search

coder / envbuilder

Build development environments from a Dockerfile on Docker, Kubernetes, and OpenShift. Enable developers to modify their development environment quickly.
Apache License 2.0
123 stars 24 forks source link

fix: revert setting default UserID and GroupID to 0:0 #202

Closed johnstcn closed 3 months ago

johnstcn commented 3 months ago

After looking into the failing unit tests some more, it looks like https://github.com/coder/kaniko/commit/9f83bc8595cde0965de0b5a17e6770e5c2b1321f actually does cause divergence from Docker behaviour.

I've included an integration test adapted from GoogleContainerTools/kaniko that reproduces the issue. It affects file permissions when changing permissions in a multi-stage build but does not appear to affect single-stage builds.

This test fails with the commit, and succeeds without. The fix has not been merged upstream yet as it would break legacy users. For now, we will revert to the upstream behaviour.

This will unfortunately re-break https://github.com/coder/envbuilder/issues/70 but has a simple workaround of using COPY --chown 0:0.

mafredri commented 3 months ago

After looking into the failing unit tests some more, it looks like https://github.com/coder/kaniko/commit/9f83bc8595cde0965de0b5a17e6770e5c2b1321f actually does cause divergence from the Docker spec.

What's the divergence? As far as Docker spec is concerned, root is the default:

All files and directories copied from the build context are created with a UID and GID of 0.unless the optional --chown flag specifies a given username, groupname, or UID/GID combination to request specific ownership of the copied content. From: https://docs.docker.com/reference/dockerfile/#copy

johnstcn commented 3 months ago

What's the divergence? As far as Docker spec is concerned, root is the default:

In a multi-stage build, the UIDs/GIDs of the source appear to be retained. This was the behaviour that the failing integration test was checking.