File permissions/ownership not preserved
Metadata
Current evaluation
File ownership was restored by preserving directory metadata when adding OCI layers in PR #55, commit 2b13004b.
Resolution: closed resolved
Reason: PR #55 merged commit 2b13004b (“oci: preserve directories when adding layers”), directly addressing the metadata loss caused by directory entries added to OCI layers.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Hey :wave:
I've been building a ROCK for Traefik. I want to include a config file and have it owned by a specific user. Take the following excerpt as an example (full file [here](https://github.com/jnsgruk/traefik-rock/blob/2.8.1/rockcraft.yaml)):
```yaml
default-config:
plugin: dump
source: files
organize:
traefik.yaml: etc/traefik/traefik.yaml
001-default.yaml: var/lib/pebble/default/layers/001-default.yaml
stage:
- etc/traefik/traefik.yaml
- var/lib/pebble/default/layers/001-default.yaml
override-prime: |
craftctl default
ls -l etc/
chown -R 1000:1000 etc/traefik
ls -l etc/
non-root-user:
plugin: nil
after: [default-config]
overlay-script: |
# Create a user in the $CRAFT_OVERLAY chroot
useradd -R $CRAFT_OVERLAY -M -r -u 1000 -U traefik
```
I've added the `ls -l` as an example - the first shows the following:
```# bash
# ...
2022-07-12 07:50:57.423 :: -rw-r----- 3 root shadow 523 Jul 12 07:48 shadow
2022-07-12 07:50:57.423 :: -rw-r----- 3 root shadow 501 May 31 15:43 shadow-
2022-07-12 07:50:57.423 :: drwxr-xr-x 1 root root 24 Jul 12 07:50 traefik
```
The second then shows that the `chown` is working as expected:
```bash
# ...
2022-07-12 07:50:57.426 :: -rw-r----- 3 root shadow 523 Jul 12 07:48 shadow
2022-07-12 07:50:57.426 :: -rw-r----- 3 root shadow 501 May 31 15:43 shadow-
2022-07-12 07:50:57.426 :: drwxr-xr-x 1 1000 1000 24 Jul 12 07:50 traefik
```
However, when the image is built, if I get a shell and list the directory:
```bash
❯ docker run --rm --entrypoint pebble --entrypoint /bin/bash -it traefik:2.8.1
root@ea2f942c09f4:/# ls -l /etc | grep trae
drw------- 1 root root 24 Jul 12 07:49 traefik
root@ea2f942c09f4:/#
```
I also attempted to `chown` the directory in the `non-root-user` stage after I'd created the user (within the chroot), but it can't see the `/etc/traefik` directory created in the previous stage from within the `chroot`.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | File ownership was restored by preserving directory metadata when adding OCI layers in PR #55, commit 2b13004b. | |
| stealth/space-bunny-alpha | — | closed stale | File ownership was lost because Rockcraft added empty overlay directories to OCI layers without preserved metadata; the issue was closed without a fix or superseding reference. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed. A maintainer identified the root cause as permission stripping during OCI image assembly at rockcraft/oci.py. The issue was closed without a direct fix, pointing to the underlying image layer handling logic as the source of the ownership loss. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed. Root cause identified in rockcraft/oci.py where OCI image assembly strips file ownership changes applied during override-prime. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed after a maintainer identified the root cause in rockcraft/oci.py, where OCI layer processing stripped ownership metadata. The bug was fixed to preserve file permissions in the final image. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed after a maintainer pinpointed the bug in rockcraft/oci.py line 306, where OCI layer processing stripped file ownership during image construction. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/rockcraft#55
(confidence 99%)
Commit 2b13004b preserves directory entries and metadata while adding OCI layers.
Related issues
No related issues found above the similarity threshold.