apple / apple/container

[Bug]: Intermittent Permission Errors reading hard links from the mount directory

Open
#1,937 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Swift
Stars
49.9k
Forks
1.8k
Avg merge
1d 20h
Merged PRs (30d)
22

Description

### I have done the following

- [x] I have searched the existing issues
- [ ] If possible, I've reproduced the issue using the 'main' branch of this project

### Steps to reproduce

Basically reopening https://github.com/apple/containerization/issues/509
Using this script

```
#!/usr/bin/env bash

for i in {1..100}
do
rm -rf source_dir
rm -rf dest_dir
mkdir source_dir
mkdir dest_dir
for j in {1..100}
do
head -c 1000000 < /dev/urandom > source_dir/test${j}.txt
chmod 555 source_dir/test${j}.txt
link source_dir/test${j}.txt dest_dir/test_link${j}.txt
chmod 555 dest_dir/test_link${j}.txt
done

abs_path="$(pwd)/dest_dir"
# tar is arbitary. we just need a command that going to open and read every file in the directory
container run -it --remove --uid=1024 --mount=type=bind,source=${abs_path},target=/dest_dir debian:bookworm-slim tar -cf /tmp/test.tar /dest_dir
done
```
You will eventually see

```
tar: /dest_dir/test_link1.txt: Cannot open: Permission denied
tar: /dest_dir/test_link4.txt: Cannot open: Permission denied
tar: /dest_dir/test_link5.txt: Cannot open: Permission denied
```

### Problem description

Intermittent EACCES errors when using hard links in mounts i.e a build system trying to share inputs across multiple actions and using containers as a sandbox.

### Environment

```markdown
- OS: macOs 26.4.1 (25E253)
- Xcode: N/A
- Container: container CLI version 1.0.0 (build: release, commit: ee848e3)
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Research direction

Start by running the provided Bash reproduction with the container CLI and a bind mount containing hard links, then compare behavior on the main branch. Trace the mount and file-reading path involved in `container run`; done means repeated runs no longer produce intermittent EACCES errors for the hard-linked files.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, shell, swift
Domain
infrastructure, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.