chmod 1777 has surprising behaviour
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 32/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- docker, php
- Domain
- infrastructure, operating-systems
Research direction
Reproduce the behavior from the issue's Dockerfile and podman commands, then inspect the linked PHP image change and the protected_symlinks documentation. Check the /var/log/apache2 symlink scenario described in the report. Done requires identifying the cause and agreeing on a safe, specific change or documentation outcome.
Written by the indexing model from the issue text.
Description
The following cost me hours of debugging. It's a side effect of https://github.com/docker-library/php/pull/1383 plus https://sysctl-explorer.net/fs/protected_symlinks/ .
Dockerfile:
FROM php:8.1-apache
RUN mkdir /tmp/files
RUN ln -s /tmp/files myfiles
Commands:
$ podman build -t symtest -f Dockerfile .
$ podman run --userns=keep-id --rm --name symtest-container -it symtest bash
podman is basically the same as docker; --userns=keep-id just makes it so everything runs as the user running the command in the container, so in this case I was running with UID 1086.
In the container:
rlpowell@85b62d863dde:~$ ls -l myfiles
lrwxrwxrwx. 1 root root 10 Dec 13 20:16 myfiles -> /tmp/files
rlpowell@85b62d863dde:~$ ls -l /tmp/files/
total 0
rlpowell@85b62d863dde:~$ ls -l myfiles/
ls: cannot access 'myfiles/': Permission denied
I discovered this because https://github.com/wikimedia/mediawiki-docker has symlinks from /var/log/apache2/error.log to /dev/stderr (and a few other similar ones) that with this php docker image change, cause apache to fail to run if the running UID is not the same as whatever the default for www-data is (33 I think?) because /var/log/apache2 is 1777 and own by that ID.
I don't have any particular suggestions for how to solve this because I'm not sure what problem you were trying to solve by making this change in the first place.
- Dominant language
- Dockerfile
- Stars
- 4k
- Forks
- 2k
- Avg merge
- 5d 21h
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/php
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
docker-library/php#1674 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
docker-library/php#1680 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
docker-library/php#1675 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
docker-library/php#1673 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 38/100
docker-library/php#1631 · 9 comments · 6 reactions ·
All issues in docker-library/php
Similar issues
-
kind/bug needs-triage
Difficulty 1/5 Under an hour Newbie friendliness 72/100
matrixorigin/matrixone#29223 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·
-
bug ci-failure high priority
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
vllm-project/vllm-omni#7972 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
simonw/sqlite-utils#872 ·
-
bug good first issue
Difficulty 1/5 Under an hour Newbie friendliness 88/100
amponce/archive-movie-browser#166 ·