File capabilities (xattrs) are not preserved in final ROCK image layers.
Metadata
Current evaluation
File capabilities (xattrs) set via setcap during ROCK build are dropped in final image layers because Python tarfile does not preserve xattrs. Acknowledged by maintainer; a fix PR (#1016) is open but stalled with unresolved review comments and CI failures.
Suggested action: keep open
Reason: Maintainer @cjdcordeiro acknowledged the issue on 2024-08-27 and linked the original Matrix discussion. The bug is confirmed still present in rockcraft/layers.py which uses Python's tarfile module (no xattr support). PR #1016 explicitly targets this issue ('closes #683') but is stalled with 5 unresolved review comments and CI failures, so the issue should remain open until a fix is merged.
Impact:
45
Quick Win:
15.75
Staleness:
60
Complexity:
65
Confidence:
78
Support Request:
5
Issue body
### Bug Description
File capabilities set via xattrs on files during ROCK build time are not preserved in the final ROCK image.
There are numerous examples of OCI images which are run as a non-root user but require root-like capabilities like binding port numbers under 1024 with `cap_net_bind_service` (e.g: the [Nginx Ingress Controller image which runs as `www-data`](https://github.com/kubernetes/ingress-nginx/blob/controller-v1.11.0/rootfs/Dockerfile#L71-L80)).
### To Reproduce
Build the below-listed `rockcraft.yaml` sample and check the caps in the final file as follows:
```bash
cd /path/to/rockfile/dir
# Build and upload the rock:
rockcraft --verbose --debug pack
rockcraft.skopeo --insecure-policy copy oci-archive:caps-test-rock_v1.0.0_amd64.rock docker-daemon:caps-test-rock:v1.0.0
# NOTE: `-v` makes `setcap` check the given caps are present on the file:
docker run --entrypoint setcap caps-test-rock:v1.0.0 -v cap_net_bind_service=+ep /example.sh
# /example.sh differs in [pe]
# $? = 1
```
### Environment
Host: Ubuntu 22.04 on x86_64 VM on VMWare
Rockcraft: 1.5.3 installed via `snap`
Docker: 24.0.7-0ubuntu2~22.04.1 amd64 installed via `apt`
### rockcraft.yaml
```yaml
name: caps-test-rock
summary: Test image to showcase snap caps preservation issues.
description: Test image to showcase snap caps preservation issues.
version: v1.0.0
license: Apache-2.0
base: ubuntu@22.04
build-base: ubuntu@22.04
platforms:
amd64:
# arm64:
services:
sleep:
command: sleep inf
override: replace
startup: enabled
parts:
setup:
plugin: nil
build-packages:
- libcap2-bin
stage-packages:
- libcap2-bin
- coreutils
override-build: |
set -eux
echo -e "#!/bin/bash\necho Hello!" > $CRAFT_PART_INSTALL/example.sh
setcap cap_net_bind_service=+ep $CRAFT_PART_INSTALL/example.sh
# NOTE: `-v` makes `setcap` check the given caps are present on the file
# and will exit non-zero if it doesn't, so the caps are set during build:
setcap -v cap_net_bind_service=+ep $CRAFT_PART_INSTALL/example.sh
```
### Relevant log output
```shell
No relevant logs to share...
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
15.75
Staleness:
60
Complexity:
65
Confidence:
78
Support Request:
5
|
keep open | File capabilities (xattrs) set via setcap during ROCK build are dropped in final image layers because Python tarfile does not preserve xattrs. Acknowledged by maintainer; a fix PR (#1016) is open but stalled with unresolved review comments and CI failures. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
88
Complexity:
52
Confidence:
78
Support Request:
5
|
close stale | Bug report detailing that file capabilities (xattrs) set during ROCK build are lost in the final image. Acknowledged by a maintainer but inactive for ~2 years with no resolution. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
88
Complexity:
65
Confidence:
75
Support Request:
5
|
needs triage | File capabilities (xattrs) set during build are stripped from the final ROCK image. The report includes clear reproduction steps but has been inactive for nearly two years and lacks labels or assignee. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
65
Confidence:
75
Support Request:
5
|
keep open | File capabilities set during ROCK build are stripped in the final image. Reported ~19 months ago, acknowledged by a maintainer with a linked discussion, but lacks labels and further progress. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
40
Confidence:
80
Support Request:
10
|
close stale | File capabilities set via xattrs during ROCK builds are stripped from the final image, breaking non-root containers requiring root-like permissions. Open, under discussion, and linked to an external Matrix thread. Last updated over a year ago. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/rockcraft#1016
(confidence 90%)
Open PR 'fix: preserve xattrs in layers' that explicitly closes #683 via GNU tar approach; stalled ~10 months with 5 unresolved review comments and failing CI (fast tests, lint).
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1016 fix: preserve xattrs in layers | rockcraft | open | Prototype fix preserving file xattrs in ROCK image layers via GNU tar; closes #683. Review requested changes (5 unresolved comments), CI failing on fast tests and lint; inactive ~10 months since a maintainer asked for a different approach. |