hasher: hash security.capability attributes #1994
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In Dockerfile, if there is something like: ``` RUN setcap cap_net_raw=+ep /path/to/binary ``` kaniko won't detect that there is a change on file `/path/to/binary` and thus discards this layer. This patch allows the hasher function to actually look at `security.capability` extended attributes.
|
@imjasonh: Could you help take a look when you get a chance? Thanks~ |
imjasonh
reviewed
Apr 29, 2022
| @@ -172,3 +177,28 @@ func Retry(operation retryFunc, retryCount int, initialDelayMilliseconds int) er | |||
|
|
|||
| return err | |||
| } | |||
|
|
|||
| func Lgetxattr(path string, attr string) ([]byte, error) { | |||
There was a problem hiding this comment.
It doesn't look like this function needs to be exported, can we rename to lgetxattr and add a comment?
I'd also love to have a test covering this behavior, since it's pretty inscrutable to me personally.
There was a problem hiding this comment.
Sure, I can add a comment there.
Regarding tests, I can take a look at how to write a test(either a unit test or e2e test). But if you have any pointers or suggestions, that'd be great.
imjasonh
approved these changes
May 4, 2022
zhouhaibing089
added a commit
to zhouhaibing089/kaniko
that referenced
this pull request
May 9, 2022
This is a followup of GoogleContainerTools#1994. This test runs a Dockerfile where setcap is executed. Without the fix in GoogleContainerTools#1994, the last command won't generate any diff and thus is discarded by kaniko and thus should fail this test.
4 tasks
zhouhaibing089
added a commit
to zhouhaibing089/kaniko
that referenced
this pull request
May 9, 2022
This is a followup of GoogleContainerTools#1994. This test runs a Dockerfile where setcap is executed. Without the fix in GoogleContainerTools#1994, the last command won't generate any diff and thus is discarded by kaniko and thus should fail this test.
zhouhaibing089
added a commit
to zhouhaibing089/kaniko
that referenced
this pull request
May 9, 2022
This is a followup of GoogleContainerTools#1994. This test runs a Dockerfile where setcap is executed. Without the fix in GoogleContainerTools#1994, the last command won't generate any diff and thus is discarded by kaniko and thus should fail this test.
zhouhaibing089
added a commit
to zhouhaibing089/kaniko
that referenced
this pull request
May 9, 2022
This is a followup of GoogleContainerTools#1994. This test runs a Dockerfile where setcap is executed. Without the fix in GoogleContainerTools#1994, the last command won't generate any diff and thus is discarded by kaniko and thus should fail this test.
zhouhaibing089
added a commit
to zhouhaibing089/kaniko
that referenced
this pull request
May 9, 2022
This is a followup of GoogleContainerTools#1994. This test runs a Dockerfile where setcap is executed. Without the fix in GoogleContainerTools#1994, the last command won't generate any diff and thus is discarded by kaniko and thus should fail this test.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1851
Description
In Dockerfile, if there is something like:
kaniko won't detect that there is a change on file
/path/to/binaryandthus discards this layer. This patch allows the hasher function to
actually look at
security.capabilityextended attributes.The function
Lgetxattruses https://github.com/moby/moby/blob/c72c1ca62cd20e74582a01b8a54a58ae7f646d4c/pkg/system/xattrs_linux.go#L8Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
See the contribution guide for more details.
Reviewer Notes
Release Notes