Docker build includes warning message

[pcgeek86]

Docker Version: 1.12.0-rc3
OS: Windows 10 RTM

Issue

1. Run docker build with the --quiet parameter
2. Output from command includes the expected image ID, but also includes a warning message

SECURITY WARNING: You are building a Docker image from Windows against a non-Windows Docker host. All files and directories added to build context will have '
-rwxr-xr-x' permissions. It is recommended to double check and reset permissions for sensitive files and directories.
sha256:18bd7a97e51e7f07dbbde2934d51252356a697172ef256d58133e3e3f117bafd

Expected Result

• The docker build command should not emit a warning message when the --quiet parameter is specified
• Extra parsing is required to extract the newly created image ID

Cheers,
Trevor Sullivan

[thaJeztah]

/cc @jhowardmsft wdyt?

[lowenna]

I don't have strong feelings either way, but it seems a reasonable suggestion.

[lowenna]

@ahmetalpbalkan Unless there was a specific reason I'm not aware of?

[thaJeztah]

agreed, I think it makes sense

@pcgeek86 do you want to open a pull request to change this behavior yourself?

[pcgeek86]

@thaJeztah I don't think you want me touching Docker source code. :) My best ability to contribute is through UX enhancement suggestions and such. The amount of time it would take me to learn about the Docker code and contribution processes would probably take too much time away from my business anyhow.

[lowenna]

Tis OK, I have a fix. Is really simple. PR coming shortly.

[thaJeztah]

@pcgeek86 no worries; just checking before I (or @jhowardmsft in this case) opened a pull request. Thanks for contributing through reporting issues 👍 it's appreciated

[ahmetb]

@jhowardmsft we added this mostly because we add +x to all files archived to context from Windows. And when they get extracted on Linux, all files having +x permission (without telling the user about this) is not quite secure. That's why I added it in the first place.

You can see the discussion at: #11397 I'd check with security folks to see if there are any concerns about removing this message.

[thaJeztah]

@ahmetalpbalkan thanks! I know about the reason it was added, and it's still printed, unless someone uses the --quiet option. I think it should be ok to suppress the message in that case (it's printed in all other cases, so users should be aware of the issue).

Happy to hear if there's concerns though

[ellismarkf]

@thaJeztah @ahmetalpbalkan @jhowardmsft

Would you mind explaining why making a file executable with the +x permission poses a security threat? Alternatively, links to resources on the subject would be great too. :)

Security is something I'm not an expert in, but I'd really like to know more. Thanks!