From e889e4c36a471ae0b36909f40be85f20414947dc Mon Sep 17 00:00:00 2001 From: webtecnica <75556242+webtecnica@users.noreply.github.com> Date: Sat, 11 Jul 2026 20:45:20 -0300 Subject: [PATCH] fix(docker): remove --link flag from COPY to support Podman/Buildah builds (#62849) --- Dockerfile | 5 ++--- tests/tools/test_dockerfile_immutable_install.py | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6f957f779678..284cfcdc96be 100644 --- a/Dockerfile +++ b/Dockerfile @@ -193,13 +193,12 @@ RUN cd web && npm run build && \ # ---------- Source code ---------- # .dockerignore excludes node_modules, so the installs above survive. -# --link decouples this layer from parents for cache purposes; --chmod bakes -# the final read-only permissions at copy time so we skip the separate +# `--chmod` bakes the final read-only permissions at copy time so we skip the separate # `chmod -R` pass that previously walked ~30k files across the venv + # node_modules + source (21s amd64 / 222s arm64 — #49113). `a+rX,go-w` # gives the non-root hermes user read + traverse but no write; root retains # write so the build steps below don't need chmod u+w dances. -COPY --link --chmod=a+rX,go-w . . +COPY --chmod=a+rX,go-w . . # ---------- Permissions ---------- # Link hermes-agent itself (editable). Deps are already installed in the diff --git a/tests/tools/test_dockerfile_immutable_install.py b/tests/tools/test_dockerfile_immutable_install.py index c712bb63ceab..43ab0bf49573 100644 --- a/tests/tools/test_dockerfile_immutable_install.py +++ b/tests/tools/test_dockerfile_immutable_install.py @@ -17,7 +17,7 @@ def test_dockerfile_makes_opt_hermes_readonly_for_hermes_user() -> None: # --chmod on the source COPY bakes read-only perms at copy time instead # of a separate chmod -R pass (which walked ~30k files — #49113). - assert "COPY --link --chmod=a+rX,go-w . ." in text + assert "COPY --chmod=a+rX,go-w . ." in text # The old tree-walking passes must not be present. assert "chown -R root:root /opt/hermes" not in text assert "chmod -R a+rX /opt/hermes" not in text