 478 - 504 is largely a copy of line 451-476. I suggest we refactor a bit to reduce replication and make one test only test one scenario, something like (not well formatted):

```golang
func TestContainerSysfsStats(t *testing.T) {
    testcases := []struct{
      name string
      privilegedPod, privilegedContainer bool
      expectedSysfsOption string
    }
    {
      {"...", true, true, "rw"},
      {"...", false, false, "ro"},
      {"...", true, false, "ro"},
      {"...", false, true, "ro"},
    }

    for _, tt := range testcases {
      t.Run(tt.name, func(t *testing.T) {
        // your test logic, e.g., line 478 - 504
      }
    }
}
```

Code after:
				WithCommand("sh", "-c", "top"),
				WithSecurityContext(test.privilegedContainer),
			)
			cn, err := runtimeService.CreateContainer(sb, cnConfig, sbConfig)
			if test.expectedErr != "" && err != nil {
				assert.Contains(t, err.Error(), test.expectedErr)
				return
			}
			assert.NoError(t, err)
			defer func() {
				if test.expectedErr == "" {
					assert.NoError(t, runtimeService.RemoveContainer(cn))
				}
			}()

			t.Log("Start the container")
			require.NoError(t, runtimeService.StartContainer(cn))
			defer func() {
				assert.NoError(t, runtimeService.StopContainer(cn, 10))
			}()

			t.Logf("Execute cmd in container by sync")
			mountinfo, _, err := runtimeService.ExecSync(cn, []string{
				"sh",
				"-c",
				"mount |grep sysfs",
			}, 10)
			assert.NoError(t, err)
			assert.Contains(t, string(mountinfo), test.expectedSysfsOption)
		})
	}
}
Repository: containerd/containerd
File: core/content/proxy/content_writer.go (Go)

Code before:
	}

	return content.Status{
		Ref:       rw.ref,
		Offset:    resp.Offset,
		Total:     resp.Total,
		StartedAt: protobuf.FromTimestamp(resp.StartedAt),
		UpdatedAt: protobuf.FromTimestamp(resp.UpdatedAt),
	}, nil
}

func (rw *remoteWriter) Digest() digest.Digest {
	return rw.digest
}

func (rw *remoteWriter) Write(p []byte) (n int, err error) {
	for len(p) > 0 && err == nil {
		offset := rw.offset

		req := &contentapi.WriteContentRequest{
			Action: contentapi.WriteAction_WRITE,
			Offset: offset,
			Data:   p,
		}

		if sz := proto.Size(req); sz > defaults.DefaultMaxSendMsgSize {
			// Limit the send size if we've exceeded the maximum send size.
			limit := len(req.Data) - (sz - defaults.DefaultMaxSendMsgSize)
			req.Data = req.Data[:limit]
		}

		var resp *contentapi.WriteContentResponse
		resp, err = rw.send(req)
		if err != nil {
			return 0, fmt.Errorf("failed to send write: %w", errgrpc.ToNative(err))
		}

		written := int(resp.Offset - offset)
		if written < len(req.Data) {
			err = io.ErrShortWrite
		}

		rw.offset += int64(written)
		if resp.Digest != "" {
			rw.digest = digest.Digest(resp.Digest)
		}
		n += written
		p = p[written:]
	}
	return n, err
}

Review comment (bug):
Using this variable seemed wrong to me but I couldn't think of any alternative. The max send message size can be changed through a [grpc.CallOption](https://pkg.go.dev/google.golang.org/grpc#MaxCallSendMsgSize) which can be arbitrarily set on the grpc connection for containerd. I don't believe there's anyway to retrieve what the real value is for this connection other than just overriding whatever the user determined, setting the value to something conservative enough it would generally always work, or documenting that lowering the max send message size could result in failures.

