Repository: containers/buildah

Issue #1534: COPY creates folders with very restricted permissions
Created: 2019-04-18T21:26:56Z
This issue was initially wrongfully reported under #1516 . The problem is that Buildah creates the folders in path for COPY using mode=700 unlike Docker that uses mode=755. This is a problem for two reasons: running as non-root and Docker compatibility:

If you're running as non-root inside the container, you now need to chase down all COPY statements and fix permissions with a chmod
If you're migrating off Docker to Buildah, your images may get broken in unexpected ways


Steps to reproduce the issue:

Create an empty file: touch distutils.cfg
Create a Dockerfile that performs a COPY into a nested non-existent path

FROM docker.io/ubuntu
COPY distutils.cfg /usr/lib/python3.7/distutils/distutils.cfg
#                           ^- 'python3.7' and 'distutils' folders have to be created
#                               to copy the file

Build an image: buildah bud -t proof-buildah .
Create a container from it: buildah from proof-buildah
Check permissions: buildah run proof-buildah-working-container ls -lah /usr/lib | grep python

Describe the results you received:
python3.7 folder has mode=700. See the full CLI output below:
$ buildah bud -t proof-buildah .
STEP 1: FROM docker.io/ubuntu
STEP 2: COPY distutils.cfg /usr/lib/python3.7/distutils/distutils.cfg
STEP 3: COMMIT proof-buildah
Getting image source signatures
Copying blob 762d8e1a6054 skipped: already exists
Copying blob e45cfbc98a50 skipped: already exists
Copying blob d60e01b37e74 skipped: already exists
Copying blob b57c79f4a9f3 skipped: already exists
Copying blob c7a123878960 done
Copying config 5ee072a37f done
Writing manifest to image destination
Storing signatures
--> 5ee072a37f58ff245eb40a410039bc989e93d03eba6e43aee0ce1cf910a12a7f
$ buildah from proof-buildah
proof-buildah-working-container
$ buildah run proof-buildah-working-container ls -lah /usr/lib | grep python
drwx------ 3 root root 4.0K Apr 18 21:05 python3.7
$ docker run --rm proof-buildah ls -lah /usr/lib | grep python
drwx------  3 root root 4.0K Apr 18 21:05 python3.7

Describe the results you expected:
python3.7 folder has mode=755.  See the Docker CLI output below (for comparison):
$ docker build -t proof-docker .
Sending build context to Docker daemon   2.56kB
Step 1/2 : FROM docker.io/ubuntu
 ---> 94e814e2efa8
Step 2/2 : COPY distutils.cfg /usr/lib/python3.7/distutils/distutils.cfg
 ---> c1cebcb50780
Successfully built c1cebcb50780
Successfully tagged proof-docker:latest
$ docker run --rm proof-docker ls -lah /usr/lib | grep python
drwxr-xr-x  3 root root 4.0K Apr 18 21:04 python3.7

Output of rpm -q buildah or apt list buildah:
Listing... Done
buildah/xenial,now 1.8-1~dev~ubuntu16.04.2~ppa5 amd64 [installed]

Output of buildah version:
Version:         1.8-dev
Go Version:      go1.10.4
Image Spec:      1.0.0
Runtime Spec:    1.0.0
CNI Spec:        0.4.0
libcni Version:
Git Commit:
Built:           Sat Apr 13 16:42:38 2019
OS/Arch:         linux/amd64

Output of podman version if reporting a podman build issue:
N/A

Output of cat /etc/*release:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.1 LTS"
NAME="Ubuntu"
VERSION="16.04.1 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.1 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
UBUNTU_CODENAME=xenial

Output of uname -a:
Linux scw-35eb3f 4.5.7-generic #1 SMP Tue Jul 12 09:41:14 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

Output of cat /etc/containers/storage.conf:
# storage.conf is the configuration file for all tools
# that share the containers/storage libraries
# See man 5 containers-storage.conf for more information

