podman cp chowns files

[matejvasek]

Sub-comman podman cp doesn't preserve uid/git from tar. It deliberately chowns everything to uid/gid the container is running under at the moment. docker however preserve uid/gid. Since podman is drop in replacement we should do that too.
If not for the cp CLI sub-comman then an least for docker APIv2.

[matejvasek]

/cc @mheon @vrothberg

[rhatdan]

@matejvasek Could you write a repeater example?

[matejvasek]

~> echo 'L3dvcmtzcGFjZS9hLnR4dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAwMDA2NDQAMDAwMTc1MAAwMDAxNzUxADAwMDAwMDAwMDAwADE0MDY2MzYxMDE1ADAxMjMyNQAgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMDAwADAwMDAwMDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvd29ya3NwYWNlL2IudHh0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDAwMDY0NAAwMDAxNzUwADAwMDE3NTEAMDAwMDAwMDAwMDAAMTQwNjYzNjEwMTcAMDEyMzMwACAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHVzdGFyADAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAwMDAwMDAAMDAwMDAwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' | base64 -d > a.tar

~> podman container create --name show-ws quay.io/boson/faas-go-builder:v0.8.3 /usr/bin/ls -la /tmp/workspace
~> podman cp - show-ws:/tmp < a.tar
~> podman start show-ws -a
total 0
drwxr-xr-x. 2 root root 60 Jun 28 17:24 .
drwxrwxrwt. 3 root root 18 Jun 28 17:24 ..
-rw-r--r--. 1 root root  0 Jun 28 14:51 a.txt
-rw-r--r--. 1 root root  0 Jun 28 14:51 b.txt

~> docker create --name show-ws quay.io/boson/faas-go-builder:v0.8.3 /usr/bin/ls -la /tmp/workspace
~> docker cp - show-ws:/tmp < a.tar
~> docker start show-ws  -a
total 0
drwxr-xr-x. 1 root root 20 Jun 28 17:22 .
drwxrwxrwt. 1 root root 90 Jun 28 17:22 ..
-rw-r--r--. 1 cnb  cnb   0 Jun 28 14:51 a.txt
-rw-r--r--. 1 cnb  cnb   0 Jun 28 14:51 b.txt

[matejvasek]

diff --git a/libpod/container_copy_linux.go b/libpod/container_copy_linux.go
index 0ab322829..09a69f8f5 100644
--- a/libpod/container_copy_linux.go
+++ b/libpod/container_copy_linux.go
@@ -63,12 +63,12 @@ func (c *Container) copyFromArchive(ctx context.Context, path string, reader io.
        }
 
        // Make sure we chown the files to the container's main user and group ID.
-       user, err := getContainerUser(c, mountPoint)
-       if err != nil {
-               unmount()
-               return nil, err
-       }
-       idPair := idtools.IDPair{UID: int(user.UID), GID: int(user.GID)}
+       //user, err := getContainerUser(c, mountPoint)
+       //if err != nil {
+       //      unmount()
+       //      return nil, err
+       //}
+       //idPair := idtools.IDPair{UID: int(user.UID), GID: int(user.GID)}
 
        decompressed, err := archive.DecompressStream(reader)
        if err != nil {
@@ -84,8 +84,8 @@ func (c *Container) copyFromArchive(ctx context.Context, path string, reader io.
                putOptions := buildahCopiah.PutOptions{
                        UIDMap:     c.config.IDMappings.UIDMap,
                        GIDMap:     c.config.IDMappings.GIDMap,
-                       ChownDirs:  &idPair,
-                       ChownFiles: &idPair,
+                       //ChownDirs:  &idPair,
+                       //ChownFiles: &idPair,
                }
 
                return c.joinMountAndExec(ctx,

this should fix it

[matejvasek]

btw docker can chown files like podman does but -a flag has to be used.

I find it weird because:

Options:
  -a, --archive       Archive mode (copy all uid/gid information)

I would expect that it would works exactly opposite: if -a flag is present it IMHO should preserve uid/gid from tar, but opposite is true, if -a flag is present files are chowned. Am I misunderstanding anything here @rhatdan?

[matejvasek]

Maybe we could add the -a flag to the podman?

[rhatdan]

SGTM
Interested in opening a PR.
@vrothberg PTAL

[matejvasek]

The flag is by default false meaning that by default files are not chowned as opposed to current podman behavior. May I do such a change?

[rhatdan]

Yes we should match the Docker behaviour. We can add a flag to containers.conf, if people want to change the default value of this field.

[vrothberg]

Note that podman cp has never been fully compatible with docker cp. Changing the behavior now may cause regressions for Podman users.

@rhatdan, do you want to continue? I am not necessarily against it but want to weigh in.

[rhatdan]

I think it is best to add the -a function and default to true to match current podman behaviour, then lets add a flag to containers.conf if people want default to Docker behaviour.