Bug: retrieval containerConfig 'volume:' is ignored by BuildHostConfig (v4.1.3) — breaks ssl cert mount for logicalRestore/snapshot

Summary

cont.BuildHostConfig silently ignores the volume: entry of a retrieval containerConfig: it applies only Resources/ShmSize from the config and then adds volumes purely from the dblab_server's own dataDir/env. So a volume: declared under a retrieval job's containerConfig in server.yml is never mounted into the dump/restore/snapshot/promotion Postgres containers. With ssl: on and certs at a containerConfig-mounted path, the retrieval Postgres dies at startup.

Evidence (v4.1.3)

engine/internal/retrieval/engine/postgres/tools/cont/container.go (BuildHostConfig, ~L191):

func BuildHostConfig(ctx, docker, dataDir, contConf map[string]interface{}) (*container.HostConfig, error) {
    hostOptions, err := ResourceOptions(contConf)   // only Resources + ShmSize
    ...
    hostConfig := &container.HostConfig{ Resources: hostOptions.Resources, ShmSize: hostOptions.ShmSize }
    if err := tools.AddVolumesToHostConfig(ctx, docker, hostConfig, dataDir); err != nil { ... }  // volumes from server dataDir/env, NOT from contConf
    return hostConfig, nil
}

contConf (the containerConfig passed by every caller — logical.go logicalRestore, physical.go, snapshot/physical.go promotion) is consumed only by ResourceOptions, which reads cpus/memory/shmSize — never volume. So containerConfig.volume is dropped.

Clone containers are unaffected (they get their mounts via the separate provision/docker-run --volume path), which is why live clones work while retrieval/snapshot break.

Repro / impact

Config with retrieval.spec.logicalRestore.options.containerConfig.volume: /var/lib/dblab/cert:/var/lib/postgresql/cert and db_configs.ssl: on (cert at that path): the logicalRestore container's Postgres fails with

FATAL: could not load server certificate file "/var/lib/postgresql/cert/server.crt": No such file or directory

Same defect breaks the logicalSnapshot promotion container. Observed on demo.dblab.dev after upgrading to v4.1.3 (data refresh had been failing; the missing cert mount was the cause once a pg_hba blocker was cleared).

Regression relative to the pre-4.1.x engine, where retrieval containers received the configured volume.

Fix

In BuildHostConfig (or ResourceOptions), honor a volume/volumes key from contConf and append the parsed bind mount(s) to hostConfig.Mounts/Binds, in addition to AddVolumesToHostConfig. Add coverage so a containerConfig.volume reaches the retrieval container.

Workaround

Add the mount to the dblab_server container itself (retrieval containers inherit its mounts via AddVolumesToHostConfig) — e.g. --volume /var/lib/dblab/cert:/var/lib/postgresql/cert:ro on dblab_server.