Description

I have been running into an issue running containers when setting umask on the host to something more restrictive than the default of 0022. What I am observing is that the /etc/resolv.conf file in the container conforms to the umask on the host which is not what I would expect. I would like for that file in the container to be world readable but when using a more restrictive umask on the host that file's permissions in the container are also restricted. You can observe this behavior by following the steps below. Note that the container image has a default non-root user of buildozer.

Steps to reproduce the issue

Default Umask

$ umask 0022; nerdctl run --rm -it alpinelinux/build-base:latest nslookup www.wikipedia.org

--- WORKS ---

Restrictive Umask

$ umask 0027; nerdctl run --rm -it alpinelinux/build-base:latest nslookup www.wikipedia.org

--- DOES NOT WORK ---

Restrictive Umask as Root

$ umask 0027; nerdctl run --rm -it -u root alpinelinux/build-base:latest nslookup www.wikipedia.org

--- WORKS ---

You can observe the file permissions when running umask differently.

$ umask 0022; nerdctl run --rm -it -u root alpinelinux/build-base:latest ls -l /etc/resolv.conf
$ umask 0027; nerdctl run --rm -it -u root alpinelinux/build-base:latest ls -l /etc/resolv.conf

Note that with 0022 the file is world readable while with 0027 it is not.

Describe the results you received and expected

I observe that the /etc/resolv.conf file in the container is not world readable. I would expect that the umask on the host would not propagate to the container environment in such a way that the /etc/resolv.conf file's permissions becomes restricted. This restrictions causes DNS queries to fail for non-root users. I suspect this is related to some kind of copy operation occurring on the host which applies the umask settings.

What version of nerdctl are you using?

1.7.0

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

No response