COPY --chown=1001:0 . . copies directories as root

[braykov]

Actual behavior
I want to transfer all files and dirs recursively from current host dir to WORKDIR inside the image
I am using COPY --chown=1001:0 . .

Expected behavior
All files and folders in the image should be owned by user with ID 1001 and group 0.

To Reproduce
Steps to reproduce the behavior:

1. Create an image from this dockerfile
2. Start a container and do ls -ls
3. Observer the files ownership and directories ownership

When built with kaniko 1.8.0, all files belong to user non-root and all directories belong to user root.
When built with Docker 20.0.13, all files belong to user non-root and all directories also belong to user non-root.

Additional Information

• Dockerfile

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster
ENV DIR_HOME=/app
RUN useradd -s /bin/bash -u 1001 -g root -m -d $DIR_HOME non-root
WORKDIR $DIR_HOME
COPY --chown=1001:0 . .

• Build Context: Just some files and folders with sub-folders in the current directory.
• Kaniko Image (fully qualified with digest): 1.8.1-debug

Triage Notes for the Maintainers

Description	Yes/No
Please check if this a new feature you are proposing
Please check if the build works in docker but not in kaniko
Please check if this error is seen when you use --cache flag
Please check if your dockerfile is a multistage dockerfile

[scrayos]

I can confirm this behaviour also for copies of sub-folders (not the entire WORKDIR):

COPY --chown=nobody:nobody server_configs merge_server_configs

[danny900714]

We also encountered this issue, please fix this.

Dockerfile:

FROM dockcenter/velocity:3.1.2-SNAPSHOT-153

COPY --chown=velocity lang /data/lang

COPY --chown=velocity plugins/gate/build/libs/*.jar /data/plugins/

[pigoz]

I've "solved" this by explicitely calling chwon through RUN:

# move over package.json and package-lock.json, and install dependencies
COPY --chown=node:node package*.json ./
# kaniko ignores the --chown from the previous command
RUN chown -R node:node .
RUN npm ci

[JeromeJu]

Looks like this cannot be reproduced at HEAD for kaniko v1.20.x where the directories users are also non-root.

jeromeju@jju:~/kaniko/workspace$ ./run_in_docker.sh /dockerfile /usr/local/google/home/jeromeju/kaniko gcr.io/jju-dev/test:latest
INFO[0000] Using dockerignore file: /workspace/.dockerignore 
INFO[0000] Retrieving image manifest mcr.microsoft.com/dotnet/core/sdk:3.1-buster 
INFO[0000] Retrieving image mcr.microsoft.com/dotnet/core/sdk:3.1-buster from registry mcr.microsoft.com 
INFO[0002] Built cross stage deps: map[]                
INFO[0002] Retrieving image manifest mcr.microsoft.com/dotnet/core/sdk:3.1-buster 
INFO[0002] Returning cached image manifest              
INFO[0002] Executing 0 build triggers                   
INFO[0002] Building stage 'mcr.microsoft.com/dotnet/core/sdk:3.1-buster' [idx: '0', base-idx: '-1'] 
INFO[0002] Unpacking rootfs as cmd RUN useradd -s /bin/bash -u 1001 -g root -m -d $DIR_HOME non-root requires it. 
INFO[0016] ENV DIR_HOME=/app                            
INFO[0016] RUN useradd -s /bin/bash -u 1001 -g root -m -d $DIR_HOME non-root 
INFO[0016] Initializing snapshotter ...                 
INFO[0016] Taking snapshot of full filesystem...        
INFO[0020] Cmd: /bin/sh                                 
INFO[0020] Args: [-c useradd -s /bin/bash -u 1001 -g root -m -d $DIR_HOME non-root] 
INFO[0020] Running: [/bin/sh -c useradd -s /bin/bash -u 1001 -g root -m -d $DIR_HOME non-root] 
INFO[0020] Taking snapshot of full filesystem...        
INFO[0021] WORKDIR $DIR_HOME                            
INFO[0021] Cmd: workdir                                 
INFO[0021] Changed working directory to /app            
INFO[0021] No files changed in this command, skipping snapshotting. 
INFO[0021] COPY --chown=1001:0 . .                      
INFO[0024] Taking snapshot of files...                  
INFO[0029] Pushing image to gcr.io/jju-dev/test:latest  
INFO[0033] Pushed gcr.io/jju-dev/test@sha256:e6b98391a5a58fefef33e8174dfe31e1fe0c5d8cb5640c43afb42bc6424b0627 
jeromeju@jju:~/kaniko/workspace$ docker run -i -t gcr.io/jju-dev/test@sha256:e6b98391a5a58fefef33e8174dfe31e1fe0c5d8cb5640c43afb42bc6424b0627
Unable to find image 'gcr.io/jju-dev/test@sha256:e6b98391a5a58fefef33e8174dfe31e1fe0c5d8cb5640c43afb42bc6424b0627' locally
gcr.io/jju-dev/test@sha256:e6b98391a5a58fefef33e8174dfe31e1fe0c5d8cb5640c43afb42bc6424b0627: Pulling from jju-dev/test
c7c50787e2da: Already exists 
aff359114acb: Already exists 
821dc261e045: Already exists 
3790459d63d5: Already exists 
d9f67e74b01d: Already exists 
c28a95092be1: Already exists 
208cfb120a77: Already exists 
ed7a12bdd5e2: Pull complete 
a41359864928: Pull complete 
Digest: sha256:e6b98391a5a58fefef33e8174dfe31e1fe0c5d8cb5640c43afb42bc6424b0627
Status: Downloaded newer image for gcr.io/jju-dev/test@sha256:e6b98391a5a58fefef33e8174dfe31e1fe0c5d8cb5640c43afb42bc6424b0627
root@3d405c752679:/app# ls -ls
total 456
152 -rw-r-----  1 non-root root 151933 Feb 16 17:26 CHANGELOG.md
  4 -rw-r-----  1 non-root root   3045 Feb 16 17:26 CONTRIBUTING.md
  8 -rw-r-----  1 non-root root   7032 Feb 16 17:26 DEVELOPMENT.md
 12 -rw-r-----  1 non-root root  11341 Feb 16 17:26 LICENSE
  4 -rw-r-----  1 non-root root    107 Feb 16 17:26 MAINTAINERS
  4 -rw-r-----  1 non-root root   3945 Feb 16 17:26 Makefile
 56 -rw-r-----  1 non-root root  56204 Feb 16 17:26 README.md
  8 -rw-r-----  1 non-root root   5270 Feb 16 17:26 RELEASE.md
  4 -rw-r-----  1 non-root root    297 Feb 16 17:26 SECURITY.md
  4 -rw-r-----  1 non-root root   2160 Feb 16 17:26 Vagrantfile
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 app
  4 -rwxr-x---  1 non-root root    758 Feb 16 17:26 benchmark.sh
  4 drwxr-x---  4 non-root root   4096 Feb 16 17:26 cmd
  8 -rw-r-----  1 non-root root   5146 Feb 16 17:26 code-of-conduct.md
  4 -rw-r-----  1 non-root root    178 Feb 16 17:26 cosign.pub
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 deploy
  4 -rw-r-----  1 non-root root    175 Feb 16 17:26 dockerfile
  4 drwxr-x---  4 non-root root   4096 Feb 16 17:26 docs
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 examples
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 files
 12 -rw-r-----  1 non-root root  10439 Feb 16 17:26 go.mod
 96 -rw-r-----  1 non-root root  97765 Feb 16 17:26 go.sum
  4 drwxr-x---  5 non-root root   4096 Feb 16 17:26 hack
  4 drwxr-x---  9 non-root root   4096 Feb 16 17:26 integration
  0 lrwxrwxrwx  1 root     root     27 Feb 16 17:26 integration-test.sh -> scripts/integration-test.sh
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 logo
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 out
  4 drwxr-x--- 19 non-root root   4096 Feb 16 17:26 pkg
  4 drwxr-x---  5 non-root root   4096 Feb 16 17:26 quarkus-dummy-project
  4 -rwxr-x---  1 non-root root   1607 Feb 16 17:26 run_in_docker.sh
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 scripts
  0 -rw-r-----  1 non-root root      0 Feb 16 17:26 test
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 testutil
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:26 tools
  4 drwxr-x--- 12 non-root root   4096 Feb 16 17:27 vendor
  4 drwxr-x---  2 non-root root   4096 Feb 16 17:27 workspace