BoundOS has two function to check whether or not a file is inside the base directory. Their implementation rely on appending filepath.Separator to fs.baseDir and using strings.HasPrefix with filename. This causes a problem when fs.baseDir is the root directory. That's because strings.HasPrefix("/" + filepath.Separator, filename) will never return true with a clean filename.