Code after:
	}

	return content.Status{
		Ref:       rw.ref,
		Offset:    resp.Offset,
		Total:     resp.Total,
		StartedAt: protobuf.FromTimestamp(resp.StartedAt),
		UpdatedAt: protobuf.FromTimestamp(resp.UpdatedAt),
	}, nil
}

func (rw *remoteWriter) Digest() digest.Digest {
	return rw.digest
}

func (rw *remoteWriter) Write(p []byte) (n int, err error) {
	const maxBufferSize = defaults.DefaultMaxSendMsgSize >> 1
	for data := range slices.Chunk(p, maxBufferSize) {
		offset := rw.offset

		resp, err := rw.send(&contentapi.WriteContentRequest{
			Action: contentapi.WriteAction_WRITE,
			Offset: offset,
			Data:   data,
		})
		if err != nil {
			return 0, fmt.Errorf("failed to send write: %w", errgrpc.ToNative(err))
		}

		written := int(resp.Offset - offset)
		rw.offset += int64(written)
		if resp.Digest != "" {
			rw.digest = digest.Digest(resp.Digest)
		}
		n += written

		if written < len(data) {
			return n, io.ErrShortWrite
		}
	}
	return n, nil
}

func (rw *remoteWriter) Commit(ctx context.Context, size int64, expected digest.Digest, opts ...content.Opt) (err error) {
	defer func() {
		err1 := rw.Close()
		if err == nil {
			err = err1
		}
	}()
Repository: containerd/containerd
File: cmd/containerd-shim-runc-v2/task/service.go (Go)

Code before:
	container, err := s.getContainer(r.ID)
	if err != nil {
		return nil, err
	}
	if err := container.Update(ctx, r); err != nil {
		return nil, errgrpc.ToGRPC(err)
	}
	return empty, nil
}

// Wait for a process to exit
func (s *service) Wait(ctx context.Context, r *taskAPI.WaitRequest) (*taskAPI.WaitResponse, error) {
	container, err := s.getContainer(r.ID)
	if err != nil {
		return nil, err
	}
	p, err := container.Process(r.ExecID)
	if err != nil {
		return nil, errgrpc.ToGRPC(err)
	}

	p.Wait(ctx)
	select {
	case <-ctx.Done():
		// connection closed, discard the result
		return nil, nil
	default:
	}
	return &taskAPI.WaitResponse{
		ExitStatus: uint32(p.ExitStatus()),
		ExitedAt:   protobuf.ToTimestamp(p.ExitedAt()),
	}, nil
}

// Connect returns shim information such as the shim's pid
func (s *service) Connect(ctx context.Context, r *taskAPI.ConnectRequest) (*taskAPI.ConnectResponse, error) {
	var pid int
	if container, err := s.getContainer(r.ID); err == nil {
		pid = container.Pid()
	}
	return &taskAPI.ConnectResponse{
		ShimPid: uint32(os.Getpid()),
		TaskPid: uint32(pid),
	}, nil
}

func (s *service) Shutdown(ctx context.Context, r *taskAPI.ShutdownRequest) (*ptypes.Empty, error) {
	s.mu.Lock()
	defer s.mu.Unlock()

	// return out if the shim is still servicing containers

Review comment (suggestion):
Should this be `return nil, ctx.Err()` instead?

```go
// If Done is closed, Err returns a non-nil error explaining why
```

Code after:
	container, err := s.getContainer(r.ID)
	if err != nil {
		return nil, err
	}
	if err := container.Update(ctx, r); err != nil {
		return nil, errgrpc.ToGRPC(err)
	}
	return empty, nil
}

// Wait for a process to exit
func (s *service) Wait(ctx context.Context, r *taskAPI.WaitRequest) (*taskAPI.WaitResponse, error) {
	container, err := s.getContainer(r.ID)
	if err != nil {
		return nil, err
	}
	p, err := container.Process(r.ExecID)
	if err != nil {
		return nil, errgrpc.ToGRPC(err)
	}

	if err = p.Wait(ctx); err != nil {
		return nil, errgrpc.ToGRPC(err)
	}

	return &taskAPI.WaitResponse{
		ExitStatus: uint32(p.ExitStatus()),
		ExitedAt:   protobuf.ToTimestamp(p.ExitedAt()),
	}, nil
}

// Connect returns shim information such as the shim's pid
func (s *service) Connect(ctx context.Context, r *taskAPI.ConnectRequest) (*taskAPI.ConnectResponse, error) {
	var pid int
	if container, err := s.getContainer(r.ID); err == nil {
		pid = container.Pid()
	}
	return &taskAPI.ConnectResponse{
		ShimPid: uint32(os.Getpid()),
		TaskPid: uint32(pid),
	}, nil
}

func (s *service) Shutdown(ctx context.Context, r *taskAPI.ShutdownRequest) (*ptypes.Empty, error) {
	s.mu.Lock()
	defer s.mu.Unlock()

