fix: filter non-executable files when symlinking buildkit-cni plugins (#4553) #4554
+1
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The nerdctl-full tarball was incorrectly creating symlinks for all files in libexec/cni/, including documentation files like README.md and LICENSE. This resulted in non-executable files appearing in bin/ as buildkit-cni-README.md and buildkit-cni-LICENSE. Add executable and regular file checks to the symlink creation loop to filter out non-executable files. The fix uses [ -x "$f" ] to check for execute permission and [ -f "$f" ] to ensure it's a regular file, so only actual CNI plugin binaries are symlinked. Tested: bin/ file count reduced from 46 to 44 files (removed 2 doc symlinks). All 18 CNI plugin executables still correctly symlinked. Fixes containerd#4553 Signed-off-by: Sadique Azmi <sadiquemobaraka5@gmail.com>
|
Happy to help! :) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #4553
The
nerdctl-fulltarball was incorrectly creating symlinks for all files inlibexec/cni/, including documentation files likeREADME.mdandLICENSE. This resulted in non-executable files appearing in thebin/directory asbuildkit-cni-README.mdandbuildkit-cni-LICENSE.Root Cause
The symlink creation loop in the Dockerfile (line 170) processed all files in
/out/libexec/cni/*without filtering:# Before (buggy) for f in /out/libexec/cni/*; do ln -s ../libexec/cni/$(basename $f) /out/bin/buildkit-cni-$(basename $f); doneThe CNI plugins tarball includes both executable binaries and documentation files with no execute permissions.
Solution
Added file type and permission checks to filter out non-executable files:
[ -f "$f" ]- ensures it's a regular file[ -x "$f" ]- ensures it has execute permissionTesting
Built and compared the full artifact before and after the fix:
Before:
bin/buildkit-cni-README.mdandbuildkit-cni-LICENSEAfter:
bin/Impact
libexec/cni/where they belong