Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Container audit loses the repository identity: git refuses the mounted repo (dubious ownership)

Aperta
  • Qualcosa non va?
#586 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
52/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, git, python
Ambito
backend, devops

Direzione di ricerca

Start with the container setup in the image built from the #519 branch and docs/install/container.md; reproduce the documented docker run command and check how the audit obtains the mounted repository’s Git remote as uid 10001. Compare the confirmed safe.directory=/repo workaround with running as the host uid, and review the ownership implications before choosing a fix. Done means the documented container command identifies the repository and platform checks use its owner and name.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs triage

With the documented command, docker run --rm -v "$PWD:/repo" <image> audit, on Linux:

Platform API call /repos//repo/releases?per_page=5 could not be measured (unavailable)
handler github_branch_protection needs owner/repo (from context or config)
Trust: unknown repository untrusted (no repository identity)

The owner is empty and the name is the mount directory (repo), so every platform check fails.

The cause is the container runs as uid 10001. The mounted repository belongs to the host user. git refuses it:

$ git -C /repo remote get-url origin
fatal: detected dubious ownership in repository at '/repo'

Confirmed workaround

docker run --rm -v "$PWD:/repo" \
  -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0=/repo \
  <image> audit

With this, git returns the remote and the audit calls /repos/darnitdevorg/darnit/....

Possible fix

Set safe.directory=/repo in the image (Dockerfile ENV or the entrypoint). This turns off git's ownership check for the mounted repo, so it is worth a short look at what a hostile .git/config could do inside the container. The alternative is to document --user "$(id -u):$(id -g)", which I have not tested.

Related

  • #579 stops the /repos//name call when the identity is empty. It does not give the container the identity.
  • docs/install/container.md does not say that platform checks need -e GH_TOKEN.

Seen on RHEL 10 with podman (rootful), image built from the #519 branch.

Lingua principale
Python
Stelle
22
Fork
27
Merge medio
2g 28m
PR unite (30g)
40

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di darnitdevorg/darnit

Tutte le issue di darnitdevorg/darnit

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.