	// return out if the shim is still servicing containers
	if len(s.containers) > 0 {
		return empty, nil
	}
Repository: containerd/containerd
File: cmd/containerd-shim-runc-v2/process/init.go (Go)

Code before:
func (p *Init) createCheckpointedState(r *CreateConfig, pidFile *pidFile) error {
	opts := &runc.RestoreOpts{
		CheckpointOpts: runc.CheckpointOpts{
			ImagePath:  r.Checkpoint,
			WorkDir:    p.CriuWorkPath,
			ParentPath: r.ParentCheckpoint,
		},
		PidFile:     pidFile.Path(),
		NoPivot:     p.NoPivotRoot,
		Detach:      true,
		NoSubreaper: true,
	}

	if p.io != nil {
		opts.IO = p.io.IO()
	}

	p.initState = &createdCheckpointState{
		p:    p,
		opts: opts,
	}
	return nil
}

// Wait for the process to exit
func (p *Init) Wait(ctx context.Context) {
	select {
	case <-p.waitBlock:
	case <-ctx.Done():
	}
}

// ID of the process
func (p *Init) ID() string {
	return p.id
}

// Pid of the process
func (p *Init) Pid() int {
	return p.pid
}

// ExitStatus of the process
func (p *Init) ExitStatus() int {
	p.mu.Lock()
	defer p.mu.Unlock()

	return p.status
}

// ExitedAt at time when the process exited

Review comment (suggestion):
It looks good. would you please add one e2e test, like when that client cancel that Wait, the task should be still running and stoppable. Thanks

Code after:
func (p *Init) createCheckpointedState(r *CreateConfig, pidFile *pidFile) error {
	opts := &runc.RestoreOpts{
		CheckpointOpts: runc.CheckpointOpts{
			ImagePath:  r.Checkpoint,
			WorkDir:    p.CriuWorkPath,
			ParentPath: r.ParentCheckpoint,
		},
		PidFile:     pidFile.Path(),
		NoPivot:     p.NoPivotRoot,
		Detach:      true,
		NoSubreaper: true,
	}

	if p.io != nil {
		opts.IO = p.io.IO()
	}

	p.initState = &createdCheckpointState{
		p:    p,
		opts: opts,
	}
	return nil
}

// Wait for the process to exit
func (p *Init) Wait(ctx context.Context) error {
	select {
	case <-p.waitBlock:
		return nil
	case <-ctx.Done():
		return ctx.Err()
	}
}

// ID of the process
func (p *Init) ID() string {
	return p.id
}

// Pid of the process
func (p *Init) Pid() int {
	return p.pid
}

// ExitStatus of the process
func (p *Init) ExitStatus() int {
	p.mu.Lock()
	defer p.mu.Unlock()

	return p.status
}
Repository: containerd/containerd
File: client/client.go (Go)

Code before:
	if err != nil {
		return err
	}
	c.conn = conn
	return nil
}

// Runtime returns the name of the runtime being used
func (c *Client) Runtime() string {
	runtime, _ := c.defaultRuntime(context.TODO())
	return runtime
}

func (c *Client) defaultRuntime(ctx context.Context) (string, error) {
	c.runtime.mut.Lock()
	defer c.runtime.mut.Unlock()

	if c.runtime.value != "" {
		return c.runtime.value, nil
	}

	if c.defaultns != "" {
		ctx := context.TODO()
		label, err := c.GetLabel(ctx, defaults.DefaultRuntimeNSLabel)
		if err != nil {
			log.G(ctx).WithError(err).Warn("error getting default runtime label")
			// Don't set the runtime value if there's an error
			return defaults.DefaultRuntime, err
		}
		if label != "" {
			c.runtime.value = label
			return label, nil
		}
	}
	c.runtime.value = defaults.DefaultRuntime
	return c.runtime.value, nil
}

// IsServing returns true if the client can successfully connect to the
// containerd daemon and the healthcheck service returns the SERVING
// response.
// This call will block if a transient error is encountered during
// connection. A timeout can be set in the context to ensure it returns
// early.
func (c *Client) IsServing(ctx context.Context) (bool, error) {
	c.connMu.Lock()
	if c.conn == nil {
		c.connMu.Unlock()
		return false, fmt.Errorf("no grpc connection available: %w", errdefs.ErrUnavailable)
	}
	c.connMu.Unlock()

Review comment (suggestion):
Should not need to log here since the error is being returned.

