{"action":"created","issue":{"url":"https://api.github.com/repos/moby/moby/issues/36677","repository_url":"https://api.github.com/repos/moby/moby","labels_url":"https://api.github.com/repos/moby/moby/issues/36677/labels{/name}","comments_url":"https://api.github.com/repos/moby/moby/issues/36677/comments","events_url":"https://api.github.com/repos/moby/moby/issues/36677/events","html_url":"https://github.com/moby/moby/issues/36677","id":307936206,"number":36677,"title":"WORKDIR creates directories as root instead of USER","user":{"login":"Crazor","id":128295,"avatar_url":"https://avatars3.githubusercontent.com/u/128295?v=4","gravatar_id":"","url":"https://api.github.com/users/Crazor","html_url":"https://github.com/Crazor","followers_url":"https://api.github.com/users/Crazor/followers","following_url":"https://api.github.com/users/Crazor/following{/other_user}","gists_url":"https://api.github.com/users/Crazor/gists{/gist_id}","starred_url":"https://api.github.com/users/Crazor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Crazor/subscriptions","organizations_url":"https://api.github.com/users/Crazor/orgs","repos_url":"https://api.github.com/users/Crazor/repos","events_url":"https://api.github.com/users/Crazor/events{/privacy}","received_events_url":"https://api.github.com/users/Crazor/received_events","type":"User","site_admin":false},"labels":[{"id":73616520,"url":"https://api.github.com/repos/moby/moby/labels/area/builder","name":"area/builder","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-03-23T08:12:29Z","updated_at":"2018-03-23T10:40:06Z","closed_at":null,"author_association":"NONE","body":"**Description**\r\nIf I use USER to switch to a non-root user I added, directories created by WORKDIR are owned by root.\r\n\r\n**Steps to reproduce the issue:**\r\n```\r\ncat <<EOF > Dockerfile\r\nFROM alpine:latest\r\nRUN adduser -S someone\r\nUSER someone\r\nWORKDIR /test\r\nRUN touch file\r\nEOF\r\ndocker build .\r\n```\r\n\r\n**Describe the results you received:**\r\n```\r\nSending build context to Docker daemon  2.048kB\r\nStep 1/5 : FROM alpine:latest\r\n ---> 3fd9065eaf02\r\nStep 2/5 : RUN adduser -S someone\r\n ---> Running in d1b5335d7d2b\r\nRemoving intermediate container d1b5335d7d2b\r\n ---> 6331753145ea\r\nStep 3/5 : USER someone\r\n ---> Running in 6fc3e580f73f\r\nRemoving intermediate container 6fc3e580f73f\r\n ---> e287cc668fd4\r\nStep 4/5 : WORKDIR /test\r\nRemoving intermediate container a5d76637e175\r\n ---> ec5080edf02c\r\nStep 5/5 : RUN touch file\r\n ---> Running in 4d6f86d33ac9\r\ntouch: file: Permission denied\r\nThe command '/bin/sh -c touch file' returned a non-zero code: 1\r\n```\r\n\r\n**Describe the results you expected:**\r\nI would expect the WORKDIR command to create a directory owned by the current USER.\r\n\r\n**Output of `docker version`:**\r\n\r\n```\r\nClient:\r\n Version:       18.03.0-ce\r\n API version:   1.37\r\n Go version:    go1.9.4\r\n Git commit:    0520e24\r\n Built: Wed Mar 21 23:10:09 2018\r\n OS/Arch:       linux/amd64\r\n Experimental:  false\r\n Orchestrator:  swarm\r\n\r\nServer:\r\n Engine:\r\n  Version:      18.03.0-ce\r\n  API version:  1.37 (minimum version 1.12)\r\n  Go version:   go1.9.4\r\n  Git commit:   0520e24\r\n  Built:        Wed Mar 21 23:08:36 2018\r\n  OS/Arch:      linux/amd64\r\n  Experimental: true\r\n```\r\n\r\n**Output of `docker info`:**\r\n\r\n```\r\nContainers: 12                                                      \r\n Running: 0                                                         \r\n Paused: 0                                                          \r\n Stopped: 12                                                        \r\nImages: 9                                                           \r\nServer Version: 18.03.0-ce                                          \r\nStorage Driver: btrfs                                               \r\n Build Version: Btrfs v4.12                                         \r\n Library Version: 102                                               \r\nLogging Driver: json-file                                           \r\nCgroup Driver: cgroupfs                                             \r\nPlugins:                                                            \r\n Volume: local                                                      \r\n Network: bridge host ipvlan macvlan null overlay                   \r\n Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog                                                           \r\nSwarm: inactive                                                     \r\nRuntimes: runc                                                      \r\nDefault Runtime: runc                                               \r\nInit Binary: docker-init                                            \r\ncontainerd version: cfd04396dc68220d1cecbe686a6cc3aa5ce3667c        \r\nrunc version: 4fc53a81fb7c994640722ac585fa9ca548971871              \r\ninit version: 949e6fa                                               \r\nSecurity Options:                                                   \r\n apparmor                                                           \r\n seccomp                                                            \r\n  Profile: default                                                  \r\nKernel Version: 4.13.0-37-generic                                   \r\nOperating System: Ubuntu 17.10                                      \r\nOSType: linux                                                       \r\nArchitecture: x86_64                                                \r\nCPUs: 4                                                             \r\nTotal Memory: 15.37GiB                                              \r\nName: tachi                                                         \r\nID: RMAS:MPHW:4AUS:Q2OT:Y6JB:OAP4:A52N:DTDB:OBAX:KU2H:GBYP:HUIH     \r\nDocker Root Dir: /var/lib/docker                                    \r\nDebug Mode (client): false                                          \r\nDebug Mode (server): false                                          \r\nRegistry: https://index.docker.io/v1/                               \r\nLabels:                                                             \r\nExperimental: true                                                  \r\nInsecure Registries:                                                \r\n 127.0.0.0/8                                                        \r\nLive Restore Enabled: false                                         \r\n\r\nWARNING: No swap limit support\r\n```"},"comment":{"url":"https://api.github.com/repos/moby/moby/issues/comments/375618791","html_url":"https://github.com/moby/moby/issues/36677#issuecomment-375618791","issue_url":"https://api.github.com/repos/moby/moby/issues/36677","id":375618791,"user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars2.githubusercontent.com/u/1804568?v=4","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"created_at":"2018-03-23T10:40:06Z","updated_at":"2018-03-23T10:40:06Z","author_association":"MEMBER","body":"> WORKDIR is more readable than RUN mkdir test && chown user: test && cd test\r\n\r\nOnly the `mkdir test` step would be needed; after that, you can use `WORKDIR /test`\r\n\r\nI personally think that `WORKDIR` should not have automatically created directories; there's too much magic involved there, and there's many corner-cases where automatically changing ownership could  (e.g.; should `WORKDIR /foo/bar/baz` create all of `/foo`, `/foo/bar` and `/foo/bar/baz` with that owner, or only the last (`/baz`) directory? What if some of those directories already exist: should they be `chown`'d? What permissions should be set? `700`? `755` (and should it follow the `umask` that's set in the container, or use a fixed one, for constency? )\r\n\r\n\r\nThe problem at least is that we can't change the default behaviour of `WORKDIR`, because it would be a breaking change, and `WORKDIR --chown=myuser:mygroup /somedirectory` may not be much cleaner than `RUN mkdir /somedirectory`"}}
{"actor":{"display_login":"thaJeztah"}}