Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

`docker context export` writes a truncated tar archive

Aberta Para iniciantes
  • Algo errado?
#7,332 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@2arian3 já está trabalhando nisso.

Desde 25/9/2026.

  • #7334 de @2arian3 — aberto
  • #7341 de @tayfuryldz — aberto

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
92/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
docker, go
Domínio
cli

Direção de pesquisa

Comece com Export() em cli/context/store/store.go e inspecione como o tar writer e o output writer são fechados. Execute os testes existentes em cli/context/store e, em seguida, verifique se um contexto exportado com arquivos TLS é um arquivo tar completo aceito pelo Python tarfile e pelo macOS tar.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Description

docker context export writes a truncated tar file. The two zero blocks that end a tar archive are never written, and when the context has TLS files, the padding after the last file is missing too.

docker context import still reads these files, because Go's archive/tar stops quietly at EOF. Other readers are stricter: with TLS files in the context, Python's tarfile rejects the export, and so does the macOS tar when reading it from a pipe (output below).

The cause is the order of these deferred calls in Export() in cli/context/store/store.go:

tw := tar.NewWriter(writer)
defer tw.Close()
defer writer.Close()

Deferred calls run last-in, first-out. So the pipe is closed first, and when tw.Close() then tries to write the padding and the trailer, it gets io.ErrClosedPipe. That error is ignored. The code hasn't changed since the context store was added in b34f340346f (2018).

Reproduce
$ openssl req -x509 -newkey rsa:2048 -nodes -keyout /dev/null -out ca.pem -days 1 -subj "/CN=example"
$ docker context create example --docker "host=tcp://127.0.0.1:2376,ca=$PWD/ca.pem"
example
Successfully created context "example"
$ docker context export example example.tar
Written file "example.tar"
$ wc -c < example.tar
3667

A tar file is always a multiple of 512 bytes, and 3667 isn't (the exact size depends on the certificate). The file stops 83 bytes into a block, right after the contents of tls/docker/ca.pem:

$ python3 -m tarfile -l example.tar
Traceback (most recent call last):
  ...
ReadError: unexpected end of data

$ docker context export example - | tar -tf - > /dev/null
tar: Truncated input file (needed 1536 bytes, only 1107 available)
tar: Error exit delayed from previous errors.
Expected behavior

A complete tar file: each file padded to a 512-byte boundary, then the end-of-archive marker. Other tar tools should be able to read the export too.

docker version
Client:
 Version:           29.8.0
 API version:       1.56
 Go version:        go1.26.8
 Git commit:        88096ef
 Built:             Thu Sep  3 21:49:43 2026
 OS/Arch:           darwin/amd64
 Context:           default

Server: Docker Desktop 4.91.0 (239619)
 Engine:
  Version:          29.8.0
  API version:      1.56 (minimum version 1.40)
  Go version:       go1.26.8
  Git commit:       3ce5872
  Built:            Thu Sep  3 21:51:20 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.3.4
  GitCommit:        db8809540e1a7a9da5d518876894933ff55692ab
 runc:
  Version:          1.4.3
  GitCommit:        v1.4.3-0-gbb14dabe
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
docker info
N/A, the daemon isn't involved. This happens in the CLI's context store (cli/context/store).
Additional Info

Same result with the CLI built from master (7fc2dff9bc).

Without TLS files the archive happens to end on a block boundary, and the readers above accept it. The end-of-archive marker is still missing, though.

Closing the tar writer before the pipe fixes it. With this change, the export from the steps above is a complete archive that both readers accept, and the existing tests in cli/context/store still pass:

tw := tar.NewWriter(writer)
defer func() {
	// Close the tar writer first, so that the padding and the
	// end-of-archive marker are written before the pipe is closed.
	writer.CloseWithError(tw.Close())
}()

Happy to open a PR for this.

Linguagem predominante
Go
Estrelas
6.1k
Forks
2.2k
Merge médio
16h 27min
PRs com merge (30d)
37

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de docker/cli

Todas as issues de docker/cli

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.