Code after:
		return err
	}
	c.conn = conn
	return nil
}

// Runtime returns the name of the runtime being used
func (c *Client) Runtime() string {
	runtime, _ := c.defaultRuntime(context.TODO())
	return runtime
}

func (c *Client) defaultRuntime(ctx context.Context) (string, error) {
	c.runtime.mut.Lock()
	defer c.runtime.mut.Unlock()

	if c.runtime.value != "" {
		return c.runtime.value, nil
	}

	if c.defaultns != "" {
		label, err := c.GetLabel(ctx, defaults.DefaultRuntimeNSLabel)
		if err != nil {
			// Don't set the runtime value if there's an error
			return defaults.DefaultRuntime, fmt.Errorf("failed to get default runtime label: %w", err)
		}
		if label != "" {
			c.runtime.value = label
			return label, nil
		}
	}
	c.runtime.value = defaults.DefaultRuntime
	return c.runtime.value, nil
}

// IsServing returns true if the client can successfully connect to the
// containerd daemon and the healthcheck service returns the SERVING
// response.
// This call will block if a transient error is encountered during
// connection. A timeout can be set in the context to ensure it returns
// early.
func (c *Client) IsServing(ctx context.Context) (bool, error) {
	c.connMu.Lock()
	if c.conn == nil {
		c.connMu.Unlock()
		return false, fmt.Errorf("no grpc connection available: %w", errdefs.ErrUnavailable)
	}
	c.connMu.Unlock()
	r, err := c.HealthService().Check(ctx, &grpc_health_v1.HealthCheckRequest{}, grpc.WaitForReady(true))
	if err != nil {
		return false, err
Repository: containerd/containerd
File: client/client.go (Go)

Code before:
	}
	c.conn = conn
	return nil
}

// Runtime returns the name of the runtime being used
func (c *Client) Runtime() string {
	runtime, _ := c.defaultRuntime(context.TODO())
	return runtime
}

func (c *Client) defaultRuntime(ctx context.Context) (string, error) {
	c.runtime.mut.Lock()
	defer c.runtime.mut.Unlock()

	if c.runtime.value != "" {
		return c.runtime.value, nil
	}

	if c.defaultns != "" {
		ctx := context.TODO()
		label, err := c.GetLabel(ctx, defaults.DefaultRuntimeNSLabel)
		if err != nil {
			log.G(ctx).WithError(err).Warn("error getting default runtime label")
			// Don't set the runtime value if there's an error
			return defaults.DefaultRuntime, err
		}
		if label != "" {
			c.runtime.value = label
			return label, nil
		}
	}
	c.runtime.value = defaults.DefaultRuntime
	return c.runtime.value, nil
}

// IsServing returns true if the client can successfully connect to the
// containerd daemon and the healthcheck service returns the SERVING
// response.
// This call will block if a transient error is encountered during
// connection. A timeout can be set in the context to ensure it returns
// early.
func (c *Client) IsServing(ctx context.Context) (bool, error) {
	c.connMu.Lock()
	if c.conn == nil {
		c.connMu.Unlock()
		return false, fmt.Errorf("no grpc connection available: %w", errdefs.ErrUnavailable)
	}
	c.connMu.Unlock()
	r, err := c.HealthService().Check(ctx, &grpc_health_v1.HealthCheckRequest{}, grpc.WaitForReady(true))
	if err != nil {

Review comment (bug):
Should be able to wrap this error with `failed to get default runtime`

Code after:
	c.conn = conn
	return nil
}

// Runtime returns the name of the runtime being used
func (c *Client) Runtime() string {
	runtime, _ := c.defaultRuntime(context.TODO())
	return runtime
}

func (c *Client) defaultRuntime(ctx context.Context) (string, error) {
	c.runtime.mut.Lock()
	defer c.runtime.mut.Unlock()

	if c.runtime.value != "" {
		return c.runtime.value, nil
	}

	if c.defaultns != "" {
		label, err := c.GetLabel(ctx, defaults.DefaultRuntimeNSLabel)
		if err != nil {
			// Don't set the runtime value if there's an error
			return defaults.DefaultRuntime, fmt.Errorf("failed to get default runtime label: %w", err)
		}
		if label != "" {
			c.runtime.value = label
			return label, nil
		}
	}
	c.runtime.value = defaults.DefaultRuntime
	return c.runtime.value, nil
}

