File capabilities (xattrs) are not preserved in final ROCK image layers.
Metadata
Current evaluation
Maintainer-acknowledged bug with a complete reproducer: security.capability xattrs on primed files are lost when ROCK image layers are packaged
Suggested action: keep open
Reason: The report provides complete rockcraft.yaml configuration, confirms the capability with `setcap -v` before packaging, and demonstrates that it differs afterward; @cjdcordeiro acknowledged the report. No resolving change is identified, and preserving security xattrs may require changes across layer serialization and integration coverage.
Evaluated by: mr-cal-bot
Impact:
58
Quick Win:
17
Complexity:
68
Confidence:
82
Actionability:
90
Issue body
### Bug Description
File capabilities set via xattrs on files during ROCK build time are not preserved in the final ROCK image.
There are numerous examples of OCI images which are run as a non-root user but require root-like capabilities like binding port numbers under 1024 with `cap_net_bind_service` (e.g: the [Nginx Ingress Controller image which runs as `www-data`](https://github.com/kubernetes/ingress-nginx/blob/controller-v1.11.0/rootfs/Dockerfile#L71-L80)).
### To Reproduce
Build the below-listed `rockcraft.yaml` sample and check the caps in the final file as follows:
```bash
cd /path/to/rockfile/dir
# Build and upload the rock:
rockcraft --verbose --debug pack
rockcraft.skopeo --insecure-policy copy oci-archive:caps-test-rock_v1.0.0_amd64.rock docker-daemon:caps-test-rock:v1.0.0
# NOTE: `-v` makes `setcap` check the given caps are present on the file:
docker run --entrypoint setcap caps-test-rock:v1.0.0 -v cap_net_bind_service=+ep /example.sh
# /example.sh differs in [pe]
# $? = 1
```
### Environment
Host: Ubuntu 22.04 on x86_64 VM on VMWare
Rockcraft: 1.5.3 installed via `snap`
Docker: 24.0.7-0ubuntu2~22.04.1 amd64 installed via `apt`
### rockcraft.yaml
```yaml
name: caps-test-rock
summary: Test image to showcase snap caps preservation issues.
description: Test image to showcase snap caps preservation issues.
version: v1.0.0
license: Apache-2.0
base: ubuntu@22.04
build-base: ubuntu@22.04
platforms:
amd64:
# arm64:
services:
sleep:
command: sleep inf
override: replace
startup: enabled
parts:
setup:
plugin: nil
build-packages:
- libcap2-bin
stage-packages:
- libcap2-bin
- coreutils
override-build: |
set -eux
echo -e "#!/bin/bash\necho Hello!" > $CRAFT_PART_INSTALL/example.sh
setcap cap_net_bind_service=+ep $CRAFT_PART_INSTALL/example.sh
# NOTE: `-v` makes `setcap` check the given caps are present on the file
# and will exit non-zero if it doesn't, so the caps are set during build:
setcap -v cap_net_bind_service=+ep $CRAFT_PART_INSTALL/example.sh
```
### Relevant log output
```shell
No relevant logs to share...
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
58
Quick Win:
17
Complexity:
68
Confidence:
82
Actionability:
90
|
keep open | Maintainer-acknowledged bug with a complete reproducer: security.capability xattrs on primed files are lost when ROCK image layers are packaged | |
| qwen/qwen3.6-35b-a3b |
Impact:
60
Quick Win:
25
Complexity:
45
Confidence:
70
Actionability:
75
|
keep open | File capabilities (xattrs) set during ROCK build are lost in the final image. Valid bug with clear reproducer; related PR #1016 exists but remains open with unresolved review comments. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
16
Staleness:
60
Complexity:
65
Confidence:
78
Support Request:
5
|
keep open | File capabilities (xattrs) set via setcap during ROCK build are dropped in final image layers because Python tarfile does not preserve xattrs. Acknowledged by maintainer; a fix PR (#1016) is open but stalled with unresolved review comments and CI failures. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
88
Complexity:
52
Confidence:
78
Support Request:
5
|
close stale | Bug report detailing that file capabilities (xattrs) set during ROCK build are lost in the final image. Acknowledged by a maintainer but inactive for ~2 years with no resolution. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
88
Complexity:
65
Confidence:
75
Support Request:
5
|
needs triage | File capabilities (xattrs) set during build are stripped from the final ROCK image. The report includes clear reproduction steps but has been inactive for nearly two years and lacks labels or assignee. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
65
Confidence:
75
Support Request:
5
|
keep open | File capabilities set during ROCK build are stripped in the final image. Reported ~19 months ago, acknowledged by a maintainer with a linked discussion, but lacks labels and further progress. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1016 fix: preserve xattrs in layers | rockcraft | open | Prototype fix preserving xattrs in ROCK layers by using GNU tar instead of Python tarfile (closes #683). Changes requested with 5 unresolved comments; lint, fast tests and snap-tests failing; no author activity in 324 days. |