# The "container storage" table contains all of the server options.
[storage]

# Default Storage Driver
driver = "overlay"

# Temporary storage location
runroot = "/var/run/containers/storage"

# Primary read-write location of container storage
graphroot = "/var/lib/containers/storage"

[storage.options]
# AdditionalImageStores is used to pass paths to additional read-only image stores
# Must be comma separated list.
additionalimagestores = [
]

# Size is used to set a maximum size of the container image.  Only supported by
# certain container storage drivers (currently overlay, zfs, vfs, btrfs)
size = ""

# OverrideKernelCheck tells the driver to ignore kernel checks based on kernel version
override_kernel_check = "true"

Duplicate issue #1613: COPY fails with multiple files when destination folder doesn't exist
Created: 2019-05-24T14:20:18Z
Description

Steps to reproduce the issue:

Create two empty files: touch file1 file2
Create the following Dockerfile

FROM scratch
COPY file1 file2 /bin/


Build an image: buildah bud .

Describe the results you received:
Image fails to build. See the log output below:
STEP 1: FROM scratch
STEP 2: COPY file1 file2 /bin/
error building at STEP "COPY file1 file2 /bin/": destination "/var/lib/containers/storage/overlay/a0d1243fd0bb31904323e9f4306dbb208ed8707a6e14b76db528ccc6901f043a/merged/bin" is not a directory

Describe the results you expected:
A successful build. See docker build output for comparison:
Step 1/2 : FROM scratch
 ---> 
Step 2/2 : COPY file1 file2 /bin/
 ---> Using cache
 ---> 71d3bbc649d0
Successfully built 71d3bbc649d0

Output of rpm -q buildah or apt list buildah:
Built off master

Output of buildah version:
Version:         1.9.0-dev
Go Version:      go1.12.4
Image Spec:      1.0.0
Runtime Spec:    1.0.0
CNI Spec:        0.4.0
libcni Version:  
Git Commit:      
Built:           Thu Jan  1 01:00:00 1970
OS/Arch:         linux/amd64

Output of podman version if reporting a podman build issue:
N/A

Output of cat /etc/*release:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.6 LTS"
NAME="Ubuntu"
VERSION="16.04.6 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.6 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial

Output of uname -a:
Linux scw-35eb3f 4.5.7-docker-4 #1 SMP Tue Jul 12 09:41:14 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

Output of cat /etc/containers/storage.conf:
# storage.conf is the configuration file for all tools
# that share the containers/storage libraries
# See man 5 containers-storage.conf for more information

# The "container storage" table contains all of the server options.
[storage]

# Default Storage Driver
driver = "overlay"

# Temporary storage location
runroot = "/var/run/containers/storage"

# Primary read-write location of container storage
graphroot = "/var/lib/containers/storage"

[storage.options]
# AdditionalImageStores is used to pass paths to additional read-only image stores
# Must be comma separated list.
additionalimagestores = [
]

# Size is used to set a maximum size of the container image.  Only supported by
# certain container storage drivers (currently overlay, zfs, vfs, btrfs)
size = ""

# OverrideKernelCheck tells the driver to ignore kernel checks based on kernel version
override_kernel_check = "true"

Closing comment (2019-05-26T13:26:21Z): Investigated this further - it not related to #1534. It's an issue introduced in c0633e3#diff-65919b07714c5faa770fc0724c4ca886. securejoin.SecureJoin drops the trailing slash - which is what Builder uses to determine if target is a folder or a file. I've fixed this by manually restoring the trailing slash if it was present in the original destination spec.
// build.go:495
		if !strings.HasPrefix(finalPath, secureMountPoint) {
			return errors.Wrapf(err, "error resolving copy destination %s", copy.Dest)
		}
		if copy.Dest[len(copy.Dest)-1] == os.PathSeparator {
			finalPath = finalPath + string(os.PathSeparator)
		}
		copy.Dest = strings.TrimPrefix(finalPath, secureMountPoint)
// build.go:501