Skip to content

fix(docker): remove --link flag from COPY to support Podman/Buildah builds (#62849) #62906

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
webtecnica wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(docker): remove --link flag from COPY to support Podman/Buildah builds (#62849) #62906

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,13 +193,12 @@ RUN cd web && npm run build && \

# ---------- Source code ----------
# .dockerignore excludes node_modules, so the installs above survive.
# --link decouples this layer from parents for cache purposes; --chmod bakes
# the final read-only permissions at copy time so we skip the separate
# `--chmod` bakes the final read-only permissions at copy time so we skip the separate
# `chmod -R` pass that previously walked ~30k files across the venv +
# node_modules + source (21s amd64 / 222s arm64 — #49113). `a+rX,go-w`
# gives the non-root hermes user read + traverse but no write; root retains
# write so the build steps below don't need chmod u+w dances.
COPY --link --chmod=a+rX,go-w . .
COPY --chmod=a+rX,go-w . .

@teknium1 teknium1 Jul 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The #62849 reproduction fails on Error parsing chmod a+rX,go-w; this line still supplies that exact symbolic --chmod value. Removing --link alone therefore leaves the reported Buildah failure path unchanged. Please replace or avoid the unsupported chmod syntax while preserving the immutable-install permissions.


# ---------- Permissions ----------
# Link hermes-agent itself (editable). Deps are already installed in the
Expand Down
2 changes: 1 addition & 1 deletion tests/tools/test_dockerfile_immutable_install.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ def test_dockerfile_makes_opt_hermes_readonly_for_hermes_user() -> None:

# --chmod on the source COPY bakes read-only perms at copy time instead
# of a separate chmod -R pass (which walked ~30k files — #49113).
assert "COPY --link --chmod=a+rX,go-w . ." in text
assert "COPY --chmod=a+rX,go-w . ." in text
# The old tree-walking passes must not be present.
assert "chown -R root:root /opt/hermes" not in text
assert "chmod -R a+rX /opt/hermes" not in text
Expand Down
Loading