Code change:
I'm working on upgrading our work repository to 23.11 and am running into an issue building a docker image with . There derivation is: This works with nix 22.05, but fails with nix 23.11 with the following error: Steps to reproduce the behavior: nix 23.11, try to build the above image The image builds and we can set ownership of files in the image n/a n/a Please run and paste the result. Also, we are running branch: , commit
I tested this a bit. I can change the permissions on the directory as long as I don't reference the unknown user .
Are you sure you were actually able to chown before hand or was chown simply ignored? It shouldn't be possible in the build sandbox regardless of what tools you preload.
As you can see here the chown becomes a no-op: If you would suggest to delete those chown commands, they do not have any effect. We replaced fakeroot and proot with just proot, since proot also can set the uid/gid to root and the combination was breaking things. You can still prepend fakeroot manually but except if you rely on third-party scripts to run without errors.
Ah okay, the idea was to try to ensure the files were owned by the UID that our CI user (outside of the container) uses, so that any file modifications done to volume mounts wouldn't make the files unreadable by CI. It's possible it wasn't actually needed and/or is vestigial. I guess it's a new version of chown that's causing the issue in 23.11? Thanks for the feedback!
No. We dropped fakechroot when proot already is enabled as it was causing issues. The chown program was still the same.
in is included as an example in :
It doesn't seem like the is actually a no-op, either, in previous versions. We wind up with permissions issues in CI when we remove the calls, and we're struggling to figure out a way to ensure the directories within the container have the expected user IDs in order to be compatible with bind-mounting volumes as the CI user.
If you are able to change filesystem owner/groups without having root, I would like to know how because that sounds like a kernel security vulnerability to me. If you do need to chown, you have to do this at container start.
I'm not sure I follow. Previously, we were able to use within the docker build process to set the ownership of directories within the resulting container image. That was useful, because we could set the UID of necessary directories to the UID of the CI user. For reference, this is essentially the derivation we are working with: On Nix 22.05, this works, and the results look as you'd expect after running & then running bash on the container: For 23.11, this is the full build output with the error: <details<summaryError Output</summary<pre nix log /nix/store/in5pqapmv1h5q94n4sj961aw5z101vqy-replication-customisation- | cat /nix/store/ffrva7icr8ws2d51955jy302icgmr80s-util-linux-2.39.2-bin/bin: login: /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/login kill: coreutils chfn: /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/chfn nologin: /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin chsh: /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/chsh +++ mkdir -p tmp src cargo +++ mkdir -p usr/bin +++ ln -s /nix/store/m38gwq0w8w7qyjn9s00balyp7cv3m5p9-coreutils-9.3/bin/env usr/bin/env +++ mkdir -p etc +++ touch etc/group proot warning: can't sanitize binding "/sys/": No such file or directory proot warning: can't sanitize binding "/nix/store/q8494z25m447skzy6l4ccyw84nqfcnja-replication-customisation-": No such file or directory ++ export PATH=/nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin:/nix/store/rvdryxhd9zw6zz7fwwxi6ma55qnblpi8-fakeroot-1.29/bin:/nix/store/811m6jpxyxzhff2wy27xx5r81bqs1dzk-proot-5.4.0/bin:/nix/store/h3ayxf5dk1gdf3s5716fh1ys815qxxag-patchelf-0.15.0/bin:/nix/store/m38gwq0w8w7qyjn9s00balyp7cv3m5p9-coreutils-9.3/bin:/nix/store/01znf87kiw5xx1dj0f7djrnrbg84ij28-findutils-4.9.0/bin:/nix/store/vq4vmndw555m7ld2bi6pq8kr348qvb6a-diffutils-3.10/bin:/nix/store/rwa7qyds01qzxvq7zq3kgnkrzzpw4s66-gnused-4.9/bin:/nix/store/n062zcsmfl9gfp6vfkcg0asb8jjwmy5i-gnugrep-3.11/bin:/nix/store/4v7m4yx07b3anmbznfhihjc8xiizyna9-gawk-5.2.2/bin:/nix/store/mi3pm67ps7c7k11aqki9182ygzg8j503-gnutar-1.35/bin:/nix/store/5c0ancqnpi0cf1h49mv13w68a950s9z0-gzip-1.13/bin:/nix/store/q5cv7r1sh3s4niyq7vm6h1j74394naxs-bzip2-1.0.8-bin/bin:/nix/store/bh7sbl99ygfvw9w96936nrhw46jmcmqq-gnumake-4.4.1/bin:/nix/store/7dpxg7ki7g8ynkdwcqf493p2x8divb4i-bash-5.2-p15/bin:/nix/store/mbh9gx43gsc5av019vsdkazbyiic3f0f-patch-2.7.6/bin:/nix/store/3q6fnwcm677l1q60vkhcf9m1gxhv83jm-xz-5.4.4-bin/bin:/nix/store/a5s2dmba16pw8l52f496gw0b7nli7mbn-file-5.45/bin ++ PATH=/nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin:/nix/store/rvdryxhd9zw6zz7fwwxi6ma55qnblpi8-fakeroot-1.29/bin:/nix/store/811m6jpxyxzhff2wy27xx5r81bqs1dzk-proot-5.4.0/bin:/nix/store/h3ayxf5dk1gdf3s5716fh1ys815qxxag-patchelf-0.15.0/bin:/nix/store/m38gwq0w8w7qyjn9s00balyp7cv3m5p9-coreutils-9.3/bin:/nix/store/01znf87kiw5xx1dj0f7djrnrbg84ij28-findutils-4.9.0/bin:/nix/store/vq4vmndw555m7ld2bi6pq8kr348qvb6a-diffutils-3.10/bin:/nix/store/rwa7qyds01qzxvq7zq3kgnkrzzpw4s66-gnused-4.9/bin:/nix/store/n062zcsmfl9gfp6vfkcg0asb8jjwmy5i-gnugrep-3.11/bin:/nix/store/4v7m4yx07b3anmbznfhihjc8xiizyna9-gawk-5.2.2/bin:/nix/store/mi3pm67ps7c7k11aqki9182ygzg8j503-gnutar-1.35/bin:/nix/store/5c0ancqnpi0cf1h49mv13w68a950s9z0-gzip-1.13/bin:/nix/store/q5cv7r1sh3s4niyq7vm6h1j74394naxs-bzip2-1.0.8-bin/bin:/nix/store/bh7sbl99ygfvw9w96936nrhw46jmcmqq-gnumake-4.4.1/bin:/nix/store/7dpxg7ki7g8ynkdwcqf493p2x8divb4i-bash-5.2-p15/bin:/nix/store/mbh9gx43gsc5av019vsdkazbyiic3f0f-patch-2.7.6/bin:/nix/store/3q6fnwcm677l1q60vkhcf9m1gxhv83jm-xz-5.4.4-bin/bin:/nix/store/a5s2dmba16pw8l52f496gw0b7nli7mbn-file-5.45/bin ++ mkdir -p /etc/pam.d ++ [[ ! -f /etc/passwd ]] ++ echo root:x:0:0::/root:/nix/store/7dpxg7ki7g8ynkdwcqf493p2x8divb4i-bash-5.2-p15/bin/bash ++ echo 'root:!x:::::::' ++ [[ ! -f /etc/group ]] ++ [[ ! -f /etc/pam.d/other ]] ++ cat ++ [[ ! -f ]] ++ echo nixbld:x:999: ++ echo root:x:0: +++ seq 1 10 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 1' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld1 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 2' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld2 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 3' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld3 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 4' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld4 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 5' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld5 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 6' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld6 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 7' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld7 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 8' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld8 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 9' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld9 ++ for n in $(seq 1 10) +++ command -v nologin ++ useradd -c 'Nix build user 10' -d /var/empty -g nixbld -G nixbld -M -N -r -s /nix/store/8d4v7wcr31xh2zh6kcyxnd94r0n8byy6-shadow-4.14.2/bin/nologin nixbld10 ++ mkdir -p /home ++ useradd -c 'ci user' --home-dir /home/ci --uid 1001 --groups nixbld,root --create-home ci Creating mailbox file: No such file or directory ++ cat /etc/group nixbld:x:999:nixbld1,nixbld2,nixbld3,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9,nixbld10,ci root:x:0:ci ci:!:1001: ++ chown -R 1001:root /src chown: changing ownership of '/src': Invalid argument exitHandler exitCode=1 set +e '[' -n '' ']' (( 1 != 0 )) runHook failureHook local hookName=failureHook shift local 'hooksSlice=failureHooks[ local hook for hook in "callImplicitHook 0 {!hooksSlice+"${!hooksSlice}"} eval 'callImplicitHook 0 failureHook' declare -F 'callImplicitHook 0 failureHook' eval 'callImplicitHook 0 failureHook' ++ callImplicitHook 0 failureHook ++ local def=0 ++ local hookName=failureHook ++ declare -F failureHook ++ type -p failureHook ++ '[' -n '' ']' ++ return 0 return 0 '[' -n '' ']' return 1 </pre</detailsIf I remove the chowns, everything in the container is owned by root, as you'd expect, but this leads to various issues in our CI process with bind-mounted directories. Is there no way to change the ownership of directories during the container build process?
Looks like I misunderstood how fakeroot works. It records those permissions between different programs and can replace them for the tar program:
Just adding the state of the directories when running the above without the chowns in 23.11. Note that the CI user doesn't even wind up owning its home directory created by . The user does exist, and I can things interactively in this bash shell as root. However, we don't run the container as root during the CI build for a few reasons, including that it needs to run postgres, which won't run as root.
This might be a better fix than: Feel free to open a pull request if it fixes your use case.
I'll pull down nixpkgs and give this a shot, thanks!
That does indeed seem to fix it! I'll open an MR now
Created , still cloning stuff to run the review suite locally

Related discussion:
text: mkdir $out ${if enableFakechroot then '' <del> proot -r $PWD/old_out ${bind-paths} --pwd=/ --root-id bash -c ' </del> <ins> proot -r $PWD/old_out ${bind-paths} --pwd=/ fakeroot bash -c ' </ins> source $stdenv/setup eval "$fakeRootCommands" tar