Fix Windows COPY --parents with SeBackupPrivilege #6364
+200
−39
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
area/dockerfile
area/testing
area/windows
area/frontend
area/solver
labels
jsternberg
approved these changes
Nov 14, 2025
tonistiigi
reviewed
Nov 14, 2025
| func copyWithElevatedPrivileges(ctx context.Context, srcRoot string, src string, destRoot string, dest string, opt ...copy.Opt) error { | ||
| privileges := []string{winio.SeBackupPrivilege} | ||
|
|
||
| if err := winio.EnableProcessPrivileges(privileges); err != nil { |
Member
There was a problem hiding this comment.
How does this work with parallel build steps?
Note that there is already similar code in contenthash. That one seems to use a reference counter.
Collaborator
Author
There was a problem hiding this comment.
@tonistiigi Regarding this issue, I think the right approach isn’t to check permissions to allow copying system-protected folders, but rather to skip those folders during the copy process.
I’ve opened a PR in your fsutil repository that updates the Copy function so it respects the exclusion list before making the OS system call that triggers the “access denied” errors. This should help resolve many permission-related problems on the system.
Please take a look and let me know what you think.
PR: tonistiigi/fsutil#243
rzlink
force-pushed
the
windows-copy-sebackup-privilege
branch
from
9b47baa to
bf339ac
Compare
rzlink
force-pushed
the
windows-copy-sebackup-privilege
branch
from
bf339ac to
3f03454
Compare
Introduce util/winprivileges package with reference-counted privilege
management to prevent race conditions when multiple goroutines need
SeBackupPrivilege concurrently in parallel builds.
This fixes Windows COPY operations that fail with 'Access is denied'
errors when reading protected system files ('System Volume Information'
and 'WcSandboxState') in container mount roots.
Implementation:
- Create util/winprivileges with reference-counted Enable/Disable functions
- Use process-wide privileges (not thread-local) for multi-threaded context
- Update cache/contenthash to use centralized manager
- Update solver/llbsolver/file/backend_windows.go copyWithElevatedPrivileges
- Update session/filesync/diffcopy_windows.go sendDiffCopy
- Remove direct winio.EnableProcessPrivileges/DisableProcessPrivileges calls
- Coordinate privilege management across all components
The reference counting ensures that when multiple operations need the
privilege simultaneously (e.g., parallel builds), the privilege remains
enabled until all operations complete, preventing race conditions where
one goroutine disables the privilege while another still needs it.
Fixes #6635
Signed-off-by: Dawei Wei <[email protected]>
rzlink
force-pushed
the
windows-copy-sebackup-privilege
branch
from
3f03454 to
8bd5e4a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes copying from Windows container mount roots by using SeBackupPrivilege to handle protected system files ('System Volume Information' and 'WcSandboxState') that cause 'Access is denied' errors when reading file metadata.
Implementation:
Test changes:
The access denied errors occur during os.Lstat() when reading file metadata. SeBackupPrivilege allows reading this metadata even with restrictive ACLs on Windows container volumes.
Fixes #6335