Secrets uid not set when using --mount
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 4.5k
- Forks
- 682
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 29
Description
There appears to be a regression in docker buildx. I updated to the latest version available in the docker Ubuntu repos before submitting this.
When writing --mount=type=secret,uid=1000,gid=1000,id=pqpi_password I would expect that the user be set on the secret file file in the container when building. On the latest version it is not. However on a older version it is.
--- Linux ---
[deploy_base 8/15] RUN --mount=type=secret,uid=1000,gid=1000,id=pqpi_username --mount=type=secret,uid=1000,gid=1000,id=pqpi_password ls -n /run/secrets && id && exit 1
0.325 total 8
0.325 -r-------- 1 0 1000 16 Feb 23 08:27 pqpi_password
0.325 -r-------- 1 0 1000 25 Feb 23 08:27 pqpi_username
0.286 uid=1000(service_user) gid=1000(service_user) groups=1000(service_user)
docker version
Client: Docker Engine - Community
Version: 23.0.1
API version: 1.42
Go version: go1.19.5
Git commit: a5ee5b1
Built: Thu Feb 9 19:47:01 2023
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 23.0.1
API version: 1.42 (minimum version 1.12)
Go version: go1.19.5
Git commit: bc3805a
Built: Thu Feb 9 19:47:01 2023
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.18
GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d
docker-init:
Version: 0.19.0
GitCommit: de40ad0
--- Mac ---
[deploy_base 8/15] RUN --mount=type=secret,id=pqpi_username,uid=1000 --mount=type=secret,id=pqpi_password,uid=1000 ls -n /run/secrets && exit 1
0.349 total 8
0.349 -r-------- 1 1000 0 15 Feb 23 08:48 pqpi_password
0.349 -r-------- 1 1000 0 26 Feb 23 08:48 pqpi_username
ERROR: executor failed running [/bin/sh -c ls -n /run/secrets && exit 1 /helpers/docker-setup-pqpi-auth.sh && /helpers/docker-pip-install.sh && rm -rf $HOME/.netrc]: exit code: 1
docker version
Client:
Cloud integration: v1.0.29
Version: 20.10.22
API version: 1.41
Go version: go1.18.9
Git commit: 3a2c30b
Built: Thu Dec 15 22:28:41 2022
OS/Arch: darwin/amd64
Context: default
Experimental: true
Server: Docker Desktop 4.16.2 (95914)
Engine:
Version: 20.10.22
API version: 1.41 (minimum version 1.12)
Go version: go1.18.9
Git commit: 42c8b31
Built: Thu Dec 15 22:26:14 2022
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.14
GitCommit: 9ba4b250366a5ddde94bb7c9d1def331423aa323
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d
docker-init:
Version: 0.19.0
GitCommit: de40ad0
I am aware that it's linux native and docker desktop that I am submitting here. But its what I had available to diagnose the issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the regression with the reported Dockerfile RUN --mount=type=secret example, comparing the Linux Docker 23.0.1 result with the older and macOS results. Start from the secret-mount handling used by that entry point, then add a regression test; done means the secret file's uid and gid match the requested values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, dockerfile, go
- Domain
- build-system, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100