copy link breaks permissions with buildkit rootless

[oOraph]

Contributing guidelines and issue reporting guide

• I've read the contributing guidelines and wholeheartedly agree. I've also read the issue reporting guide.

Well-formed report checklist

• I have found a bug that the documentation does not mention anything about my problem
• I have found a bug that there are no open or closed issues that are related to my problem
• I have provided version/information about my environment and done my best to provide a reproducer

Description of bug

Bug description

COPY --link command leads to weird permissions overrides in the resulting image with the setgid permission set on the resulting directory
this may be related to this issue
#2842
or not, not sure yet

more precisely the problem is that if we copy anything with --link into tmp, for example the resulting permissions are sth like:

drwxr-sr-x 1 root root 4.0K Jul  8 12:05 /tmp

instead of drwxrwxrwt (quite important permission set for tmp)

Reproduction

See reproduce.sh in

https://github.com/oOraph/dig-buildkit-rootless-permissions

Version information

Using current moby/buildkit:rootless docker image tag

[tonistiigi]

@AkihiroSuda Do you know what is going on here? Smth. specific to /tmp/ ?

[oOraph]

Not specific to /tmp. Used it as an example because this is how I saw the issue (broke apt-get update because _apt user could not create temp files in /tmp). But it can be reproduced with any directory. Actually, copy --link will result in changed permissions of all directories between / and the copied file

[tonistiigi]

It is expected that COPY --link changes permissions of parent directories. It needs to recreate these directories based on the config of COPY command and it can't depend on previous layer data.

Effectively.

FROM scratch AS new
COPY src a/b/dest

FROM mainbuild
COPY --from=new / /

But from your report, I didn't understand where the setgid bit would come from.

[AkihiroSuda]

Is this a recent regression?

[oOraph]

only tested on latest and v0.16.0, problem was there in both cases (so no recent regression)