nestybox / nestybox/sysbox

Directory and file ownership nobody:nogroup - after docker copy into sysbox enabled container

Open
#754 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
3.9k
Forks
230
Avg merge
7h 48m
Merged PRs (30d)
3

Description

Am seeing an issue with directory and file ownership after using docker cp to copy a directory inside a sysbox enabled container.


Using the latest version of all system components.

os=Ubuntu 22.04.3 LTS, kernel=6.2.0-37-generic, docker=24.0.7, sysbox=0.6.2 EE (Tue Nov 14 23:13:01 UTC 2023)
os=Ubuntu 22.04.3 LTS, kernel=6.2.0-37-generic, docker=24.0.7, sysbox=0.6.2 CE (Mon Jun 12 03:49:19 UTC 2023)

HWE kernel installed using the following package.

linux-image-generic-hwe-22.04/jammy-updates

The shiftfs module looks to be available.

lsmod | grep shiftfs
shiftfs                36864  0

Start test container.

docker run --runtime sysbox-runc -it --name z1 ubuntu:22.04 bash


Run following commands outside test container.

mkdir z2
echo "hi there" > z2/hello
docker cp z2 z1:/
docker exec z1 ls -l /z2

This produces the following.
-rw-r--r-- 1 nobody nogroup 9 Nov 30 07:15 hello


We were expecting the following.
-rw-r--r-- 1 root root 9 Nov 30 07:15 hello

Attempting to adjust directory and file ownership after the fact.
docker exec -it z1 chown -R root:root /z2

Produces the following errors.

chown: changing ownership of '/z2/hello': Operation not permitted
chown: changing ownership of '/z2': Operation not permitted

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the shown docker run, mkdir, docker cp, docker exec ls, and chown commands on the listed Ubuntu, Docker, and Sysbox versions. Investigate how Sysbox handles ownership mapping for docker cp and verify the fix by confirming copied files appear as root:root and can be changed with chown inside the container.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, linux, shell, ubuntu
Domain
devops, infrastructure, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.