mz864: chown implicitly created WORKDIR parent directories to the active user#867
Open
mzihlmann wants to merge 2 commits into
Open
mz864: chown implicitly created WORKDIR parent directories to the active user#867mzihlmann wants to merge 2 commits into
mzihlmann wants to merge 2 commits into
Conversation
mzihlmann
force-pushed
the
mz864-workdir-chown-implicit-dirs
branch
2 times, most recently
from
5a8d563 to
4563b31
Compare
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
mzihlmann
force-pushed
the
mz864-workdir-chown-implicit-dirs
branch
from
4563b31 to
7241a61
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #864
WORKDIRchowns only the final directory it creates. When it also has to create missing parents,MkdirAllWithPermissionsrunsos.MkdirAllfor the whole tree butos.Chownonly on the leaf, so the implicit parents stay root owned while buildkit assigns the active USER to every directory it creates.WORKDIR /work/dirunderUSER 1000therefore leaves/workowned by root in kaniko but by 1000 in buildkit. This chowns every directory that the call newly creates, gated behindFF_KANIKO_CHOWN_ON_IMPLICIT_DIRSand enabled in the integration suite, matching the existingFF_KANIKO_COPY_CHMOD_ON_IMPLICIT_DIRSpattern for the COPY side of the same family.