Fix absolute hard links temp - #96
Closed
thaJeztah wants to merge 3 commits into
Closed
Conversation
Member
Author
|
Two failures; Remaining issueResolving hardlink targets through For paths that escape through a relative symlink, such as:
The fallback should only apply when the failure is caused by an absolute symlink that needs chroot-like rebasing. Relative symlink escapes must continue to be rejected. The existing |
thaJeztah
force-pushed
the
fix_absolute_symlinks_TEMP
branch
from
July 31, 2026 13:53
f548b62 to
db2c101
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #96 +/- ##
==========================================
- Coverage 65.81% 65.51% -0.30%
==========================================
Files 42 44 +2
Lines 2039 2320 +281
==========================================
+ Hits 1342 1520 +178
- Misses 519 588 +69
- Partials 178 212 +34 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The move to os.Root caused archive extraction to reject paths that traverse
absolute symlinks inside the destination. For example, given:
var/run -> /run
os.Root interprets /run as an absolute host path and reports that the path
escapes the root. Archive extraction instead requires chroot-like semantics,
where absolute symlink targets are resolved relative to the extraction root.
When os.Root cannot traverse an entry's parent, resolve it with fsRootPath and
continue extraction using the resulting root-relative path. Leave the final
component unresolved because extraction may create or replace it.
Apply this handling to Unpack and UnpackLayer, including implied directories,
whiteouts, deferred directory timestamps, and opaque-whiteout path tracking.
The actual filesystem operations continue to use os.Root and remain confined
to the extraction destination.
This is a compatibility workaround that resolves paths separately from their
use. It should eventually be replaced with handle-relative operations that
provide resolve-in-root semantics.
A regression test was added, which fails before this patch;
=== RUN TestUntarThroughAbsoluteSymlink
=== RUN TestUntarThroughAbsoluteSymlink/existing_target
archive_unix_test.go:558: assertion failed: error is not nil: statat var/run/existing/non-existing: path escapes from parent
=== RUN TestUntarThroughAbsoluteSymlink/missing_target
archive_unix_test.go:558: assertion failed: error is not nil: statat var/run/existing/non-existing: path escapes from parent
--- FAIL: TestUntarThroughAbsoluteSymlink (0.00s)
--- FAIL: TestUntarThroughAbsoluteSymlink/existing_target (0.00s)
--- FAIL: TestUntarThroughAbsoluteSymlink/missing_target (0.00s)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
force-pushed
the
fix_absolute_symlinks_TEMP
branch
from
July 31, 2026 14:13
895d6fe to
f01aca2
Compare
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Hardlink extraction failed when the source path crossed an absolute symlink inside a container root because os.Root treated the target as a host-rooted escape. Resolve the validated source with extraction-root semantics before linking, and reuse that bounded path when applying timestamps. Signed-off-by: Paweł Gronowski <git@grono.dev>
thaJeztah
force-pushed
the
fix_absolute_symlinks_TEMP
branch
from
July 31, 2026 14:16
f01aca2 to
6c3be27
Compare
Member
Author
|
Closing; pushed the commits to #93 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.