docker / docker/buildx

buildx permissions on config files should be more permissive

Open
#1,426 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
4.5k
Forks
682
Avg merge
2d 14h
Merged PRs (30d)
29

Description

I'm not sure how I ended up in this situation (perhaps I bind-mounted my homedir and switched contexts inside the container), but we probably can ease permissions on the files created within the config directory, as the user's home-directory itself should already be protected through permissions.

Here's what happened;

docker buildx imagetools inspect hello-world
ERROR: open /Users/thajeztah/.docker/buildx/current: permission denied

And lookiung at those files, they all seem to be either 0700 or 0600;

ls -la ~/.docker/buildx
total 16
drwx------   7 thajeztah  staff  224 Nov 21 21:24 ./
drwx------  17 thajeztah  staff  544 Nov 24 12:54 ../
-rw-------   1 thajeztah  staff   16 Sep  6 23:11 .buildNodeID
-rw-------   1 thajeztah  staff    0 Sep  6 23:11 .lock
-rw-------   1 root       staff   48 Nov 21 21:24 current
drwx------   2 thajeztah  staff   64 Sep  6 23:11 defaults/
drwx------   2 thajeztah  staff   64 Sep 29 17:48 instances/

Afaics, the files don't contain sensitive data, so wouldn't need to be very restricted;

sudo cat ~/.docker/buildx/current
{"Key":"desktop-linux","Name":"","Global":false}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue identifies ~/.docker/buildx/current and the surrounding config directory, but no repository file or test. Start by searching the Go code for creation of the buildx config files and inspecting their permission modes. Done means the relevant non-sensitive files can be accessed in the reported bind-mounted or context-switched scenario without loosening home-directory protection.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.