I've made two observations about volumes in the past when it came to change the data within a declared volume (respectively directory) from within the Dockerfile.
- You cannot change the owner and group of such a directory (see also https://stackoverflow.com/a/26145444/9816335).
- You cannot create a symlink inside such a directory (see also https://stackoverflow.com/a/63662898/9816335).
This is also stated in the Docker documentation.
Changing the volume from within the Dockerfile: If any build steps change the data within the volume after it has been declared, those changes will be discarded.
Both points are true when the image is built with the legacy builder but not when the image is built with BuildKit.
Steps to reproduce:
Create a Dockerfile with the following content:
FROM ubuntu # Create directory that will be declared as a volume # Since the command is executed with the root user, owner and group will be root RUN mkdir /my_volume # Mark /my_volume as volume VOLUME /my_volume # Create a symlink in /my_volume that links to an existing directory (/home) RUN ln -s /home /my_volume/home # Change owner and group from /my_volume RUN chown 1000:1000 /my_volume
Build from it two images; one with the legacy builder and one with BuildKit.
# DOCKER_BUILDKIT=0 docker build -t image_legacy .
# DOCKER_BUILDKIT=1 docker build -t image_buildkit .
Check the image built with legacy builder:
# docker run image_legacy ls -la /my_volume total 8 drwxr-xr-x 2 root root 4096 May 7 16:01 . drwxr-xr-x 1 root root 4096 May 7 16:19 ..
As stated in the documentation all changes have been discarded. The symlink has not been created and owner is still root.
Check the image built with BuildKit:
# docker run image_buildkit ls -la /my_volume total 8 drwxr-xr-x 2 1000 1000 4096 May 7 16:23 . drwxr-xr-x 1 root root 4096 May 7 16:23 .. lrwxrwxrwx 1 root root 5 May 7 16:01 home -> /home
It behaves differently with BuildKit. Symlink has been created and the
chown
command has been successfuly applied.
It looks like the original restrictions have been relaxed. But is this intended? I can't find any documentation about this.
Additional information:
I'm using Ubuntu 22.04.1 LTS on WSL and have installed Docker within ubuntu (not using Docker Desktop).