Repository navigation
Conversation
With a rootful runtime the container's root doesn't own the mounted host
repo, so git refuses to clone file:///source ("detected dubious
ownership") and every clone-mode run exits 128 before building. Trust
exactly /source/.git in the throwaway container before cloning.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
More details
The Git trust entry covers /source/.git before cloning in both shell and test modes and remains confined to the disposable container. Rootful Docker execution was not independently rerun.
🤖 Bits Code Review · Commit 591a886
CI Test ResultsRun: #38902416169 | Commit:
Status Overview
Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled Summary: Total: 32 | Passed: 32 | Failed: 0 Updated: 2026-10-16 13:07:31 UTC |
Effect:
./utils/run-containers-tests.sh --container=dockerworks in its default clone mode with a rootful Docker daemon. Before, every cell failed at the clone step with exit 128, before anything was built.What does this PR do?:
Clone mode mounts the repo read-only at
/sourceand runsgit clone file:///source /workspaceinside the container. Under rootful Docker, root in the container doesn't own the host repo, and git refuses to clone it:The clone command now runs
git config --global --add safe.directory /source/.gitfirst. The exception covers only that path, in a container that is discarded after the run. Rootless podman (the default runtime) maps the user's UID, so it never hit this, and nothing changes for it.Motivation:
Hit on an x64 Linux dev VM with rootful Docker: all seven cells of a test matrix failed at the clone.
Additional Notes:
-c safe.directory=…togit cloneisn't enough with the glibc image's git 2.34.1 (tested), hence the global config entry.--mountmode needs no change: the only git calls in the build come fromutils/compute-version.sh, which already passes-c safe.directory..gitlab-ci.yml,.gitlab/or.github/invokes this script.How to test the change?:
bash -n utils/run-containers-tests.shgit clone file:///sourcefails without the entry and succeeds with it (java-profiler-test:glibc-jdk21-x64with git 2.34.1,java-profiler-test:musl-jdk21-x64with git 2.47.3)../utils/run-containers-tests.sh --container=docker --libc=glibc --arch=x64 --jdk=21 --config=debug --gtest-task=xorshift_utclones, builds and passes (BUILD SUCCESSFUL); before the change it exited 128 at the clone.For Datadog employees:
credentials of any kind, I've requested a security review (run the
dd:platform-security-reviewskill, or file a request via the PSEC review form).
bewairealso runs automatically on every PR.🤖 Generated with Claude Code