Skip to content

diffapply: do chown before xattrs#3671

Merged
sipsma merged 2 commits intomoby:masterfrom
sipsma:fix-merge-file-caps
Feb 24, 2023
Merged

diffapply: do chown before xattrs#3671
sipsma merged 2 commits intomoby:masterfrom
sipsma:fix-merge-file-caps

Conversation

@sipsma
Copy link
Copy Markdown
Collaborator

@sipsma sipsma commented Feb 24, 2023

Chown will result file capabilities getting reset, so it should be done
before setting xattrs to ensure they are retained.

Signed-off-by: Erik Sipsma erik@sipsma.dev

The included test failed before only on the snapshotter w/ disable hardlinking. Passes after the new fix.

Signed-off-by: Erik Sipsma <erik@sipsma.dev>
Chown will result file capabilities getting reset, so it should be done
before setting xattrs to ensure they are retained.

Signed-off-by: Erik Sipsma <erik@sipsma.dev>
@sipsma sipsma requested a review from tonistiigi February 24, 2023 23:18
@sipsma sipsma merged commit db6342f into moby:master Feb 24, 2023
@thaJeztah
Copy link
Copy Markdown
Member

Does this fix the issue reported in moby 23.0? or are changes needed on the moby side for that? (does this one need cherry-pick?)

@sipsma
Copy link
Copy Markdown
Collaborator Author

sipsma commented Feb 28, 2023

@thaJeztah The moby issue was a combination of two orthogonal problems:

  1. Merged snapshots on disk didn't preserve file capabilities (this was true in both vanilla buildkit and moby-flavored buildkit)
  2. Images exported from merged snapshots were incorrectly flattened into a single layer derived directly from the merged snapshot (this was only a problem in moby, not vanilla buildkit)

The PR here fixes 1 but not 2. 2 needs to be fixed in moby.

I think 1 on it's own is pretty obscure since it only affected local snapshots, not exported container images (it's only in combination w/ 2 that it's much worse). So I'll defer to @tonistiigi on whether we should backport this or not. It shouldn't be hard if desired.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants