bug: run umoci in --rootless mode
Metadata
Current evaluation
umoci unpack fails for non-root users in destructive mode; extract_to supports --rootless but image service doesn't use it
Suggested action: keep open
Reason: Valid bug: `rockcraft/services/image.py:94` calls `extract_to(bundle_dir)` without passing `rootless=True`, even though `oci.py:199-213` already supports the `--rootless` flag. The fix is straightforward — detect destructive mode and pass `rootless=True`. Confidence is high based on code inspection confirming the parameter exists but is unused in the image service.
Evaluated by: mr-cal-bot
Impact:
70
Quick Win:
45
Complexity:
20
Confidence:
85
Actionability:
80
Issue body
https://github.com/canonical/rockcraft/blob/041e31375a27af9ac74ff31625076f5bdd68c469/rockcraft/oci.py#L185
This is not a problem for lxc-based builds, but when running Rockcraft with a nonroot user and with `--destructive-mode`, the following will happen:
> Failed to copy image: Command '['/snap/rockcraft/1907/bin/umoci', 'unpack', '--image', '/home/ubuntu/images/ubuntu:22.04', '/home/ubuntu/bundles/ubuntu-22.04']' returned non-zero exit status 1. (• umoci encountered a permission error: maybe --rootless will help?
> ⨯ create runtime bundle: unpack rootfs: chown rootfs: lchown /home/ubuntu/bundles/ubuntu-22.04/rootfs: operation not permitted)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b |
Impact:
70
Quick Win:
45
Complexity:
20
Confidence:
85
Actionability:
80
|
keep open | umoci unpack fails for non-root users in destructive mode; extract_to supports --rootless but image service doesn't use it | |
| stealth/space-bunny-alpha |
Impact:
55
Quick Win:
23
Complexity:
40
Confidence:
85
Actionability:
70
|
keep open | Non-root `rockcraft pack --destructive-mode` fails because umoci unpack is called without --rootless (rockcraft/services/image.py:94). The rootless kwarg already exists on oci.Image.extract_to but is unused in production code; still unfixed. | |
| qwen/qwen3.6-35b-a3b |
Impact:
70
Quick Win:
57
Complexity:
10
Confidence:
90
Actionability:
90
|
keep open | Bug: Rockcraft fails in destructive mode for non-root users because umoci unpack is not called with --rootless, despite the code supporting it. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
29
Staleness:
80
Complexity:
35
Confidence:
75
Support Request:
10
|
needs triage | umoci unpack fails with permission error when Rockcraft runs as nonroot user with --destructive-mode; extract_to() has a rootless param but image.py never passes it, so the bug persists in current code | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
20
Confidence:
90
Support Request:
10
|
needs triage | Rockcraft fails with permission errors when running umoci as a non-root user in destructive mode. Suggests adding the --rootless flag to the umoci command. No maintainer response or activity for over two years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
20
Confidence:
85
Support Request:
10
|
close stale | Non-root user running Rockcraft in destructive mode fails when unpacking OCI images with umoci due to permission errors. Suggests adding --rootless flag. No maintainer response or activity for over two years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
20
Confidence:
85
Support Request:
10
|
needs triage | Rockcraft fails when run as non-root in destructive mode because umoci lacks permission to chown rootfs. Suggests adding --rootless flag to umoci. Unaddressed for over two years. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.