feat(envd): allow opting into watching network mounts

packages/envd/internal/services/filesystem/watch.go

@@ -45,12 +45,14 @@ func (s Service) watchHandler(ctx context.Context, req *connect.Request[rpc.Watc
 	}
 
 	// Check if path is on a network filesystem mount
-	isNetworkMount, err := IsPathOnNetworkMount(watchPath)
-	if err != nil {
-		return connect.NewError(connect.CodeInternal, fmt.Errorf("error checking mount status: %w", err))
-	}
-	if isNetworkMount {
-		return connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("cannot watch path on network filesystem: %s", watchPath))
+	if !req.Msg.GetAllowNetworkMounts() {
+		isNetworkMount, err := IsPathOnNetworkMount(watchPath)
+		if err != nil {
+			return connect.NewError(connect.CodeInternal, fmt.Errorf("error checking mount status: %w", err))
+		}
+		if isNetworkMount {
+			return connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("cannot watch path on network filesystem: %s", watchPath))
+		}
 	}
 
 	w, err := fsnotify.NewWatcher()

packages/envd/internal/services/filesystem/watch_sync.go

@@ -162,12 +162,14 @@ func (s Service) CreateWatcher(ctx context.Context, req *connect.Request[rpc.Cre
 	}
 
 	// Check if path is on a network filesystem mount
-	isNetworkMount, err := IsPathOnNetworkMount(watchPath)
-	if err != nil {
-		return nil, connect.NewError(connect.CodeInternal, fmt.Errorf("error checking mount status: %w", err))
-	}
-	if isNetworkMount {
-		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("cannot watch path on network filesystem: %s", watchPath))
+	if !req.Msg.GetAllowNetworkMounts() {
+		isNetworkMount, err := IsPathOnNetworkMount(watchPath)
+		if err != nil {
+			return nil, connect.NewError(connect.CodeInternal, fmt.Errorf("error checking mount status: %w", err))
+		}
+		if isNetworkMount {
+			return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("cannot watch path on network filesystem: %s", watchPath))
+		}
 	}
 
 	watcherId := "w" + id.Generate()

packages/envd/internal/services/filesystem/watch_test.go

@@ -3,8 +3,10 @@ package filesystem
 import (
 	"context"
 	"os"
+	"os/exec"
 	"os/user"
 	"path/filepath"
+	"runtime"
 	"testing"
 	"time"
 
@@ -164,3 +166,52 @@ func TestWatcherIncludeEntryInfo_RemoveDoesNotCarryReplacement(t *testing.T) {
 	require.NotNil(t, replacementEvent, "expected a create/write event for the replacement")
 	assert.NotNil(t, replacementEvent.GetEntry(), "event for the existing replacement should carry entry info")
 }
+
+func TestCreateWatcherOnNetworkMount(t *testing.T) {
+	t.Parallel()
+
+	// FUSE mounts via bindfs are exercised on Linux only.
+	if runtime.GOOS != "linux" {
+		t.Skip("FUSE bindfs mount test runs only on Linux")
+	}
+
+	_, err := exec.LookPath("bindfs")
+	require.NoError(t, err, "bindfs must be installed for this test")
+	_, err = exec.LookPath("fusermount")
+	require.NoError(t, err, "fusermount must be installed for this test")
+
+	u, err := user.Current()
+	require.NoError(t, err)
+
+	sourceDir := t.TempDir()
+	mountDir := t.TempDir()
+
+	require.NoError(t, exec.CommandContext(t.Context(), "bindfs", sourceDir, mountDir).Run(), "failed to mount bindfs")
+	t.Cleanup(func() {
+		_ = exec.CommandContext(context.Background(), "fusermount", "-u", mountDir).Run()
+	})
+
+	svc := mockService()
+	ctx := authn.SetInfo(t.Context(), u)
+
+	// Without the flag, watching a network mount is rejected.
+	_, err = svc.CreateWatcher(ctx, connect.NewRequest(&filesystem.CreateWatcherRequest{
+		Path: mountDir,
+	}))
+	require.Error(t, err)
+	assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
+
+	// With allow_network_mounts, the watcher is created.
+	created, err := svc.CreateWatcher(ctx, connect.NewRequest(&filesystem.CreateWatcherRequest{
+		Path:               mountDir,
+		AllowNetworkMounts: true,
+	}))
+	require.NoError(t, err)
+	watcherID := created.Msg.GetWatcherId()
+	t.Cleanup(func() {
+		_, _ = svc.RemoveWatcher(ctx, connect.NewRequest(&filesystem.RemoveWatcherRequest{
+			WatcherId: watcherID,
+		}))
+	})
+	assert.NotEmpty(t, watcherID)
+}