reproducible_builds: ensure that `umask` doesn't affect the container build

Open
#3 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
docker, dockerfile

Research direction

The issue names no specific file or test; inspect the Dockerfile entry that uses ADD root / and the root/usr tree. First reproduce a container build under a restrictive umask, then verify that the resulting image permissions are unchanged by the builder's umask.

Written by the indexing model from the issue text.

Description

enhancement
  • git doesn't track file permissions, thus
  • git clone initiates the permissions according the user's umask value
  • docker build just copies the files as-is into container
  • especial problems are with root/usr directory created by ADD root / command, this affects the whole image (/usr directory might be unreadable)

In RPMs' specfiles, we explicitly set the permissions in %install phase (or by %attr in %files), though there's no such way in Dockerfile.

Dominant language
Shell
Stars
25
Forks
45
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sclorg/container-common-scripts

All issues in sclorg/container-common-scripts

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.