Skip to content

Skopeo leaks details about the host in oci-archives #1627

@graywolf-at-work

Description

@graywolf-at-work

When running

skopeo copy docker://docker.io/library/ubuntu@sha256:b2339eee806d44d6a8adc0a790f824fb71f03366dd754d400316ae5a7e3ece3e oci-archive:/tmp/x.tar

the resulting /tmp/x.tar contains references to the current user. In particular
it seems that uname and gname are set to the current user and group. uid and
gid are set as well (I think they should simply be 0 since they are not
relevant on this level in the oci-archive). I don't think there is a good
reason to leak this information about the host running the skopeo-copy.

I think the same happening even with the layers inside the oci-archive when
doing podman save, but I assume root cause will be the same so I'm not filling
that separately (I can if it is desired).

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugA defect in an existing functionality (or a PR fixing it)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions