design proposal 01: filesystem resolution

[cvgw]

Fixes #1047

Description

Design proposal for how to handle resolving the filesystem

Submitter Checklist

Reviewer Notes

Release Notes

[tejal29]

first pass review.

[tejal29]

What happens when a docker files has a command
Copy some_bin /var/run/some_bin

/var/run is whitelisted.
In this scenario, Docker would create /var/run/some_bin in the layer.

[cvgw]

I'm not sure, what do we currently do when the destination of a copy command is a whitelisted path?

[tejal29]

Right now, for Copy and ADD command we do the following

• Resolve source and dest by substituting any env varaibles
• Resolve any wild cards in sources
• Get Relative source file path respect to root path. In this step,
  • we apply CheckWhitelist(path) && !HasFilepathPrefix(path, root, false)
  • if /var/run is ignored, then this condition should return true for /var/run/some_bin
  • if /var/run is ignores then this condition should return false for var/run/another_dir/some_bin

For copying symlink dir targeted to a whitelisted path, there is another flow.
We should simplify this but probably not in scope for this proposal

[cvgw]

So what is the end result? Do we copy the file to the whitelist destination?

[cvgw]

I did a quick test

FROM ubuntu:16.04
COPY meow.txt /var/run

docker

ls /var/run
=> initctl  lock  log  meow.txt  mount  sendsigs.omit.d  shm  systemd  user  utmp

kaniko

ls /var/run
=> /var/run

[cvgw]

Interestingly

FROM ubuntu:16.04
COPY meow.txt /var/run/meow.txt

docker

ls /var/run
=> initctl  lock  log  meow.txt  mount  sendsigs.omit.d  shm  systemd  user  utmp

kaniko

ls /var/run
=> /var/run/meow.txt

hit approve by mistake.