jenkinsci / jenkinsci/docker-workflow-plugin

[JENKINS-54408] docker exec runs as root within docker.image.inside which docker run runs as the jenkins user

Open
#590 4 comments 0 reactions 0 assignees View on GitHub
component:docker-workflow-plugin imported-jira-issue priority:major resolution:unresolved
Dominant language
Java
Stars
527
Forks
422
Avg merge
10m
Merged PRs (30d)
1

Description

A docker.image.inside block causes Jenkins to run a 'docker run ... cat' command and later a docker exec command. The run command runs as the Jenkins user (specifically with the same uid), while docker exec runs as root. The result is that files created withing the inside block has root owners in the workplace, causing issues in later stages.

I would expect the opposite behavior. "docker run ... cat" should run as root, in order to be able to initialize the docker container. Specifically I have to create a user with the same uid as the jenkins user of the agent (otherwise sudo, ssh will not work). On the other hand docker exec, which does the actual build job, should run under the jenkins user uid, so the owner of the newly created files in mounted directories is the jenkins user.

---
Originally reported by hontvari, imported from: docker exec runs as root within docker.image.inside which docker run runs as the jenkins user


  • status: Open
  • priority: Major
  • component(s): docker-workflow-plugin
  • resolution: Unresolved
  • votes: 4
  • watchers: 6
  • imported: 2025-12-07

Raw content of original issue

A docker.image.inside block causes Jenkins to run a 'docker run ... cat' command and later a docker exec command. The run command runs as the Jenkins user (specifically with the same uid), while docker exec runs as root. The result is that files created withing the inside block has root owners in the workplace, causing issues in later stages.

I would expect the opposite behavior. "docker run ... cat" should run as root, in order to be able to initialize the docker container. Specifically I have to create a user with the same uid as the jenkins user of the agent (otherwise sudo, ssh will not work). On the other hand docker exec, which does the actual build job, should run under the jenkins user uid, so the owner of the newly created files in mounted directories is the jenkins user.

  • environment: Jenkins ver. 2.138.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.