Describe your changes. --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/rockcraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [x] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes. Fixes #1170. `/var/lib/pebble/default` is intentionally world-writable so that Pebble can create its socket and state files when a rock uses a non-root `run-user`. However, mode `0777` allows users to remove or rename entries owned by other users and is reported by insecure world-writable-directory checks. Set the directory mode to `01777`, preserving non-root write access while protecting directory entries with the sticky bit. The mode is updated in both paths that create the directory: - the implicit Pebble part, including rocks without services or checks; - the layer generated when services or checks are present. Tests now verify the complete mode with `stat.S_IMODE` instead of inspecting only the final three octal digits. Spread coverage checks the resulting image both with and without a generated Pebble layer, while retaining the existing non-root file-creation check. After this is released, affected base images must be rebuilt and republished; the change cannot alter permissions in already-published OCI layers.