Propagate permissions for all host-to-container socket mounts. - #1751
Merged
Conversation
- Closes apple#1750. - Applies permission code used for the `--ssh` mount to all host-to-container socket mounts. - Adds a user option to the `doExec` test support function. - Updates the `testRunCommandUnixSocketMount` to install `nc` in the test container, and check the socket permission, and check the mounted socket using `nc` as the guest user.
Code Coverage
|
katiewasnothere
approved these changes
Jun 18, 2026
6 tasks
sylvaincombes
added a commit
to sylvaincombes/socktainer
that referenced
this pull request
Jul 9, 2026
A container process running as a non-root user got EACCES on the relayed docker.sock: apple/container 1.1.0 mirrors the host socket's mode onto the root-owned guest-side socket (apple/container#1751), and socktainer's control socket was created with umask-default 0755 — no write bit for the guest user. Group-based modes can't help since the guest socket is always root:root, so open the socket to 0666 and compensate by restricting ~/.socktainer to 0700: other host users are blocked at directory traversal (the previous 0755 socket already denied them connect(2)), while the guest mirror only copies the socket's own mode. Live-verified on apple/container 1.1.0: --user 1000:1000 with the docker.sock bind mount now connects out of the box; root baseline unchanged. Also drops an accidentally duplicated create-directory / remove-socket block in prepareUnixSocket. Closes socktainer#288 Signed-off-by: Sylvain Combes <combes.sylvain@gmail.com>
sylvaincombes
added a commit
to sylvaincombes/socktainer
that referenced
this pull request
Jul 10, 2026
A container process running as a non-root user got EACCES on the relayed docker.sock: apple/container 1.1.0 mirrors the host socket's mode onto the root-owned guest-side socket (apple/container#1751), and socktainer's control socket was created with umask-default 0755 — no write bit for the guest user. Group-based modes can't help since the guest socket is always root:root, so open the socket to 0666 and compensate by restricting ~/.socktainer to 0700: other host users are blocked at directory traversal (the previous 0755 socket already denied them connect(2)), while the guest mirror only copies the socket's own mode. Live-verified on apple/container 1.1.0: --user 1000:1000 with the docker.sock bind mount now connects out of the box; root baseline unchanged. Also drops an accidentally duplicated create-directory / remove-socket block in prepareUnixSocket. Closes socktainer#288 Signed-off-by: Sylvain Combes <combes.sylvain@gmail.com>
jianliang00
pushed a commit
to jianliang00/container
that referenced
this pull request
Aug 28, 2026
…#1751) - Closes apple#1750. - Applies permission code used for the `--ssh` mount to all host-to-container socket mounts. - Adds a user option to the `doExec` test support function. - Updates the `testRunCommandUnixSocketMount` to install `nc` in the test container, and check the socket permission, and check the mounted socket using `nc` as the guest user.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--sshmount to all host-to-container socket mounts.doExectest support function.testRunCommandUnixSocketMountto installncin the test container, and check the socket permission, and check the mounted socket usingncas the guest user.Type of Change
Motivation and Context
Allows socket mounts for non-user workloads.
Testing