canonical / rockcraft

Tool to create OCI Images using the language from Snapcraft and Charmcraft.
GNU General Public License v3.0
35 stars 43 forks source link

File permissions/ownership not preserved #44

Closed jnsgruk closed 2 years ago

jnsgruk commented 2 years ago

Hey :wave:

I've been building a ROCK for Traefik. I want to include a config file and have it owned by a specific user. Take the following excerpt as an example (full file here):

  default-config:
    plugin: dump
    source: files
    organize:
      traefik.yaml: etc/traefik/traefik.yaml
      001-default.yaml: var/lib/pebble/default/layers/001-default.yaml
    stage:
      - etc/traefik/traefik.yaml
      - var/lib/pebble/default/layers/001-default.yaml
    override-prime: |
      craftctl default
      ls -l etc/
      chown -R 1000:1000 etc/traefik
      ls -l etc/

  non-root-user:
    plugin: nil
    after: [default-config]
    overlay-script: |
      # Create a user in the $CRAFT_OVERLAY chroot
      useradd -R $CRAFT_OVERLAY -M -r -u 1000 -U traefik

I've added the ls -l as an example - the first shows the following:

# ...
2022-07-12 07:50:57.423 :: -rw-r----- 3 root shadow 523 Jul 12 07:48 shadow
2022-07-12 07:50:57.423 :: -rw-r----- 3 root shadow 501 May 31 15:43 shadow-
2022-07-12 07:50:57.423 :: drwxr-xr-x 1 root root    24 Jul 12 07:50 traefik

The second then shows that the chown is working as expected:

# ...
2022-07-12 07:50:57.426 :: -rw-r----- 3 root shadow 523 Jul 12 07:48 shadow
2022-07-12 07:50:57.426 :: -rw-r----- 3 root shadow 501 May 31 15:43 shadow-
2022-07-12 07:50:57.426 :: drwxr-xr-x 1 1000   1000  24 Jul 12 07:50 traefik

However, when the image is built, if I get a shell and list the directory:

❯ docker run --rm --entrypoint pebble --entrypoint /bin/bash -it traefik:2.8.1
root@ea2f942c09f4:/# ls -l /etc | grep trae
drw------- 1 root root      24 Jul 12 07:49 traefik
root@ea2f942c09f4:/#

I also attempted to chown the directory in the non-root-user stage after I'd created the user (within the chroot), but it can't see the /etc/traefik directory created in the previous stage from within the chroot.

sergiusens commented 2 years ago

The root cause for this is most likely here

https://github.com/canonical/rockcraft/blob/main/rockcraft/oci.py#L306