Skip to content

fix: Reflect Unix file mode when building tarball from .NET 7 onwards#1397

Merged
HofmeisterAn merged 1 commit into
testcontainers:developfrom
kfarnung:bugfix/1171-unix-file-mode
Mar 12, 2025
Merged

fix: Reflect Unix file mode when building tarball from .NET 7 onwards#1397
HofmeisterAn merged 1 commit into
testcontainers:developfrom
kfarnung:bugfix/1171-unix-file-mode

Conversation

@kfarnung

Copy link
Copy Markdown
Contributor

What does this PR do?

When the image build process is creating the tarball of files needed to build the image, it currently just uses the default value of 700. This causes those files to be readable only by the owner (i.e. root) when placed in the container.

The fix is to read the file mode of the files when building the tarball on Unix. The API in use only exists in .NET 7.0 and higher, so this change also extends the Windows workaround to Unix. When the GetUnixFileMode function isn't available, just use 755 as the file mode.

Why is it important?

The behavior when an image is built using Testcontainers on Unix differs from the behavior when the image is built externally. This is especially problematic when running the container as a non-root user (e.g. USER ubuntu) as all of the files copied from the tarball are restricted to the root user only.

Related issues

Closes #1171

How to test this PR

This PR was tested locally on Fedora 41 using Podman. The test scenario used a simple docker file that copied a script (mode 755) from the local disk and tried to execute it:

Dockerfile

FROM ubuntu:24.04

RUN apt-get update && apt-get install -y python3

COPY ./app/ /app/

EXPOSE 8000
USER ubuntu
WORKDIR /app
ENTRYPOINT ["/app/app.py"]

app/app.py

#!/usr/bin/env python3

from http.server import BaseHTTPRequestHandler, HTTPServer
import json

class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        if self.path == '/submit':
            content_length = int(self.headers['Content-Length'])
            post_data = self.rfile.read(content_length)
            data = json.loads(post_data)
            response = data.get('type', 'No type provided')
            
            self.send_response(200)
            self.send_header('Content-type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({'type': response}).encode('utf-8'))
        else:
            self.send_response(404)
            self.end_headers()

    def do_GET(self):
        if self.path == '/':
            self.send_response(200)
            self.send_header('Content-type', 'text/html')
            self.end_headers()
            self.wfile.write(b'Hello, world!')
        else:
            self.send_response(404)
            self.end_headers()

def run(server_class=HTTPServer, handler_class=SimpleHTTPRequestHandler, port=8000):
    server_address = ('', port)
    httpd = server_class(server_address, handler_class)
    print(f'Starting httpd server on port {port}')
    httpd.serve_forever()

if __name__ == "__main__":
    run()

Without my change, the script would fail to execute due to the 700 permissions on app.py. With my change, the script executed successfully.

When the image build process is creating the tarball of files needed to
build the image, it currently just uses the default value of 700. This
causes those files to be readable only by the owner (i.e. root) when
placed in the container.

The fix is to read the file mode of the files when building the tarball
on Unix. The API in use only exists in .NET 7.0 and higher, so this
change also extends the Windows workaround to Unix. When the
`GetUnixFileMode` function isn't available, just use 755 as the file
mode.
@netlify

netlify Bot commented Mar 12, 2025

Copy link
Copy Markdown

Deploy Preview for testcontainers-dotnet ready!

Name Link
🔨 Latest commit 6390dc0
🔍 Latest deploy log https://app.netlify.com/sites/testcontainers-dotnet/deploys/67d13dbb8102d200089eef59
😎 Deploy Preview https://deploy-preview-1397--testcontainers-dotnet.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@HofmeisterAn HofmeisterAn added bug Something isn't working enhancement New feature or request labels Mar 12, 2025

@HofmeisterAn HofmeisterAn left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good idea 😎 thanks.

@HofmeisterAn HofmeisterAn changed the title fix: Reflect Unix file mode when building tarball fix: Reflect Unix file mode when building tarball from .NET 7 onwards Mar 12, 2025
@HofmeisterAn
HofmeisterAn merged commit 8056b24 into testcontainers:develop Mar 12, 2025
@kfarnung
kfarnung deleted the bugfix/1171-unix-file-mode branch March 13, 2025 01:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: .NET 8 Container Permissions Changed Breaking Non-Root App User

2 participants