Skip to content

2026-07-22.01-world-readable-hosts-file.md

Latest commit

 

History

History
50 lines (39 loc) · 2.15 KB

2026-07-22.01-world-readable-hosts-file.md

File metadata and controls

50 lines (39 loc) · 2.15 KB
Raw
summary Generated scripts chmod the owned /etc/hosts to 644 so non-root service images can read it; without it name resolution fell through to DNS and failed.

Change: chmod the owned /etc/hosts world-readable

Lane: lightweight — ≲30 LOC net, ≤2 files, no new file, no public-API change, a single straightforward test.

Goal

Fix pod-internal name resolution for service images that run as a non-root user. On Podman 5.x/6.x, a 0.4.0 script emits hostsfile=$(mktemp) — mode 0600, owned by the invoking user — and bind-mounts it read-only as /etc/hosts into every container. A non-root process cannot read a 0600 root-owned file, so glibc skips /etc/hosts, falls through to DNS, and every lookup fails with could not translate host name "db": Temporary failure in name resolution. Root-user images were unaffected, which is why the 0.4.0 mechanism passed validation (all probes ran as root).

Approach

Emit one line, chmod 644 "$hostsfile", immediately after the printf that writes the file and before the first podman run mounts it. The file holds only hostname → 127.0.0.1 and extra_hosts (hostname → ip) lines — nothing secret — so world-readable is correct. umask cannot substitute: mktemp forces 0600 regardless. Truth home: architecture/supported-subset.md (networking / owned-/etc/hosts bullet).

Reproduced on real Podman 5.8.1 (via quay.io/podman/stable:v5.8.1): a non-root member gets cat: /etc/hosts: Permission denied and socket.gaierror without the chmod; resolves db → 127.0.0.1 with it.

Files

  • compose2pod/emit.py — append the chmod 644 "$hostsfile" line after the hosts-file write.
  • tests/test_emit.py — assert the chmod line is emitted, ordered after the write and before the first podman run.

Verification

  • Failing test first — pytest -k test_hosts_file_made_world_readable fails: assert 'chmod 644 "$hostsfile"' in lines.
  • Apply the change.
  • Test passes.
  • just test-ci — 1402 passed, 100% coverage.
  • just lint-ci — clean.
  • End-to-end on Podman 5.8.1 — fixed-generator script runs a non-root app that resolves db.