docker-compose up fails because volumes source is outside repo, but it isn't

[Kenneth Bingham]

ERROR: for datadb Cannot create container for service datadb: authorization denied by plugin pipelines: -v only supports $BITBUCKET_CLONE_DIR

docker-compose.yml has

 volumes:
- ./sql:/docker-entrypoint-initdb.d

and so it attempting to do the equivalent of

docker run -v $BITBUCKET_CLONE_DIR/sql:/docker-entrypoint-initdb.d

I'm not able to reproduce this outside of Pipelines, by the way. docker-compose and Engine CLI can mount the same volume when running on my workstation and I have verified that the volume source directory is inside the Git working copy (clone dir).

docker run -p 3306:3306 -d -e MYSQL_ROOT_PASSWORD=testpass -e MYSQL_DATABASE=testdb -v $BITBUCKET_CLONE_DIR/data/sql:/docker-entrypoint-initdb.d mysql:5.7

docker: Error response from daemon: authorization denied by plugin pipelines: -v only supports $BITBUCKET_CLONE_DIR.

[Kenneth Bingham · Accepted solution]

BB confirmed they'd introduced a new security policy that excluded this use case (mounting a subtree of the repo working copy as a volume), and then apparently reverted that policy because this problem suddenly stopped presenting the following day.

[Kenneth Bingham]

I can't delete the answer I unintentionally published when I thought this was a place to comment on this issue, so I'm replacing the text here with a request that you allow deleting answers and provide a place to comment.