// IsServing returns true if the client can successfully connect to the
// containerd daemon and the healthcheck service returns the SERVING
// response.
// This call will block if a transient error is encountered during
// connection. A timeout can be set in the context to ensure it returns
// early.
func (c *Client) IsServing(ctx context.Context) (bool, error) {
	c.connMu.Lock()
	if c.conn == nil {
		c.connMu.Unlock()
		return false, fmt.Errorf("no grpc connection available: %w", errdefs.ErrUnavailable)
	}
	c.connMu.Unlock()
	r, err := c.HealthService().Check(ctx, &grpc_health_v1.HealthCheckRequest{}, grpc.WaitForReady(true))
	if err != nil {
		return false, err
	}
	return r.Status == grpc_health_v1.HealthCheckResponse_SERVING, nil
Repository: containerd/containerd
File: internal/cri/server/container_image_mount.go (Go)

Code before:
	err = os.Remove(targetBase)
	if err != nil && !errdefs.IsNotFound(err) {
		return fmt.Errorf("failed to remove directory to cleanup image volume mounts: %w", err)
	}
	return nil
}

// ensureImageSubPath ensures the subPath exists **within** the mountPoint (i.e.
// not escape outside of mountPoint) and is not a symlink file.
// It returns the final absolute path of `subPath`.
func ensureImageSubPath(mountPoint, subPath string) (string, error) {
	if subPath == "" {
		return mountPoint, nil
	}

	file, err := os.OpenInRoot(mountPoint, subPath)
	if err != nil {
		return "", err
	}
	defer file.Close()

	stat, err := file.Stat()
	if err != nil {
		return "", err
	}

	if !stat.IsDir() {
		// the current OCI volume source treats mounting a single file as non-goal
		// and limits the mount output to directories.
		// https://github.com/kubernetes/enhancements/tree/f3fa3a12d303a6b749efd072987a39aab159f9d5/keps/sig-node/4639-oci-volume-source#non-goals
		return "", fmt.Errorf("only directory subpath is supported, subpath: %q, mountpoint: %q ", subPath, mountPoint)
	}

	return file.Name(), nil

}


Review comment (suggestion):
The function comment specifies that the subpath must not be a symlink file, yet the current implementation uses file.Stat() which follows symlinks. Consider using os.Lstat() to explicitly check for symlink files and enforce the intended constraint.
```suggestion
	stat, err := os.Lstat(file.Name())
	if err != nil {
		return "", err
	}

	if stat.Mode()&os.ModeSymlink != 0 {
		return "", fmt.Errorf("symlink files are not supported, subpath: %q, mountpoint: %q", subPath, mountPoint)
	}
```

Code after:
	err = os.Remove(targetBase)
	if err != nil && !errdefs.IsNotFound(err) {
		return fmt.Errorf("failed to remove directory to cleanup image volume mounts: %w", err)
	}
	return nil
}

// ensureImageSubPath ensures the subPath exists **within** the mountPoint (i.e.
// not escape outside of mountPoint) and it's a directory.
// It returns the final absolute path of `subPath`.
func ensureImageSubPath(mountPoint, subPath string) (string, error) {
	if subPath == "" {
		return mountPoint, nil
	}

	file, err := os.OpenInRoot(mountPoint, subPath)
	if err != nil {
		return "", err
	}
	defer file.Close()

	stat, err := file.Stat()
	if err != nil {
		return "", err
	}

	if !stat.IsDir() {
		// the current OCI volume source treats mounting a single file as non-goal
		// and limits the mount output to directories.
		// https://github.com/kubernetes/enhancements/tree/f3fa3a12d303a6b749efd072987a39aab159f9d5/keps/sig-node/4639-oci-volume-source#non-goals
		return "", fmt.Errorf("only directory subpath is supported, subpath: %q, mountpoint: %q ", subPath, mountPoint)
	}

	return file.Name(), nil
}