Filesystem driver does not honor umask

[mkanderson]

I would like to have the registry data be group-writable in order to allow automation of periodic cleanup tasks by a non-root user.
I'm using this wrapper as the entrypoint in my Dockerfile to set the umask to 002:

#!/bin/bash  
umask 002

# Test umask
touch /UMASK_FILE
mkdir /UMASK_DIR

exec registry "$@"

/UMASK_FILE and /UMASK_DIR are created with the correct permissions (664/775), and I've verified that the registry process is running with the correct umask by attaching a debugger to the running process:

(gdb) call umask(0)
$1 = 2 

However, after pushing an image to the registry, the files and directories under /var/lib/registry/ have permissions 644 and 755 respectively:

root@74d3bca0018e:/go/src/github.com/docker/distribution# find /var/lib/registry/ | xargs stat --format %a - | sort | uniq   
644
755

Here's the setup:

mand@docker1:~$ docker --version
Docker version 1.8.3, build f4bf5c7

mand@docker1:~$ docker info
Containers: 8
Images: 298
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 314
 Dirperm1 Supported: true
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 3.16.0-4-amd64
Operating System: Debian GNU/Linux 8 (jessie)
CPUs: 2
Total Memory: 3.873 GiB
Name: docker1
ID: HPR4:7SK5:RDZJ:JHGU:ZKOM:PYJO:TBQF:7QCW:32IO:HEHM:BSJF:IZA4
WARNING: No memory limit support
WARNING: No swap limit support

mand@docker1:~$ docker exec regtest registry --version
registry github.com/docker/distribution v2.1.1-279-g55ca526

[aaronlehmann]

Looks like this is because the filesystem driver explicitly specifies 0644 permissions:

https://github.com/docker/distribution/blob/master/registry/storage/driver/filesystem/driver.go#L142

It's probably more correct to use 0666 here, and 0777 for the MkdirAll call above, and let umask do its work.

[stevvooe]

Closed by #1304.