{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/image-tools/issues/3","repository_url":"https://api.github.com/repos/opencontainers/image-tools","labels_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3/comments","events_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3/events","html_url":"https://github.com/opencontainers/image-tools/pull/3","id":177236228,"number":3,"title":"Apply ownership in unpacked entries","user":{"login":"glestaris","id":1753414,"avatar_url":"https://avatars.githubusercontent.com/u/1753414?v=3","gravatar_id":"","url":"https://api.github.com/users/glestaris","html_url":"https://github.com/glestaris","followers_url":"https://api.github.com/users/glestaris/followers","following_url":"https://api.github.com/users/glestaris/following{/other_user}","gists_url":"https://api.github.com/users/glestaris/gists{/gist_id}","starred_url":"https://api.github.com/users/glestaris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glestaris/subscriptions","organizations_url":"https://api.github.com/users/glestaris/orgs","repos_url":"https://api.github.com/users/glestaris/repos","events_url":"https://api.github.com/users/glestaris/events{/privacy}","received_events_url":"https://api.github.com/users/glestaris/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":39,"created_at":"2016-09-15T17:24:52Z","updated_at":"2016-10-03T21:37:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/opencontainers/image-tools/pulls/3","html_url":"https://github.com/opencontainers/image-tools/pull/3","diff_url":"https://github.com/opencontainers/image-tools/pull/3.diff","patch_url":"https://github.com/opencontainers/image-tools/pull/3.patch"},"body":"This patch will apply the user/group, found in the tar entry, to the unpacked\r\nfiles, directories, and symlinks. It will only do so if the user running the\r\n`oci-unpack` tool is root.\r\n\r\nTo test the patch, I used latest Ubuntu from Dockerhub, converted to OCI\r\nformat with `skopeo`:\r\n\r\n```bash\r\nskopeo copy docker://ubuntu oci://$PWD/ubuntu\r\n```\r\n\r\nWith the current `oci-unpack`, all files and directories are owned by the user\r\nthat does the unpacking:\r\n\r\n```bash\r\nroot@vagrant:/tmp# ls -la ubuntu-unpacked-old/etc/shadow\r\n-rw-r----- 1 root root 652 Sep 15 17:17 ubuntu-unpacked-old/etc/shadow\r\n```\r\n\r\nWith the proposed patch, the correct ownership is applied:\r\n\r\n```bash\r\nroot@vagrant:/tmp# ls -la ubuntu-unpacked/etc/shadow\r\n-rw-r----- 1 root shadow 652 Sep 15 17:14 ubuntu-unpacked/etc/shadow\r\n```"},"comment":{"url":"https://api.github.com/repos/opencontainers/image-tools/issues/comments/251234916","html_url":"https://github.com/opencontainers/image-tools/pull/3#issuecomment-251234916","issue_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3","id":251234916,"user":{"login":"glestaris","id":1753414,"avatar_url":"https://avatars.githubusercontent.com/u/1753414?v=3","gravatar_id":"","url":"https://api.github.com/users/glestaris","html_url":"https://github.com/glestaris","followers_url":"https://api.github.com/users/glestaris/followers","following_url":"https://api.github.com/users/glestaris/following{/other_user}","gists_url":"https://api.github.com/users/glestaris/gists{/gist_id}","starred_url":"https://api.github.com/users/glestaris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glestaris/subscriptions","organizations_url":"https://api.github.com/users/glestaris/orgs","repos_url":"https://api.github.com/users/glestaris/repos","events_url":"https://api.github.com/users/glestaris/events{/privacy}","received_events_url":"https://api.github.com/users/glestaris/received_events","type":"User","site_admin":false},"created_at":"2016-10-03T21:37:53Z","updated_at":"2016-10-03T21:37:53Z","body":"There are two cases in what @cyphar asks:\r\n\r\n1. User namespace with multiple mappings: the UID/GIDs defined in the tar-ball need to be translated accordingly.\r\n1. User namespace with single mapping created by unprivileged user X): in this case simply running `oci-unpack` *outside** of that user namespace as user X will do. This is closer to what @wking describes as flattening the multi-user tar-ball to single-user I believe.\r\n\r\nThis PR does not introduce mappings but rather a logic fix since today ownership is not handled at all. I am happy to continue down the path of UID/GID mappings if we think that it could be within the scope of `oci-unpack`. I am generally keen to push translation logic into `oci-unpack`."}}
{"actor":{"display_login":"glestaris"}}