fix: report when docker cp silently writes nothing - #487
Merged
Conversation
Fixes #387. `docker cp` cannot write into a mount. A destination under a tmpfs or a volume goes to the container's own filesystem layer, which the mount then hides -- and docker exits 0 with no output, so the copy looks like it worked and the file is simply not there. Nothing caught that, so the failure surfaced later and somewhere else. With `tmpfs: /tmp`, which is how the Docker documentation suggests running systemd, the first sign was the next command failing with /bin/bash: /tmp/docker-<uuid>.sh: No such file or directory which names neither the copy nor the mount, and reads like the driver wrote a broken script rather than none at all. The copy is now checked, and reported where the cause is still known: Failed to copy file ./.kitchen/temp/docker-<uuid>.sh to container. docker reported no error copying it to /tmp, but the file is not there. `docker cp` cannot write into a mount -- if /tmp is a tmpfs or a volume, set the transport's temp_dir and the provisioner's root_path to a path that is not. `docker cp SRC CONTAINER:DEST` copies into DEST when DEST is a directory and to DEST otherwise, and which one it was is only known inside the container, so the probe makes that choice there rather than asking twice. Both paths are passed to `sh` as arguments rather than interpolated, so nothing in either is read as shell syntax. Windows containers are not probed: tmpfs is a Linux container feature, and `docker cp` against a Windows container is a separate code path in Docker that this could not be tried against. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
tas50
force-pushed
the
fix/docker-cp-into-mount
branch
from
August 23, 2026 16:52
0b6acb6 to
d9ffa0a
Compare
Contributor
|
Hey @tas50, if I'm Reading the patch correctly, this doesn't make tmpfs /tmp work, merely provides a more descriptive error message? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #387.
The bug
docker cpcannot write into a mount. A destination under a tmpfs or a volume is written to the container's own filesystem layer, which the mount then hides -- and docker exits 0 with no output. The copy looks like it worked and the file is simply not there.Confirmed at the Docker level (29.7.2), against a container run with
--tmpfs /tmp:Nothing caught that, so the failure surfaced later and somewhere else.
tmpfs: /tmpis how the Docker documentation suggests running systemd in a container, and the first sign was the next command failing:That names neither the copy nor the mount, and reads like the driver wrote a broken script rather than none at all.
The fix
The copy is checked, and reported where the cause is still known:
docker cp SRC CONTAINER:DESTcopies into DEST when DEST is a directory and to DEST otherwise; which one happened is only known inside the container, so the probe makes that choice there rather than asking twice from the host. Both paths are passed toshas arguments rather than interpolated, so nothing in either is read as shell syntax.Windows containers are not probed. tmpfs is a Linux container feature, and
docker cpagainst a Windows container is a separate code path in Docker that I could not try this against, so those keep the behaviour they have.This diagnoses the failure rather than making
docker cpwork into a mount, which Docker does not support. The advice it gives is verified below.Confirmation
Docker 29.7.2 (Docker Desktop 4.87.0, macOS/arm64), Test Kitchen 4.1.1, real
ubuntu-24.04containers.Before --
/bin/bash: /tmp/docker-<uuid>.sh: No such file or directory, as above.After, same
kitchen.yml-- the error quoted above, raised at the copy.Then taking the advice the message gives (
transport.temp_dir: /var/tmp,provisioner.root_path: /var/tmp/kitchen), withtmpfs: /tmpstill mounted:Regression checks, both still passing: an ordinary docker-transport converge with no tmpfs, and a converge over the default SSH transport.
rake styleclean;rspec313 examples, 0 failures (7 new).