[Bug]: copyFileToContainer retention of uid/gid breaks rootless Docker

Module

Core

Testcontainers version

1.21.3

Using the latest Testcontainers version?

Yes

Host OS

OpenSuse

Host Arch

x86

Docker version

Docker version 28.5.1-ce

What happened?

Trying to solve this issue in keycloak dev container https://github.com/quarkusio/quarkus/issues/45940
I have found, that copyFileToContainer function sets owner of the copied file to the user id, which are not exists inside container
in my case it was:
-rw-r--r--. 1 439803918 439800513 1201 Feb 4 14:24 upconfig.json

Debugging through Test container source code I have found in container_copy_common.go following commentary:
// We optimistically chown to the host user. In case of a hypothetical
// container-to-container copy, the reading side will chown back to the
// container user.

There is no way to override this behavior, even if function is called without permission mask, file owner will be changed to host owner user id, which is not exist inside container.

This permission change accidentally works in rootfull docker , because as root you can set owner even if this owner does not exists, but does not work in rootless docker, because unprivileged user could not set owner to not existed user, leading to the described "Keycloak Dev Service fails to start on rootless Docker setup"

Unfortunately we was not able to find any workaround ad need this hard coded chown could be disabled in this function.

Relevant log output

Keycloak Devservice fails to start with rootless docker with following error log.

    2025-01-29 09:09:18,785 INFO [tc.qua.io/.0.6] (build-23) Creating container for image: quay.io/keycloak/keycloak:25.0.6
    2025-01-29 09:09:18,794 INFO [tc.tes.11.0] (build-23) Creating container for image: testcontainers/ryuk:0.11.0
    2025-01-29 09:09:18,866 INFO [tc.tes.11.0] (build-23) Container testcontainers/ryuk:0.11.0 is starting: 721e3e87dd739f95f37021e640a42046a74833cc1bf8a3507cc7916814c5163d
    2025-01-29 09:09:19,109 INFO [tc.tes.11.0] (build-23) Container testcontainers/ryuk:0.11.0 started in PT0.314788777S
    <====2025-01-29 09:09:19,151 INFO [tc.qua.io/.0.6] (build-23) Container quay.io/keycloak/keycloak:25.0.6 is starting: c25e849df4aa9d8c18ab05109bb46990bf18f961a50cad35247e10948dc428f6
    <====2025-01-29 09:09:20,007 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Changes detected in configuration. Updating the server image.
    <====2025-01-29 09:09:20,023 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Updating the configuration and installing your custom providers, if any. Please wait.
    <====2025-01-29 09:09:25,079 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: 2025-01-29 08:09:25,078 INFO [io.qua.dep.QuarkusAugmentor] (main) Quarkus augmentation completed in 4490msEXECUTING [10s]
    2025-01-29 09:09:25,091 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Server configuration updated and persisted. Run the following command to review the configuration:
    2025-01-29 09:09:25,091 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:25,091 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: kc.sh show-config
    2025-01-29 09:09:25,092 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Next time you run the server, just run:
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: kc.sh start --http-enabled=true --hostname-strict=false --spi-user-profile-declarative-user-profile-config-file=/opt/keycloak/upconfig.json --optimized
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:26,144 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: Unexpected error when starting the server in (production) mode
    2025-01-29 09:09:26,144 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: Failed to start quarkus
    2025-01-29 09:09:26,144 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: Failed to reaad default user profile configuration: /opt/keycloak/upconfig.json
    2025-01-29 09:09:26,145 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: /opt/keycloak/upconfig.json (Permission denied)
    2025-01-29 09:09:26,145 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.

It seems like the file permission of upconfig.json are not correct when copying the file to the container KeycloakDevServicesProcessor

    drwxr-xr-x 1 keycloak root 4.0K Jan 29 08:10 .
    drwxr-xr-x 1 root root 4.0K Sep 19 17:57 ..
    drwxrwxr-x 3 keycloak root 4.0K Sep 19 17:53 bin
    drwxrwxr-x 3 keycloak root 4.0K Sep 19 17:57 conf
    drwxrwxr-x 2 keycloak root 4.0K Sep 19 17:57 data
    drwxrwxr-x 1 keycloak root 4.0K Sep 19 17:53 lib
    -rw-rw-r-- 1 keycloak root 12K Sep 19 17:43 LICENSE.txt
    drwxrwxr-x 2 keycloak root 4.0K Sep 19 17:57 providers
    -rw-rw-r-- 1 keycloak root 492 Sep 19 17:43 README.md
    drwxrwxr-x 2 keycloak root 4.0K Sep 19 17:57 themes
    -rw-r----- 1 5766578 20003 1.2K Jan 29 08:10 upconfig.json
    -rw-rw-r-- 1 keycloak root 26 Sep 19 17:43 version.txt

5766578 is the UID of my local user.

Additional Information

No response

Inizia con container_copy_common.go e il percorso copyFileToContainer menzionato nel report, quindi riproduci la copia del file con rootless Docker usando i dettagli di proprietà e permessi forniti. Traccia dove viene applicato l’UID/GID dell’host e aggiungi la copertura per il comportamento richiesto; il lavoro è completato quando i file copiati possono essere utilizzati dal container senza l’errore di permessi rootless.