move restricted mount to helper function

engine/compiler/compiler.go

@@ -6,7 +6,6 @@ package compiler
 
 import (
 	"context"
-	"path/filepath"
 	"strings"
 
 	"github.com/drone-runners/drone-runner-docker/engine"
@@ -466,32 +465,7 @@ func (c *Compiler) isPrivileged(step *resource.Step) bool {
 	// privileged-by-default mode is disabled if the
 	// pipeline step mounts a restricted volume.
 	for _, mount := range step.Volumes {
-		path, _ := filepath.Abs(mount.MountPath)
-		path = strings.ToLower(path)
-		switch {
-		case path == "/":
-			return false
-		case path == "/var":
-			return false
-		case strings.Contains(path, "/var/run"):
-			return false
-		case strings.Contains(path, "/proc"):
-			return false
-		case strings.Contains(path, "/mount"):
-			return false
-		case strings.Contains(path, "/bin"):
-			return false
-		case strings.Contains(path, "/usr/local/bin"):
-			return false
-		case strings.Contains(path, "/mnt"):
-			return false
-		case strings.Contains(path, "/media"):
-			return false
-		case strings.Contains(path, "/sys"):
-			return false
-		case strings.Contains(path, "/dev"):
-			return false
-		case strings.Contains(path, "/etc/docker"):
+		if isRestrictedVolume(mount.MountPath) {
 			return false
 		}
 	}