COPY cache not re-used depending on SELinux environment

[56KBs]

Opened as requested by @thaJeztah in moby/moby#39003 (comment)_

When attempting to docker build with --cache-from the cache for COPY (and presumably ADD) commands is ignored if the two systems do not both use SELinux.

For example, if you were to build an image on Ubuntu (No SELinux) and use the image as a cache in CentOS (SELinux enabled by default), the cache is ignored for COPY commands. The same is true vice-versa.

To reproduce

I have done the following on Ubuntu 18.04 with Docker 19.03.5

FROM debian:stretch-slim
RUN ls -l
COPY ./this-is-a-file ./
RUN ls -l

And then

echo "this is a file" > this-is-a-file
DOCKER_BUILDKIT=1 docker build --build-arg BUILDKIT_INLINE_CACHE=1 --tag invalid-cache:ubuntu -f Dockerfile .

Push this image to a docker repository somewhere.

Then on a CentOS machine (Or anything with SELinux), create the same Dockerfile and run:

echo "this is a file" > this-is-a-file
docker pull debian:stretch-slim
docker pull invalid-cache:ubuntu
DOCKER_BUILDKIT=1 docker build --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from invalid-cache:ubuntu--tag invalid-cache:centos -f Dockerfile .

You'll see that the cache isn't used for the COPY command. I have assumed this is due to the SELinux permissions, if you build the same image on the same machine with SELinux where this-is-a-file has different security context you'll notice the same issue.

[websolutions-hamburg]

Is this fix already included in the current Docker Release v19.03.8? I still have this issue with my local Mac OS v10.14 and Ubuntu v18.04.

[mttradebyte]

I too have the same issue running v19.03.9 on macOS and Ubuntu. Both machines produce reproducible image IDs when using --cache-from, but they differ between the two systems.

It looks like moby/moby references buildkit commit ae7ff71 which does include this change, so I'm confused why it's still creating differing IDs between the 2 systems.

@tonistiigi sorry for the @, but is there any chance you can confirm whether this is currently in docker-ce v19.03.9? A couple of us are still having issues and would just like to know if it's something else or indeed the same issue due to it not being released yet. Thanks.

[tonistiigi]

This fix is not in 19.03