Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

[Bug]: copyFileToContainer retention of uid/gid breaks rootless Docker

Aberta
  • Algo errado?
#11,487 2 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 2 dias

@Gautam-aman já está trabalhando nisso.

Desde 16/7/2026.

  • #11488 de @ym0506 — fechado sem integrar
  • #11929 de @Gautam-aman — aberto

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
48/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Pouca atividade
Stack de tecnologia
docker, java
Domínio
devops, testing-qa

Direção de pesquisa

Comece com container_copy_common.go e o caminho copyFileToContainer mencionado no relatório e, em seguida, reproduza a cópia do arquivo com rootless Docker usando os detalhes de propriedade e permissões fornecidos. Rastreie onde o UID/GID do host é aplicado e adicione cobertura para o comportamento solicitado; considera-se concluído quando os arquivos copiados puderem ser usados pelo container sem a falha de permissão do rootless.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

type/bug
Module

Core

Testcontainers version

1.21.3

Using the latest Testcontainers version?

Yes

Host OS

OpenSuse

Host Arch

x86

Docker version
Docker version 28.5.1-ce
What happened?

Trying to solve this issue in keycloak dev container https://github.com/quarkusio/quarkus/issues/45940
I have found, that copyFileToContainer function sets owner of the copied file to the user id, which are not exists inside container
in my case it was:
-rw-r--r--. 1 439803918 439800513 1201 Feb 4 14:24 upconfig.json

Debugging through Test container source code I have found in container_copy_common.go following commentary:
// We optimistically chown to the host user. In case of a hypothetical
// container-to-container copy, the reading side will chown back to the
// container user.

There is no way to override this behavior, even if function is called without permission mask, file owner will be changed to host owner user id, which is not exist inside container.

This permission change accidentally works in rootfull docker , because as root you can set owner even if this owner does not exists, but does not work in rootless docker, because unprivileged user could not set owner to not existed user, leading to the described "Keycloak Dev Service fails to start on rootless Docker setup"

Unfortunately we was not able to find any workaround ad need this hard coded chown could be disabled in this function.

Relevant log output
Keycloak Devservice fails to start with rootless docker with following error log.

    2025-01-29 09:09:18,785 INFO [tc.qua.io/.0.6] (build-23) Creating container for image: quay.io/keycloak/keycloak:25.0.6
    2025-01-29 09:09:18,794 INFO [tc.tes.11.0] (build-23) Creating container for image: testcontainers/ryuk:0.11.0
    2025-01-29 09:09:18,866 INFO [tc.tes.11.0] (build-23) Container testcontainers/ryuk:0.11.0 is starting: 721e3e87dd739f95f37021e640a42046a74833cc1bf8a3507cc7916814c5163d
    2025-01-29 09:09:19,109 INFO [tc.tes.11.0] (build-23) Container testcontainers/ryuk:0.11.0 started in PT0.314788777S
    <====2025-01-29 09:09:19,151 INFO [tc.qua.io/.0.6] (build-23) Container quay.io/keycloak/keycloak:25.0.6 is starting: c25e849df4aa9d8c18ab05109bb46990bf18f961a50cad35247e10948dc428f6
    <====2025-01-29 09:09:20,007 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Changes detected in configuration. Updating the server image.
    <====2025-01-29 09:09:20,023 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Updating the configuration and installing your custom providers, if any. Please wait.
    <====2025-01-29 09:09:25,079 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: 2025-01-29 08:09:25,078 INFO [io.qua.dep.QuarkusAugmentor] (main) Quarkus augmentation completed in 4490msEXECUTING [10s]
    2025-01-29 09:09:25,091 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Server configuration updated and persisted. Run the following command to review the configuration:
    2025-01-29 09:09:25,091 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:25,091 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: kc.sh show-config
    2025-01-29 09:09:25,092 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: Next time you run the server, just run:
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: kc.sh start --http-enabled=true --hostname-strict=false --spi-user-profile-declarative-user-profile-config-file=/opt/keycloak/upconfig.json --optimized
    2025-01-29 09:09:25,093 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak:
    2025-01-29 09:09:26,144 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: Unexpected error when starting the server in (production) mode
    2025-01-29 09:09:26,144 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: Failed to start quarkus
    2025-01-29 09:09:26,144 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: Failed to reaad default user profile configuration: /opt/keycloak/upconfig.json
    2025-01-29 09:09:26,145 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: ERROR: /opt/keycloak/upconfig.json (Permission denied)
    2025-01-29 09:09:26,145 INFO [io.qua.dev.key.KeycloakDevServicesProcessor] (docker-java-stream--1719331462) Keycloak: For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.

It seems like the file permission of upconfig.json are not correct when copying the file to the container KeycloakDevServicesProcessor

    drwxr-xr-x 1 keycloak root 4.0K Jan 29 08:10 .
    drwxr-xr-x 1 root root 4.0K Sep 19 17:57 ..
    drwxrwxr-x 3 keycloak root 4.0K Sep 19 17:53 bin
    drwxrwxr-x 3 keycloak root 4.0K Sep 19 17:57 conf
    drwxrwxr-x 2 keycloak root 4.0K Sep 19 17:57 data
    drwxrwxr-x 1 keycloak root 4.0K Sep 19 17:53 lib
    -rw-rw-r-- 1 keycloak root 12K Sep 19 17:43 LICENSE.txt
    drwxrwxr-x 2 keycloak root 4.0K Sep 19 17:57 providers
    -rw-rw-r-- 1 keycloak root 492 Sep 19 17:43 README.md
    drwxrwxr-x 2 keycloak root 4.0K Sep 19 17:57 themes
    -rw-r----- 1 5766578 20003 1.2K Jan 29 08:10 upconfig.json
    -rw-rw-r-- 1 keycloak root 26 Sep 19 17:43 version.txt

5766578 is the UID of my local user.
Additional Information

No response

Linguagem predominante
Java
Estrelas
8.7k
Forks
1.9k
Merge médio
1d 5h
PRs com merge (30d)
1

Preparar o ambiente

Abrir no Codespaces

Inicia o contêiner de desenvolvimento do projeto no navegador, com a sua própria conta do GitHub.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de testcontainers/testcontainers-java

Todas as issues de testcontainers/testcontainers-java

Issues semelhantes

Mais issues de Java

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.