You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
File capabilities set via xattrs on files during ROCK build time are not preserved in the final ROCK image.
There are numerous examples of OCI images which are run as a non-root user but require root-like capabilities like binding port numbers under 1024 with cap_net_bind_service (e.g: the Nginx Ingress Controller image which runs as www-data).
To Reproduce
Build the below-listed rockcraft.yaml sample and check the caps in the final file as follows:
cd /path/to/rockfile/dir
# Build and upload the rock:
rockcraft --verbose --debug pack
rockcraft.skopeo --insecure-policy copy oci-archive:caps-test-rock_v1.0.0_amd64.rock docker-daemon:caps-test-rock:v1.0.0
# NOTE: `-v` makes `setcap` check the given caps are present on the file:
docker run --entrypoint setcap caps-test-rock:v1.0.0 -v cap_net_bind_service=+ep /example.sh
# /example.sh differs in [pe]# $? = 1
Environment
Host: Ubuntu 22.04 on x86_64 VM on VMWare
Rockcraft: 1.5.3 installed via snap
Docker: 24.0.7-0ubuntu2~22.04.1 amd64 installed via apt
rockcraft.yaml
name: caps-test-rocksummary: Test image to showcase snap caps preservation issues.description: Test image to showcase snap caps preservation issues.version: v1.0.0license: Apache-2.0base: [email protected]build-base: [email protected]platforms:
amd64:
# arm64:services:
sleep:
command: sleep infoverride: replacestartup: enabledparts:
setup:
plugin: nilbuild-packages:
- libcap2-binstage-packages:
- libcap2-bin
- coreutilsoverride-build: | set -eux echo -e "#!/bin/bash\necho Hello!" > $CRAFT_PART_INSTALL/example.sh setcap cap_net_bind_service=+ep $CRAFT_PART_INSTALL/example.sh # NOTE: `-v` makes `setcap` check the given caps are present on the file # and will exit non-zero if it doesn't, so the caps are set during build: setcap -v cap_net_bind_service=+ep $CRAFT_PART_INSTALL/example.sh
Relevant log output
No relevant logs to share...
The text was updated successfully, but these errors were encountered:
Bug Description
File capabilities set via xattrs on files during ROCK build time are not preserved in the final ROCK image.
There are numerous examples of OCI images which are run as a non-root user but require root-like capabilities like binding port numbers under 1024 with
cap_net_bind_service
(e.g: the Nginx Ingress Controller image which runs aswww-data
).To Reproduce
Build the below-listed
rockcraft.yaml
sample and check the caps in the final file as follows:Environment
Host: Ubuntu 22.04 on x86_64 VM on VMWare
Rockcraft: 1.5.3 installed via
snap
Docker: 24.0.7-0ubuntu2~22.04.1 amd64 installed via
apt
rockcraft.yaml
Relevant log output
The text was updated successfully, but these errors were encountered: