Cache permissions

Hi! I'm excited about the new builder frontend. I have been dreaming of this sort of functionality for years now! Great to see it happening, looks like there are some very neat features in here 🎉.

My Dockerfile looks something like this:

# syntax=docker/dockerfile:experimental
USER nobody:nogroup

COPY go.mod go.sum .
RUN --mount=type=cache,target=/home/nobody/.cache/go-build \
  go mod download

But it fails with permission denied:

#17 0.658 go: disabling cache (/home/nobody/.cache/go-build) due to initialization failure: mkdir /home/nobody/.cache/go-build/00: permission denied
#17 0.658 go: cannot use modules with build cache disabled

Is there a way to specify the owner of the cache? One of my aims is to avoid using root as early as I can during the build, and to do the build as nobody. So I use root to install a few distro packages, then drop permissions to build the go code.

I wasn't sure whether this is the right place to file this issue. Please let me know if I should have filed it in the moby repository.

Start with the Dockerfile example using USER nobody:nogroup and RUN --mount=type=cache, then trace how cache mounts establish ownership. Done means a non-root Go build can specify or receive an appropriate cache owner without the permission-denied failure shown in the issue.