Software1 hOctober 21, 2026, 05:40

BuildKit silently gives files to root on missing --chown user

With Docker 29.9.1, buildx v0.38.0 and BuildKit v0.34.0, a COPY --chown=nosuchuser build exits 0 and leaves files owned by 0:0 with no warning. Numeric IDs of 2^31 or more also become root, and a missing group with a numeric user falls back to that user's group. Only --link and a FROM scratch stage without passwd fail.

DEV Community

Open source

BuildKit silently gives files to root on missing --chown user

COPY --chown=nosuchuser built with exit 0, file owned by 0:0
IDs of 2147483648 and above are treated as names and become root
chown=1000:nosuchgroup produced 1000:1000 instead of an error
Fix buildkit#7295 was closed unmerged on October 20

#Docker#BuildKit

Rootless Docker builds silently ignore BuildKit memory limits

Software

Docker Engine 29.9.1 brings CVE fixes and behavior changes for self-hosters

Security

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Security

BuildKit silently gives files to root on missing --chown user

Rootless Docker builds silently ignore BuildKit memory limits

Docker Engine 29.9.1 brings CVE fixes and behavior changes for self-hosters

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Silent Ransom Group Allegedly Extorted $207 Million Without Encrypting Files