This repository was archived by the owner on Sep 5, 2026. It is now read-only.
fix(image): sync-image reconstitution must not flatten rootfs ownership - #11
Merged
Conversation
buildExt4 ran a blanket `sudo chown -R root:root` over the unsquashed rootfs before `mkfs.ext4 -d`, flattening every legitimately non-root path. `sudo unsquashfs` already restores the source squashfs's uid/gid and `mkfs.ext4 -d` copies them through, so the flatten is pure destruction — the author even had to hand-repair /var/cache/man afterward because the blanket chown clobbered it. Its worst victim is /home/frappe (uid 1000): when a promoted base image is re-served as a squashfs and fanned out host-to-host via sync-image, the reconstituted image on every non-home host booted into `cd /home/frappe/pilot: Permission denied`. This is the only path that hits buildExt4 (promote / snapshot-clone / migration are all block-level), which is exactly why the home host and clones stayed correct. Remove the blanket chown so ownership is preserved end-to-end. Keep the guarded, numeric man-cache normalization as a standalone belt-and-suspenders (it is correct regardless of the source and independent of the removed chown). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Assert the blanket `chown -R root:root` is gone, the ext4 is still built straight from the ownership-preserving extracted tree, and the guarded man-cache normalization still runs. Fails if the flatten is reintroduced. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem (downstream symptom hit live)
When a promoted base image is fanned out host-to-host via
sync-image(re-served as a squashfs and reconstituted on the target), non-root paths — notably/home/frappe— ended up ownedroot:root. A server booting that distributed image then failed with:on any host that was not the golden's promote-home. The promoted image on the home host was fine (uid 1000), and snapshot-clones were fine.
Root cause
internal/image/rootfs.go: buildExt4ran a blanketover the unsquashed tree just before
mkfs.ext4 -d.sudo unsquashfsalready restores the source squashfs's uid/gid faithfully andmkfs.ext4 -dcopies them through, so the blanket chown is pure destruction — it flattens every legitimately non-root path (/home/frappeat uid 1000 most damagingly). The author already knew it was destructive: the very next lines hand-repaired/var/cache/man(chown6:12) because the blanket chown had clobbered it — but nothing restored/home/frappe.buildExt4is reached only fromSyncImage(the URL / reconstitution path). Promote, snapshot-clone and migration base-ship are all block-level (dd / dm-clone / NBD), which preserve ownership — exactly why the home host and clones stayed correct while sync-image distribution broke.Fix
Remove the blanket
chown -R root:rootso uid/gid are preserved end-to-end on reconstitution. Keep the guarded, numeric man-cache normalization as a standalone belt-and-suspenders (correct regardless of the source, independent of the removed chown).Verification
make build— green.go test ./...— all packages pass.TestSyncImagePreservesTreeOwnership: asserts the blanket flatten is gone, the ext4 is still built straight from the ownership-preserving extracted tree, and the man-cache normalization still runs. Confirmed it fails when the blanket chown is reintroduced and passes with the fix.🤖 Generated with Claude Code