executor: fix submount symlink resolution

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

executor/oci/spec_unix.go

@@ -11,6 +11,7 @@ import (
 	"github.com/containerd/containerd/mount"
 	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/containerd/oci"
+	"github.com/containerd/continuity/fs"
 	"github.com/mitchellh/hashstructure"
 	"github.com/moby/buildkit/executor"
 	"github.com/moby/buildkit/snapshot"
@@ -114,7 +115,11 @@ func (s *submounts) subMount(m mount.Mount, subPath string) (mount.Mount, error)
 		return mount.Mount{}, nil
 	}
 	if mr, ok := s.m[h]; ok {
-		return sub(mr.mount, subPath), nil
+		sm, err := sub(mr.mount, subPath)
+		if err != nil {
+			return mount.Mount{}, nil
+		}
+		return sm, nil
 	}
 
 	lm := snapshot.LocalMounterWithMounts([]mount.Mount{m})
@@ -140,7 +145,11 @@ func (s *submounts) subMount(m mount.Mount, subPath string) (mount.Mount, error)
 		unmount: lm.Unmount,
 	}
 
-	return sub(s.m[h].mount, subPath), nil
+	sm, err := sub(s.m[h].mount, subPath)
+	if err != nil {
+		return mount.Mount{}, err
+	}
+	return sm, nil
 }
 
 func (s *submounts) cleanup() {
@@ -157,7 +166,11 @@ func (s *submounts) cleanup() {
 	wg.Wait()
 }
 
-func sub(m mount.Mount, subPath string) mount.Mount {
+func sub(m mount.Mount, subPath string) (mount.Mount, error) {
-	m.Source = path.Join(m.Source, subPath)
+	src, err := fs.RootPath(m.Source, subPath)
-	return m
+	if err != nil {
+		return mount.Mount{}, err
+	}
+	m.Source = src
+	return m, nil
 }

frontend/dockerfile/dockerfile_test.go

@@ -164,9 +164,10 @@ func testCopyThroughSymlinkMultiStage(t *testing.T, sb integration.Sandbox) {
 
 	dockerfile := []byte(`
 FROM busybox AS build
-RUN mkdir -p /out/sub && ln -s out/sub /sub && echo -n "data" > /sub/foo
+RUN mkdir -p /out/sub && ln -s /out/sub /sub && ln -s out/sub /sub2 && echo -n "data" > /sub/foo
 FROM scratch
 COPY --from=build /sub/foo .
+COPY --from=build /sub2/foo bar
 `)
 
 	dir, err := tmpdir(