Bug 1307049 - Docker's ADD can't handle a local tar archive with file capabilities in xattr
Docker's ADD can't handle a local tar archive with file capabilities in xattr
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: docker (Show other bugs)
7.2
x86_64 Linux
unspecified Severity medium
: rc
: ---
Assigned To: Antonio Murdaca
atomic-bugs@redhat.com
: Extras
: 1307047 1307051 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-12 09:57 EST by Jim Perrin
Modified: 2016-08-21 06:19 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-08-21 06:19:33 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jim Perrin 2016-02-12 09:57:52 EST
Description of problem:
Building a base container from scratch with a tar archive fails if the archive contains file capabilities.

Version-Release number of selected component (if applicable):
docker-1.8.2-10

How reproducible:
Always

Steps to Reproduce:
1. Create a base disk image with livemedia-creator

example commands used are available on github: 
https://github.com/CentOS/sig-cloud-instance-build/tree/livemedia_builds/docker

2. Create a container from the resulting tarball via a very basic Dockerfile. Something like the following:

=====
FROM scratch
MAINTAINER me
ADD centos-img.tar.xz /
=====

docker run --rm -t centostest .

3. run the container and observe that the capabilities are stripped from the iputils package. 

[root@73ba9b203c2b /]# rpm -V iputils
........P    /usr/bin/ping
........P    /usr/bin/ping6
........P    /usr/sbin/arping
........P    /usr/sbin/clockdiff


4. Create the archive with tar directly:

kpartx -a /var/tmp/centos-7-root
mount /dev/mapper/loop0p1 /mnt

tar -C /mnt/ -jcf centos-img.tar.bz2 .

Build docker container using this tarball, just as above. 

Same output from running rpm -V iputils in this container.

[root@92bca8435dd8 /]# rpm -V iputils
........P    /usr/bin/ping
........P    /usr/bin/ping6
........P    /usr/sbin/arping
........P    /usr/sbin/clockdiff


5. Create archive with --xattr, to maintain file capabilities

tar --xattrs -C /mnt/ -jcf centos-img.tar.bz2 .

Build docker container using this tarball:


Note that the resulting container is only slightly larger than the tarball itself. 

6. Examine the contents of the docker container:

docker create --name wtf c7build

[root@lappy ~]# docker export wtf | tar -t
.dockerenv
.dockerinit
centos-img.tar.bz2
dev/
dev/console
dev/pts/
dev/shm/
etc/
etc/hostname
etc/hosts
etc/mtab
etc/resolv.conf
lib64
proc/
sys/


Docker's for some reason not extracted this archive, but instead stuffed it inside the container which won't work. 

Validate that the capabilities are intact by importing the tar archive directly

cat centos-img.tar.bz2 | docker import - capvalidate

docker run --rm -it capvalidate /bin/bash
[root@cf2021d70a42 /]# rpm -V iputils
[root@cf2021d70a42 /]#



Actual results:
containers including files with capabilities (like ping) don't get unpacked via an ADD in a dockerfile

Expected results:
ADD unpacks the tarball and a base container is happily created.
Comment 2 Daniel Walsh 2016-02-12 11:05:02 EST
This looks like golang's tar which is what docker uses I believe does not support xattrs.
Comment 3 Daniel Walsh 2016-02-12 11:12:05 EST
*** Bug 1307051 has been marked as a duplicate of this bug. ***
Comment 4 Daniel Walsh 2016-02-12 11:13:11 EST
*** Bug 1307047 has been marked as a duplicate of this bug. ***
Comment 5 Vincent Batts 2016-02-12 14:39:36 EST
surely it does. Alexl added that support.
https://golang.org/pkg/archive/tar/#Header
Comment 6 Daniel Walsh 2016-02-22 14:25:12 EST
Antonio have you been working on this?
Comment 7 Antonio Murdaca 2016-08-20 14:46:09 EDT
Fixed in docker-1.10

Note You need to log in before you can comment on or make changes to this bug.