{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/14632","labels_url":"https://api.github.com/repos/docker/docker/issues/14632/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/14632/comments","events_url":"https://api.github.com/repos/docker/docker/issues/14632/events","html_url":"https://github.com/docker/docker/pull/14632","id":95026760,"number":14632,"title":"Chown contents on volume mount if user specifies :u","user":{"login":"rhatdan","id":2000835,"avatar_url":"https://avatars.githubusercontent.com/u/2000835?v=3","gravatar_id":"","url":"https://api.github.com/users/rhatdan","html_url":"https://github.com/rhatdan","followers_url":"https://api.github.com/users/rhatdan/followers","following_url":"https://api.github.com/users/rhatdan/following{/other_user}","gists_url":"https://api.github.com/users/rhatdan/gists{/gist_id}","starred_url":"https://api.github.com/users/rhatdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhatdan/subscriptions","organizations_url":"https://api.github.com/users/rhatdan/orgs","repos_url":"https://api.github.com/users/rhatdan/repos","events_url":"https://api.github.com/users/rhatdan/events{/privacy}","received_events_url":"https://api.github.com/users/rhatdan/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/1-needs-design-review","name":"status/1-needs-design-review","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":22,"created_at":"2015-07-14T19:58:16Z","updated_at":"2015-07-15T19:43:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/14632","html_url":"https://github.com/docker/docker/pull/14632","diff_url":"https://github.com/docker/docker/pull/14632.diff","patch_url":"https://github.com/docker/docker/pull/14632.patch"},"body":"This patch follows the same pattern as the :Z and :z patch.\r\n\r\nBasically it will recursively chown the content on container\r\ncreation iff user specifies :u on volume mount and --user at the\r\nsame time.  Once we get usernamespace this could be extended to\r\ndo the same thing to match the primary UID of the container.\r\n\r\nDocker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/121724257","html_url":"https://github.com/docker/docker/pull/14632#issuecomment-121724257","issue_url":"https://api.github.com/repos/docker/docker/issues/14632","id":121724257,"user":{"login":"eparis","id":8093535,"avatar_url":"https://avatars.githubusercontent.com/u/8093535?v=3","gravatar_id":"","url":"https://api.github.com/users/eparis","html_url":"https://github.com/eparis","followers_url":"https://api.github.com/users/eparis/followers","following_url":"https://api.github.com/users/eparis/following{/other_user}","gists_url":"https://api.github.com/users/eparis/gists{/gist_id}","starred_url":"https://api.github.com/users/eparis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eparis/subscriptions","organizations_url":"https://api.github.com/users/eparis/orgs","repos_url":"https://api.github.com/users/eparis/repos","events_url":"https://api.github.com/users/eparis/events{/privacy}","received_events_url":"https://api.github.com/users/eparis/received_events","type":"User","site_admin":false},"created_at":"2015-07-15T19:43:38Z","updated_at":"2015-07-15T19:43:38Z","body":"This is exactly as dangerous as the selinux :z feature no doubt about it. Exactly the same way that :z can add or remove permissions so can :u.  Blocking :u in the same places we block :z makes perfect sense.\r\n\r\nConsider `docker run --user=bob -v /tmp/container1:/tmp`  the host operator actually has no/extremely little idea what the required uid is.  the \"bob\" uid is determined by /etc/passwd inside the container, right? This is the exact same reason that :z is required. The operator doesn't know what value docker is going to use, and in fact this value could change! The operator is not able to do the chown -R himself with ANY degree of usefulness.\r\n\r\nHowever `docker run --user=bob -b /tmp/container1:/tmp:u,z` does in fact work, is predictable and reliable, and provides the expected user experience."}}