4.34.*: Subdirectories created in mount point in-container on non-root container get created with wrong ownership

[rfay]

Description

In Docker Desktop 4.34.*, directories created inside a mount point on a non-root container have the wrong ownership (root), breaking lots of things due to lack of access.

I believe this is the same as

• VirtioFS changes in 4.34 break initial startup of PostgreSQL container #7415

but it's more explicitly described here, with a repro.

This seems to have been introduced in 4.34.0

Reproduce

1. Run a container with non-root user and with a bind-mount
2. Inside the container, create a subdirectory in the bind-mount
3. Subdirectory will inappropriately have ownership of root

This can be demonstrated with the simple and complete repro in https://github.com/rfay/dd_ownership_test - please try it out.

Note that the problem does not exist before 4.34.0, and does not exist in other Docker providers like Orbstack or Colima.

(We won't mention that the bind-mount is root:root and shouldn't be, but that's another longstanding issue with DD covered in other issues)

Expected behavior

Subdirectories should have the ownership of the creating user, as do all subdirectories in Unix/Linux systems.

docker version

Client:
Version: 27.2.0
API version: 1.47
Go version: go1.21.13
Git commit: 3ab4256
Built: Tue Aug 27 14:14:45 2024
OS/Arch: darwin/arm64
Context: desktop-linux

Server: Docker Desktop 4.34.3 (170107)
Engine:
Version: 27.2.0
API version: 1.47 (minimum version 1.24)
Go version: go1.21.13
Git commit: 3ab5c7d
Built: Tue Aug 27 14:15:41 2024
OS/Arch: linux/arm64
Experimental: false
containerd:
Version: 1.7.20
GitCommit: 8fc6bcff51318944179630522a095cc9dbf9f353
runc:
Version: 1.1.13
GitCommit: v1.1.13-0-g58aa920
docker-init:
Version: 0.19.0
GitCommit: de40ad0

docker info

Client:
Version: 27.2.0
Context: desktop-linux
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.16.2-desktop.1
Path: /Users/rfay/.docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.29.2-desktop.2
Path: /Users/rfay/.docker/cli-plugins/docker-compose
debug: Get a shell into any image or container (Docker Inc.)
Version: 0.0.34
Path: /Users/rfay/.docker/cli-plugins/docker-debug
desktop: Docker Desktop commands (Alpha) (Docker Inc.)
Version: v0.0.15
Path: /Users/rfay/.docker/cli-plugins/docker-desktop
dev: Docker Dev Environments (Docker Inc.)
Version: v0.1.2
Path: /Users/rfay/.docker/cli-plugins/docker-dev
extension: Manages Docker extensions (Docker Inc.)
Version: v0.2.25
Path: /Users/rfay/.docker/cli-plugins/docker-extension
feedback: Provide feedback, right in your terminal! (Docker Inc.)
Version: v1.0.5
Path: /Users/rfay/.docker/cli-plugins/docker-feedback
init: Creates Docker-related starter files for your project (Docker Inc.)
Version: v1.3.0
Path: /Users/rfay/.docker/cli-plugins/docker-init
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: /Users/rfay/.docker/cli-plugins/docker-sbom
scout: Docker Scout (Docker Inc.)
Version: v1.13.0
Path: /Users/rfay/.docker/cli-plugins/docker-scout

Server:
Containers: 6
Running: 6
Paused: 0
Stopped: 0
Images: 55
Server Version: 27.2.0
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 8fc6bcff51318944179630522a095cc9dbf9f353
runc version: v1.1.13-0-g58aa920
init version: de40ad0
Security Options:
seccomp
Profile: unconfined
cgroupns
Kernel Version: 6.10.4-linuxkit
Operating System: Docker Desktop
OSType: linux
Architecture: aarch64
CPUs: 10
Total Memory: 7.655GiB
Name: docker-desktop
ID: 61f1dd5a-5155-4b68-9d5a-305488bf40fa
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
No Proxy: hubproxy.docker.internal
Labels:
com.docker.desktop.address=unix:///Users/rfay/Library/Containers/com.docker.docker/Data/docker-cli.sock
Experimental: false
Insecure Registries:
hubproxy.docker.internal:5555
127.0.0.0/8
Live Restore Enabled: false

Diagnostics ID

A41222BE-3BBE-4DE5-8034-C9612315CEB0/20241022182513

Additional Info

No response

[xenoscopic]

CC @fredericdalleau - Could this be the same underlying issue as #6243?

[rfay]

This problem is fixed in Docker Desktop 4.35.0, thanks!