Make sure buildin volumes have the same ownership and permissions as …

[rhatdan]

…image

When creating a new image volume to be mounted into a container, we need to
make sure the new volume matches the Ownership and permissions of the path
that it will be mounted on.

For example if a volume inside of a containre image is owned by the database
UID, we want the volume to be mounted onto the image to be owned by the
database UID.

Signed-off-by: Daniel J Walsh [email protected]

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

Closes: #2634

[rhatdan]

https://github.com/neVERberleRfellerER PTAL

[rhatdan]

@giuseppe @umohnani8 @mheon @baude @TomSweeneyRedHat PTAL

[mheon]

Potential problem - what happens if someone else mounts this volume? Do we leave the permissions as is? Need to figure out how Docker handles this.

…

On Thu, Mar 14, 2019, 08:37 Daniel J Walsh ***@***.***> wrote: @giuseppe <https://github.com/giuseppe> @umohnani8 <https://github.com/umohnani8> @mheon <https://github.com/mheon> @baude <https://github.com/baude> @TomSweeneyRedHat <https://github.com/TomSweeneyRedHat> PTAL — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2643 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHYHCPdAF_rltu1Bqymp_O6Zk6kMnxXkks5vWkKPgaJpZM4b0Cb6> .

[rhatdan]

Yes once the volume is created it never gets changed. This is only doing the chown on initial creation of the source.

[TomSweeneyRedHat]

Other than @mheon's potential issue, LGTM

[rhatdan]

BTW This has nothing to do with the container that is mounting it, it is just looking at the ownership of the image.
Where this will fail is when we are using User Namespaces. Since the UID will probably not be mapped to the container.

[giuseppe]

LGTM

[mheon]

I feel like we ought to be doing this inside the volume code, but eh.

LGTM if we're confident this is the right behavior.

[mheon]

Tests are properly angry though

[umohnani8]

Changes LGTM

[mheon]

/lgtm