From d83fa77de4a59bd5cf02a555376b7209a33f0502 Mon Sep 17 00:00:00 2001 From: silverwind Date: Tue, 22 Sep 2026 01:20:16 +0000 Subject: [PATCH] enhance: support `--umask` in `container.options` (#1238) Re-sync `act/container/docker_cli.go` and `act/container/docker_cli_test.go` to docker/cli v29.8.1, the version go.mod pins. The copies lacked the `--umask` flag added in v29.8.0, so `container.options` rejected it as unknown. Daemons below API 1.56 ignore the setting. Reviewed-on: https://gitea.com/gitea/runner/pulls/1238 Reviewed-by: Lunny Xiao Co-authored-by: silverwind --- act/container/docker_cli.go | 8 +++++++- act/container/docker_cli_test.go | 15 ++++++++++++++- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/act/container/docker_cli.go b/act/container/docker_cli.go index e9135d36..a515c1f8 100644 --- a/act/container/docker_cli.go +++ b/act/container/docker_cli.go @@ -4,9 +4,10 @@ //go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) -// This file is exact copy of https://github.com/docker/cli/blob/dfc4efb1e2ab8c06d70d2a1366ad448d2f917e90/cli/command/container/opts.go with: +// This file is exact copy of https://github.com/docker/cli/blob/4a63305d74332de5ceba7fcbccbc3cbb7412f5ba/cli/command/container/opts.go with: // * appended with license information // * regexp and loader.ParseVolume in place of the import-restricted internal/lazyregexp and internal/volumespec +// * jsontext in place of json.Compact for the seccomp profile // * invalidParameter from the package's errors.go, and convertPortSet/convertPortMap for the callers in docker_run.go // // docker/cli is licensed under the Apache License, Version 2.0. @@ -152,6 +153,7 @@ type containerOptions struct { runtime string autoRemove bool init bool + umask opts.UmaskOpt annotations *opts.MapOpts Image string @@ -326,6 +328,9 @@ func addFlags(flags *pflag.FlagSet) *containerOptions { flags.Var(&copts.shmSize, "shm-size", "Size of /dev/shm") flags.StringVar(&copts.utsMode, "uts", "", "UTS namespace to use") flags.StringVar(&copts.runtime, "runtime", "", "Runtime to use for this container") + flags.Var(&copts.umask, "umask", "Set umask for the container") + flags.SetAnnotation("umask", "version", []string{"1.56"}) + flags.SetAnnotation("umask", "ostype", []string{"linux"}) flags.BoolVar(&copts.init, "init", false, "Run an init inside the container that forwards signals and reaps processes") flags.SetAnnotation("init", "version", []string{"1.25"}) @@ -721,6 +726,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con MaskedPaths: maskedPaths, ReadonlyPaths: readonlyPaths, Annotations: copts.annotations.GetAll(), + Umask: copts.umask.Value(), } if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() { diff --git a/act/container/docker_cli_test.go b/act/container/docker_cli_test.go index 6b1f4e77..ab38d874 100644 --- a/act/container/docker_cli_test.go +++ b/act/container/docker_cli_test.go @@ -2,7 +2,7 @@ // Copyright 2022 The nektos/act Authors. All rights reserved. // SPDX-License-Identifier: MIT -// This file is exact copy of https://github.com/docker/cli/blob/dfc4efb1e2ab8c06d70d2a1366ad448d2f917e90/cli/command/container/opts_test.go with: +// This file is exact copy of https://github.com/docker/cli/blob/4a63305d74332de5ceba7fcbccbc3cbb7412f5ba/cli/command/container/opts_test.go with: // * appended with license information // * added tests for the locally changed parseDevice, validateDevice and invalidParameter // @@ -167,6 +167,19 @@ func TestParseRunLinks(t *testing.T) { } } +func TestParseRunWithoutUmask(t *testing.T) { + _, hostConfig, _, err := parseRun([]string{"ubuntu", "bash"}) + assert.NilError(t, err) + assert.Assert(t, hostConfig.Umask == nil) +} + +func TestParseRunUmask(t *testing.T) { + _, hostConfig, _, err := parseRun([]string{"--umask", "0022", "ubuntu", "bash"}) + assert.NilError(t, err) + assert.Assert(t, hostConfig.Umask != nil) + assert.Equal(t, uint32(0o22), *hostConfig.Umask) +} + func TestParseRunAttach(t *testing.T) { tests := []struct { input string