Buildkit: Docker build secrets owned by root

[Lactem]

This issue is similar to #760 but applies specifically to the mount type "secret" and contains an example where the target file is owned by root even when its path is in the home directory of another user.

Issue

Using the experimental "--mount" feature to access a secret (file) passed in from docker build --secret only allows the file to be read by the root user. It would be ideal there were a way to specify which user(s) can access the secret (for any type of mount).

Example

My use case is supplying a gradle.properties file containing login credentials to a private repo needed to build a JAR. An example Dockerfile that currently fails is:

# syntax = docker/dockerfile:experimental
FROM gradle:4.8-jdk8 AS build
# This image runs by default as the user gradle in the directory /home/gradle
COPY gradlew gradlew
COPY build.gradle build.gradle
ADD gradle/wrapper gradle/wrapper
COPY settings.gradle settings.gradle
RUN mkdir -p /home/gradle/.gradle
RUN --mount=type=secret,id=gradle_properties,target=/home/gradle/.gradle/gradle.properties,required ./gradlew jar --stacktrace

To reproduce the error using this Dockerfile, navigate to the Gradle project directory and run: docker build --secret=id=gradle_properties,src=/home/YOUR_USERNAME/.gradle/gradle.properties -t YOUR_IMAGE:YOUR_TAG .

And the error that results is:

Exception in thread "main" java.lang.RuntimeException: Error when loading properties file=/home/gradle/.gradle/gradle.properties
at org.gradle.wrapper.SystemPropertiesHandler.getSystemProperties(SystemPropertiesHandler.java:42)
at org.gradle.wrapper.GradleWrapperMain.addSystemProperties(GradleWrapperMain.java:68)
at org.gradle.wrapper.GradleWrapperMain.main(GradleWrapperMain.java:56)
Caused by: java.io.FileNotFoundException: /home/gradle/.gradle/gradle.properties (Permission denied)
java.io.FileInputStream.open0(Native Method)
java.io.FileInputStream.open(FileInputStream.java:195)
java.io.FileInputStream.<init>(FileInputStream.java:138)
at org.gradle.wrapper.SystemPropertiesHandler.getSystemProperties(SystemPropertiesHandler.java:35)
... 2 more
------
rpc error: code = Unknown desc = executor failed running [/bin/sh -c ./gradlew jar --stacktrace]: exit code: 1

Workaround

For now I have to change the user to root before creating the JAR and then change ownership of the JAR afterward. The final Dockerfile looks like:

# syntax = docker/dockerfile:experimental
FROM gradle:4.8-jdk8 AS build
COPY gradlew gradlew
COPY build.gradle build.gradle
ADD gradle/wrapper gradle/wrapper
COPY settings.gradle settings.gradle
USER root
RUN mkdir -p /home/gradle/.gradle
RUN --mount=type=secret,id=gradle_properties,target=/home/gradle/.gradle/gradle.properties,required ./gradlew jar --stacktrace
RUN chown -R gradle /home/gradle
USER gradle

[AkihiroSuda]

Implemented in https://github.com/moby/buildkit/pull/767

[tonistiigi]

Use #syntax=docker/dockerfile-upstream:master-experimental to test