[chandarith-chea]

The bug

The engine runs as the Mac user, not root, so a guest's chmod 555 or chmod 000 of a directory is enforced against dockivad too. Go's module cache is made of 0555 directories, and #34 lets guest root make more of them. With such a directory holding files (engine af13b2b):

command	before	this branch
docker rmi of an image with a non-empty 0555 directory	unlinkat …: permission denied; image.json gone, files left; every later docker images answers Host operation failed	image and files removed; docker images works
docker commit of a container with nested 0555 directories	mkdir <store>/.commit-*/rootfs/root/a/d: permission denied	image made, modes and files kept
docker cp c:/dir -, docker export with a 000 directory or file	truncated tar	whole tree, modes kept
docker build	its work directory stayed in <store>/build when a stage held a 0555 directory (21 left on my installed 0.6.10)	removed

The fix

dockivad/restricted.go holds the helpers. Where the engine removes, copies or archives guest files, the directory or file gets the owner bits it lacks for as long as they are needed and its own mode back after, so what is stored and exported keeps the guest's modes.

• Removal. Every removal of guest files goes through removeTree. An image directory leaves the cache in one rename (.removing-*) before its files go: the image is listed whole or not at all, and what a failed removal leaves goes at the next start. A cache directory left without image.json by an earlier engine is skipped by docker images and docker rmi, and removed at start.

• Copies. clonefile copies a tree whole or not at all (EACCES on one 000 entry), so cloneTree unlocks such a tree, clones, and locks source and copy again. applyUpper (commit) keeps the directories it fills writable and sets their modes last. Layer diffs, the build cache's hash and size and build exports walk with walkTree, and look up the base through 000 directories.

• Archives. docker cp out, docker export and docker diff read 000 directories and files. docker cp into a container, the engine's own files and mount points, and a build's COPY write into a 0555 directory, as Docker's root does.

• Leftovers. At a start, before the API serves requests, what an engine that has gone left behind is renamed aside and removed in the background: build, load and .commit-* in the store, and build and load in the home from before the store.

A running container sees the wider mode for the moment the engine holds it, as with the runtime's own override in #34.

Not changed

• A path given to docker cp that itself runs through a 000 directory is still "not found" (layers.lookup).
• Unpacked image layers and populated volumes keep the owner bits the engine adds at unpack; bind mounts are read as they are.
• Guest root still cannot read a 000 directory that is in the image layer (the runtime limit noted in Root changes directories and opens files whatever their mode (CAP_DAC_OVERRIDE) #34).

Checks

• dockivad/restricted_test.go: docker rmi of an image with such directories and docker images beside a half-removed one; a commit's copy and its layer; docker cp out, docker export and docker cp in (these three fail on main); the start-up sweep of leftovers.
• go vet ./... and go test ./... in dockivad/ pass.
• scripts/verify_dockivad.py: 31/31 on both layouts (default and --new-home).
• End to end on locally built bundles, temporary home, both with main's runtime and with Root changes directories and opens files whatever their mode (CAP_DAC_OVERRIDE) #34's (which is what writes files into 0555 and 000 directories): the rmi sequence then docker images; the commit, with the committed image run and its file read back; docker cp and docker export of a tree with a 000 directory and a 000 file; docker build FROM the committed image with a RUN and a COPY; docker cp into a 0555 directory; docker rm, docker rmi and docker builder prune leaving nothing behind; a half-removed image directory is listed around and gone after a restart; planted build, load and .commit-* leftovers with 0555 directories are gone after a restart, and a build after it works.