Incorrect privileges on image root

[praseodym]

When running a VM with the weaveworks/ignite-ubuntu:latest image I ran into problems starting the systemd-resolved service (which is expected by kubeadm, at least when using kubespray). It turns out that this problem was caused by the non-root systemd-resolve user not being able to access the sytemd-resolved binary.

It turns out that this is because of incorrect privileges on the image's root directory:

root@17b9791da8ac3e62:~# ls -la /
total 36
drwx------ 22 root root  1024 Jul 26 11:00 .

A normal Linux system has drwxr-xr-x (0755) for /. Both the Ubuntu and CentOS images have this problem.

[praseodym]

Looks like the problem is not in the OCI images themselves, but somewhere in Ignite itself:

> docker run --rm -it weaveworks/ignite-ubuntu ls -la
total 8
drwxr-xr-x   1 root root    6 Jul 28 19:52 .

[DieterReuter]

There is also a problem with apt update, it doesn't work with this VM image weaveworks/ignite-ubuntu:latest. As soon as you fix it with chmod 755 /, the command apt update is working!

[DieterReuter]

I just want to confirm, with fixing the image root's directory via chmod 755 / all the error messages from booting the VM image weaveworks/ignite-ubuntu:latest are resolved!

[DieterReuter]

Ping @luxas. Can you please have a quick look at this issue? Maybe could point us to the right code, where we could fix the folder permission in Ignite.

[luxas]

So we basically do docker export > archive.tar, and then tar -x -f archive.tar -C mountpath
https://github.com/weaveworks/ignite/blob/master/pkg/dmlegacy/image_format.go#L59

There we'd have to do chmod 755; alternatively pass some kind of "preserve permission data" option to tar. @DieterReuter can you take a look and help fix this?

[praseodym]

ioutil.TempDir does a chmod 0700, so doing a chmod 0755 afterwards (or maybe better yet, creating a new directory in the TempDir with mode 0755 to avoid making it readable for other local users) will probably fix this.

[luxas]

can you send a PR for this please?

[praseodym]

Turns out the problem was not with the base image, but with the overlay. PR including some details at #249!

[DieterReuter]

I already tested this fix, works like a charm!!! 🎉👍🤓

Thanks 🙏, @praseodym!