Skip to content

fix(podman): relax image tar directory permissions for WSL#52215

Closed
chienchandler wants to merge 1 commit intoopenclaw:mainfrom
chienchandler:fix/podman-wsl-image-dir-permission
Closed

fix(podman): relax image tar directory permissions for WSL#52215
chienchandler wants to merge 1 commit intoopenclaw:mainfrom
chienchandler:fix/podman-wsl-image-dir-permission

Conversation

@chienchandler
Copy link
Copy Markdown

@chienchandler chienchandler commented Mar 22, 2026

What

scripts/podman/setup.sh creates the image tar temp directory with chmod 700, which blocks the openclaw user from reading the tar file during podman image load on Windows WSL.
Fixes #52180

How

chmod 700chmod 755. The directory is temporary (cleaned up on EXIT trap) and only holds a build artifact, so world-readable is fine here.

Testing

Verified the permission change is consistent with how other temp directories are handled in the script. The directory is short-lived and removed by the cleanup trap at line 256.


AI-assisted (Claude Code), reviewed by author.

The setup script creates a temp directory for the Docker image tar with
chmod 700, which prevents the openclaw user from reading the file during
podman image load on Windows WSL. Change to 755 so the directory is
world-readable while the owner retains full control.

Fixes openclaw#52180
@openclaw-barnacle openclaw-barnacle bot added scripts Repository scripts docker Docker and sandbox tooling size: XS labels Mar 22, 2026
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps bot commented Mar 22, 2026

Greptile Summary

This PR fixes a WSL-specific permission issue in scripts/podman/setup.sh by relaxing the temporary image tar directory from chmod 700 to chmod 755, allowing the openclaw user to traverse into the directory and read the tar file during podman image load.

  • The change is minimal and well-targeted: one line changed in a single file.
  • The security trade-off is acceptable — the directory is short-lived (created and destroyed within the same script run via the cleanup_image_tar EXIT trap at line 257) and holds only a build artifact.
  • chmod 755 is consistent with how other temporary directories in the script are handled, as noted in the PR description.

Confidence Score: 5/5

  • This PR is safe to merge — it's a minimal, well-justified fix with no functional regressions.
  • The change is a single-line permission tweak on an ephemeral temp directory. The rationale is sound (WSL needs execute bits to traverse directories), the directory is cleaned up immediately via an EXIT trap, and the relaxed permissions pose no meaningful security risk for a short-lived build artifact.
  • No files require special attention.

Reviews (1): Last reviewed commit: "fix(podman): relax image tar directory p..." | Re-trigger Greptile

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a91c223d1a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@chienchandler
Copy link
Copy Markdown
Author

CI note: Both failing checks fail on src/plugin-sdk/subpaths.test.ts (MODULE_NOT_FOUND for dist/plugin-sdk/core.js) — same pre-existing issue as other open PRs, unrelated to this podman permission fix.

@sallyom
Copy link
Copy Markdown
Contributor

sallyom commented Mar 30, 2026

Closing because this targets the old tar-based Podman setup path, which we no longer use on current main.

@sallyom sallyom closed this Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docker Docker and sandbox tooling scripts Repository scripts size: XS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Podman Windows WSL permission denied

2 participants