buildx permissions on config files should be more permissive
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 4.5k
- Forks
- 682
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 29
Description
I'm not sure how I ended up in this situation (perhaps I bind-mounted my homedir and switched contexts inside the container), but we probably can ease permissions on the files created within the config directory, as the user's home-directory itself should already be protected through permissions.
Here's what happened;
docker buildx imagetools inspect hello-world
ERROR: open /Users/thajeztah/.docker/buildx/current: permission denied
And lookiung at those files, they all seem to be either 0700 or 0600;
ls -la ~/.docker/buildx
total 16
drwx------ 7 thajeztah staff 224 Nov 21 21:24 ./
drwx------ 17 thajeztah staff 544 Nov 24 12:54 ../
-rw------- 1 thajeztah staff 16 Sep 6 23:11 .buildNodeID
-rw------- 1 thajeztah staff 0 Sep 6 23:11 .lock
-rw------- 1 root staff 48 Nov 21 21:24 current
drwx------ 2 thajeztah staff 64 Sep 6 23:11 defaults/
drwx------ 2 thajeztah staff 64 Sep 29 17:48 instances/
Afaics, the files don't contain sensitive data, so wouldn't need to be very restricted;
sudo cat ~/.docker/buildx/current
{"Key":"desktop-linux","Name":"","Global":false}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue identifies ~/.docker/buildx/current and the surrounding config directory, but no repository file or test. Start by searching the Go code for creation of the buildx config files and inspecting their permission modes. Done means the relevant non-sensitive files can be accessed in the reported bind-mounted or context-switched scenario without loosening home-directory protection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100