Repository navigation
feat: add the umask service attribute - #942
Merged
Merged
Conversation
umask sets the initial file mode creation mask of the container's processes (entrypoint, exec and healthcheck), as proposed by compose-spec#659 and made available by the engine in docker 29.8 (HostConfig.Umask, docker/cli#7108). The model keeps a *uint32 so that an explicit `umask: 0`, which masks no permission bit, stays distinct from an omitted or null umask, where the runtime default applies. A value is written like a YAML integer: a leading 0 or a 0o prefix makes it octal, so `077` and `0o77` are 63 while `77` is 77. Strings, including interpolated ones, are parsed the same way and rejected when they do not fit in 32 bits. The attribute belongs to the container specification, so it is accepted by services, jobs and pre_start init containers, and a pre_start step inherits the umask of its service. Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does, in one sentence
Adds the
umaskattribute, so a Compose file can set the file mode creation mask of a container's processes.Context
Docker 29.8 lets a container be created with an umask (
docker run --umask, docker/cli#7108, backed byHostConfig.Umaskfrom moby/moby#53463), applied consistently to the entrypoint,execand healthcheck processes. Compose files have no way to express it today. The attribute is proposed for the specification in compose-spec#659; this is the matching support in compose-go.What the PR brings
umaskis accepted on services, jobs andpre_startinit containers, as part of the container specification. Apre_startstep inherits the umask of its service unless it declares its own.0or a0oprefix makes it octal, so077and0o77both mean the octal mask077(63), while77stays the decimal 77. Strings, interpolated ones included (umask: ${UMASK}), follow the same rule.umask: 0, which masks no permission bit, is kept distinct from an omitted ornullumask, where the runtime default applies. The model exposes it as*uint32, the type the engine uses.0..4294967295(the spec proposal only has the lower bound), and out-of-range strings fail when parsed.The canonical output (
config) writes the umask as a plain integer:umask: 077comes back asumask: 63, which loads to the same value.Covered by conformance tests in
loader/tests/umask_test.go(notations,0vs unset, interpolation, override,pre_startinheritance, invalid values).🤖 Generated with Claude Code