prevent mounting run/drone directory

engine/linter/linter_test.go

@@ -48,6 +48,14 @@ func TestLint(t *testing.T) {
 			invalid: true,
 			message: "linter: invalid volume name: _docker_socket",
 		},
+		// user should not be trying to mount internal or restricted
+		// volume paths.
+		{
+			path:    "testdata/volume_restricted.yml",
+			trusted: false,
+			invalid: true,
+			message: "linter: cannot mount volume at /run/drone",
+		},
 		// user should not be able to mount host path
 		// volumes unless the repository is trusted.
 		{