exclude docker sockets and host system paths from volume backups

src/lib/utils/unbackupable-mounts.ts

@@ -0,0 +1,42 @@
+/**
+ * Bind mounts that must never be backed up: Docker/containerd sockets and host
+ * system paths that are infrastructure, not data. Backing up a socket is
+ * meaningless (it's a device node, not files) and a "backup all" that captures
+ * /proc or /var/run is pointless and slow.
+ *
+ * Dependency-free so BOTH the backup engine (discovery-core.ts, which enumerates
+ * mounts itself for "backup all") and the UI picker (utils/mounts.ts) can share
+ * the exact same rule with no drift.
+ *
+ * Matches on the HOST SOURCE path of a bind mount, not the container destination
+ * (the source is what identifies "this is the host's docker socket", regardless
+ * of where a container maps it).
+ */
+
+/** Exact host source paths (or their children) that are never backed up. */
+const UNBACKUPABLE_PREFIXES = [
+	'/proc',
+	'/sys',
+	'/dev',
+	'/var/run',
+	'/run',
+];
+
+/** Exact socket files, matched anywhere, in case they live outside the prefixes
+ *  above (e.g. rootless docker under /var/run/user/<uid>, already covered by
+ *  /var/run, but a socket bound from an unusual path still gets caught here). */
+const UNBACKUPABLE_SOCKET_BASENAMES = ['docker.sock', 'containerd.sock'];
+
+/** True if a bind mount's host SOURCE is infrastructure that must not be backed
+ *  up (a socket or a host system path). Only applies to bind mounts — named
+ *  volumes are always data. */
+export function isUnbackupableBindSource(hostSource: string | undefined | null): boolean {
+	if (!hostSource || !hostSource.startsWith('/')) return false;
+	const path = hostSource.replace(/\/+$/, ''); // drop trailing slash
+	const base = path.slice(path.lastIndexOf('/') + 1);
+	if (UNBACKUPABLE_SOCKET_BASENAMES.includes(base)) return true;
+	for (const prefix of UNBACKUPABLE_PREFIXES) {
+		if (path === prefix || path.startsWith(prefix + '/')) return true;
+	}
+	return false;
+}