Issue Description
After upgrading to the latest version of podman and its dependencies (podman 6.0.0-rc1, buildah 1.44.0), we noticed failures in some of our tests that were using Containerfiles in the following form:
FROM oci-archive:/absolute-path
It seems that using absolute paths like this is no longer supported since path sanitation was introduced in #5975. This makes sense for Containefile FROM directives, however the same failures also occur when using absolute paths with podman build or buildah bud:
podman build --from oci-archive:<absolute-path>
buildah bud --from oci-archive:<absolute-path>
When using --from on the command line, the user is explicitly providing the path, and there is no expectation that the build is self containing, so I expected the last command to work.
The error message itself (attached in the reproduction steps) is not super self explanatory, I believe what is happening is that the provided absolute path is being resolved as a relative path to the build context directory, leading to failures.
Please let me know if you need any more details!
Steps to reproduce the issue
[core@cosa-devsh ~]$ buildah --version
buildah version 1.44.0 (image-spec 1.1.1, runtime-spec 1.3.0)
[core@cosa-devsh ~]$ skopeo copy docker://quay.io/fedora/fedora-minimal:latest oci-archive:/tmp/fedora.ociarchive
Getting image source signatures
Copying blob fb1251ea7033 done |
Copying config 8d41eb7fb8 done |
Writing manifest to image destination
[core@cosa-devsh ~]$ cat > /tmp/Containerfile <<'EOF'
FROM overridden
RUN touch /etc/foo
EOF
[core@cosa-devsh ~]$ buildah bud --from oci-archive:/tmp/fedora.ociarchive -f /tmp/Containerfile
WARN[0000] expected to have archived a copy of "/tmp/fedora.ociarchive", missed it
STEP 1/2: FROM oci-archive:/tmp/fedora.ociarchive
Error: creating build container: loading index: open /var/tmp/container_images_oci48477806/index.json: no such file or directory
Describe the results you received
Could not run podman build --from / buildah bud --from with absolute paths.
Describe the results you expected
To be able to run podman build --from / buildah bud --from with absolute paths.
buildah version output
[core@cosa-devsh ~]$ buildah --version
buildah version 1.44.0 (image-spec 1.1.1, runtime-spec 1.3.0)
buildah info output
{
"host": {
"Distribution": {
"distribution": "fedora",
"version": "45"
},
"MemFree": 105451520,
"MemTotal": 989708288,
"OCIRuntime": "crun",
"SwapFree": 0,
"SwapTotal": 0,
"arch": "amd64",
"cpus": 12,
"hostname": "cosa-devsh",
"kernel": "7.2.0-0.rc0.260622gef0c9f75a195.6.fc45.x86_64",
"os": "linux",
"rootless": true,
"uptime": "7m 46.15s",
"variant": ""
},
"store": {
"ContainerStore": {
"number": 1
},
"GraphDriverName": "overlay",
"GraphImageStore": "",
"GraphOptions": [
"overlay.mountopt=nodev,metacopy=on"
],
"GraphRoot": "/var/home/core/.local/share/containers/storage",
"GraphStatus": {
"Backing Filesystem": "xfs",
"Native Overlay Diff": "false",
"Supports d_type": "true",
"Supports shifting": "false",
"Supports volatile": "true",
"Using metacopy": "false"
},
"GraphTransientStore": false,
"ImageStore": {
"number": 2
},
"RunRoot": "/run/user/1000/containers"
}
}
Provide your storage.conf
[core@cosa-devsh ~]$ cat /usr/share/containers/storage.conf
# This file is the configuration file for all tools
# that use the containers/storage library. The storage.conf file
# overrides all other storage.conf files. Container engines using the
# container/storage library do not inherit fields from other storage.conf
# files.
#
# See man 5 containers-storage.conf for more information
# The "storage" table contains all of the server options.
[storage]
[storage.options]
[storage.options.pull_options]
[storage.options.overlay]
mountopt = "nodev"
[storage.options.vfs]
[core@cosa-devsh ~]$ cat /etc/containers/storage.conf
cat: /etc/containers/storage.conf: No such file or directory
Upstream Latest Release
Yes
Additional environment details
The above commands were run using a Fedora CoreOS 45 rawhide qcow2 image in QEMU.
Additional information
No response
Issue Description
After upgrading to the latest version of podman and its dependencies (podman 6.0.0-rc1, buildah 1.44.0), we noticed failures in some of our tests that were using
Containerfilesin the following form:It seems that using absolute paths like this is no longer supported since path sanitation was introduced in #5975. This makes sense for
ContainefileFROMdirectives, however the same failures also occur when using absolute paths withpodman buildorbuildah bud:When using
--fromon the command line, the user is explicitly providing the path, and there is no expectation that the build is self containing, so I expected the last command to work.The error message itself (attached in the reproduction steps) is not super self explanatory, I believe what is happening is that the provided absolute path is being resolved as a relative path to the build context directory, leading to failures.
Please let me know if you need any more details!
Steps to reproduce the issue
Describe the results you received
Could not run
podman build --from/buildah bud --fromwith absolute paths.Describe the results you expected
To be able to run
podman build --from/buildah bud --fromwith absolute paths.buildah version output
buildah info output
Provide your storage.conf
Upstream Latest Release
Yes
Additional environment details
The above commands were run using a Fedora CoreOS 45 rawhide qcow2 image in QEMU.
Additional information
No response