docker / docker/buildx

Secrets uid not set when using --mount

Open
#1,647 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
4.5k
Forks
682
Avg merge
2d 14h
Merged PRs (30d)
29

Description

There appears to be a regression in docker buildx. I updated to the latest version available in the docker Ubuntu repos before submitting this.

When writing --mount=type=secret,uid=1000,gid=1000,id=pqpi_password I would expect that the user be set on the secret file file in the container when building. On the latest version it is not. However on a older version it is.

--- Linux ---
[deploy_base  8/15] RUN --mount=type=secret,uid=1000,gid=1000,id=pqpi_username --mount=type=secret,uid=1000,gid=1000,id=pqpi_password   ls -n /run/secrets   && id   && exit 1
0.325 total 8
0.325 -r-------- 1 0 1000 16 Feb 23 08:27 pqpi_password
0.325 -r-------- 1 0 1000 25 Feb 23 08:27 pqpi_username
0.286 uid=1000(service_user) gid=1000(service_user) groups=1000(service_user)

docker version
Client: Docker Engine - Community
 Version:           23.0.1
 API version:       1.42
 Go version:        go1.19.5
 Git commit:        a5ee5b1
 Built:             Thu Feb  9 19:47:01 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          23.0.1
  API version:      1.42 (minimum version 1.12)
  Go version:       go1.19.5
  Git commit:       bc3805a
  Built:            Thu Feb  9 19:47:01 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.18
  GitCommit:        2456e983eb9e37e47538f59ea18f2043c9a73640
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
--- Mac ---
[deploy_base  8/15] RUN --mount=type=secret,id=pqpi_username,uid=1000 --mount=type=secret,id=pqpi_password,uid=1000 ls -n /run/secrets && exit 1
0.349 total 8
0.349 -r-------- 1 1000 0 15 Feb 23 08:48 pqpi_password
0.349 -r-------- 1 1000 0 26 Feb 23 08:48 pqpi_username
ERROR: executor failed running [/bin/sh -c ls -n /run/secrets && exit 1  /helpers/docker-setup-pqpi-auth.sh   && /helpers/docker-pip-install.sh   && rm -rf $HOME/.netrc]: exit code: 1


docker version
Client:
 Cloud integration: v1.0.29
 Version:           20.10.22
 API version:       1.41
 Go version:        go1.18.9
 Git commit:        3a2c30b
 Built:             Thu Dec 15 22:28:41 2022
 OS/Arch:           darwin/amd64
 Context:           default
 Experimental:      true

Server: Docker Desktop 4.16.2 (95914)
 Engine:
  Version:          20.10.22
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.9
  Git commit:       42c8b31
  Built:            Thu Dec 15 22:26:14 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.14
  GitCommit:        9ba4b250366a5ddde94bb7c9d1def331423aa323
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

I am aware that it's linux native and docker desktop that I am submitting here. But its what I had available to diagnose the issue.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the regression with the reported Dockerfile RUN --mount=type=secret example, comparing the Linux Docker 23.0.1 result with the older and macOS results. Start from the secret-mount handling used by that entry point, then add a regression test; done means the secret file's uid and gid match the requested values.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, dockerfile, go
Domain
build-system, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.