Unnecessary overwrites of directories, resulting changes to owners and permissions

The way we took to fix #727 and #523 was to add TAR archive entries to enumerate all parent directories of any given file and explicitly set permissions for those parent directories: PR #891. The consequence is that owner:group is always reset to root:root and the permission mode 755 for all the directories involved.

So, let’s say I have a base Tomcat image where the owner:group and the permission of /usr are 12345:54321 and 750:

$ docker run --rm -it --entrypoint ls francium25/base-tomcat -ld /usr
drwxr-x---    1 12345    54321         4096 Sep 12 20:50 /usr

Now, if Jib builds an image where /usr is one of the parent directories of my <appRoot>,

          <from><image>francium25/base-tomcat</image></from>
          <container>
            <appRoot>/usr/local/tomcat/webapps/ROOT</appRoot>
          </container>

the owner and the permission are reset (to the values we chose).

$ docker run --rm -it --entrypoint ls my-image -ld /usr
drwxr-xr-x    1 root     root          4096 Jan  1  1970 /usr

It will be ideal to not touch the owners and permissions of existing directories.

Also note that <appRoot> and its parent directories will always be root:root and 755.

[cablespaghetti]

Just came across this problem with the jetty:9-jre11-slim image on Docker Hub. I’m using that rather than Distroless for multi-arch (ARM64) support, and for some reason the default entrypoint shell script tries to create a directory in /var/lib/jetty on startup. Here’s the properties I add to get everything working:

        <jib.from.image>jetty:9-jre11-slim</jib.from.image>
        <jib.container.appRoot>/var/lib/jetty/webapps/ROOT</jib.container.appRoot>
        <jib.container.entrypoint>/usr/local/openjdk-11/bin/java,-jar</jib.container.entrypoint>
        <jib.container.args>/usr/local/jetty/start.jar</jib.container.args>
        <jib.container.user>nobody</jib.container.user>

Hope it’s useful to somebody. 😃

[chanseokoh]

FTR: #1257 is resolved using a Jib extension. This issue is documented as one of the known limitations of the extension, where there is a workaround.