RUN --mount=type=cache should inherit ownership/permissions from mountpoint
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- docker, go
- Domain
- build-system
Research direction
Start by reproducing the behavior with the Dockerfile example and trace the cache-mount permission handling in BuildKit. The change is done when a cache mount inherits the existing mountpoint's uid/gid when available, while still defaulting to root when the mountpoint does not exist; verify both cases with tests.
Written by the indexing model from the issue text.
Description
When using RUN --mount=type=cache, the uid/gid of the mount defaults to 0:0 (root), even if the mountpoint is an existing directory with different permissions.
While it's possible to manually override the uid/gid for the mount, I think it would make sense to default to the permissions of the mountpoint (if exists), and otherwise fall back to the current behaviour (root).
Example / reproduction steps:
# syntax=docker/dockerfile:1.1.3-experimental
FROM busybox
ARG UID=1000
ARG GID=1000
RUN addgroup -g ${GID} foo
RUN adduser -D -u ${UID} -G foo foo
RUN mkdir -p /mycache && chown -R "${UID}:${GID}" /mycache
# this works (as we're root):
RUN mkdir -p /mycache/root-nomount/bar
# this works (we're still root):
RUN --mount=type=cache,target=/mycache \
mkdir -p /mycache/root-withmount/bar
USER ${UID}:${GID}
# without `--mount`, this works, because `/mycache` was created with
# the correct permissions:
RUN mkdir -p /mycache/foo-nomount/bar
# with `--mount`, this works if we manually set the uid/gid, but this does not
# work well (currently) with dynamically set UID/GID
RUN --mount=type=cache,target=/mycache,uid=1000,gid=1000 \
mkdir -p /mycache/foo-withmount-manually/bar
# but this fails:
#
# > [stage-0 9/9] RUN --mount=type=cache,target=/mycache mkdir -p /mycache/foo-withmount/bar:
#15 0.607 mkdir: can't create directory '/mycache/foo-withmount/': Permission denied
RUN --mount=type=cache,target=/mycache \
mkdir -p /mycache/foo-withmount/bar
DOCKER_BUILDKIT=1 docker build .
[+] Building 11.9s (15/15) FINISHED
=> [internal] load build definition from Dockerfile 0.1s
=> => transferring dockerfile: 1.07kB 0.0s
=> [internal] load .dockerignore 0.1s
=> => transferring context: 2B 0.0s
=> resolve image config for docker.io/docker/dockerfile:1.1.3-experimental 1.4s
=> docker-image://docker.io/docker/dockerfile:1.1.3-experimental@sha256:888f21826273409b5ef5ff9ceb90c64a8f8ec7760da30d1ffbe6c3e2d323a7bd 2.8s
=> => resolve docker.io/docker/dockerfile:1.1.3-experimental@sha256:888f21826273409b5ef5ff9ceb90c64a8f8ec7760da30d1ffbe6c3e2d323a7bd 0.0s
=> => sha256:888f21826273409b5ef5ff9ceb90c64a8f8ec7760da30d1ffbe6c3e2d323a7bd 2.03kB / 2.03kB 0.0s
=> => sha256:ee85655c57140bd20a5ebc3bb802e7410ee9ac47ca92b193ed0ab17485024fe5 527B / 527B 0.0s
=> => sha256:80b5f664ac0c5f6b89608f7b0afd9548ac5b2d4cd631b7b723d9f2edca8676d9 897B / 897B 0.0s
=> => sha256:73e11b97eeae87ce062a224a9ff2d7f8a919d3b50e014a3f33a79b0c219a7003 8.82MB / 8.82MB 2.3s
=> => extracting sha256:73e11b97eeae87ce062a224a9ff2d7f8a919d3b50e014a3f33a79b0c219a7003 0.3s
=> [internal] load metadata for docker.io/library/busybox:latest 0.0s
=> [stage-0 1/9] FROM docker.io/library/busybox 0.0s
=> => resolve docker.io/library/busybox:latest 0.0s
=> [internal] settings cache mount permissions 0.1s
=> [stage-0 2/9] RUN addgroup -g 1000 foo 0.9s
=> [stage-0 3/9] RUN adduser -D -u 1000 -G foo foo 0.9s
=> [stage-0 4/9] RUN mkdir -p /mycache && chown -R "1000:1000" /mycache 0.8s
=> [stage-0 5/9] RUN mkdir -p /mycache/root-nomount/bar 1.0s
=> [stage-0 6/9] RUN --mount=type=cache,target=/mycache mkdir -p /mycache/root-withmount/bar 0.8s
=> [stage-0 7/9] RUN mkdir -p /mycache/foo-nomount/bar 0.8s
=> [stage-0 8/9] RUN --mount=type=cache,target=/mycache,uid=1000,gid=1000 mkdir -p /mycache/foo-withmount-manually/bar 0.8s
=> ERROR [stage-0 9/9] RUN --mount=type=cache,target=/mycache mkdir -p /mycache/foo-withmount/bar 0.7s
------
> [stage-0 9/9] RUN --mount=type=cache,target=/mycache mkdir -p /mycache/foo-withmount/bar:
#14 0.543 mkdir: can't create directory '/mycache/foo-withmount/': Permission denied
------
failed to solve with frontend dockerfile.v0: failed to solve with frontend gateway.v0: rpc error: code = Unknown desc = failed to build LLB: executor failed running [/bin/sh -c mkdir -p /mycache/foo-withmount/bar]: runc did not terminate sucessfully
- Dominant language
- Go
- Stars
- 10.3k
- Forks
- 1.5k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 48
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from moby/buildkit
-
status/triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
area/dockerfile
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100