The mergedDir has different permission mode on two hosts

[yiminmv]

Hi there,

I deployed two k8s clusters with CRI-O on two cloud VMs, and I found two nodes have different rootfs permissions. I observed that on AWS hosts, the directory /var/lib/containers/storage/overlay/<container-id>/merged mode is 0755, and on Azure hosts, this dir mode is 0555.

I have read some source code at the version of 1.24.5, and found by default, the mergedDir's mode is 0700, the code that I found out is idtools.MkdirAs(mergedDir, 0700, rootUID, rootGID).

I am not very familiar with this repo, does anyone know why? Or can someone please provide some information that can help to figure this out? Thanks very much!

[nalind]

The default mode for a container's rootfs when its base image doesn't specify one was changed from a default of 0755 to 0555 by the combination of #743 and #772. The permissions of the mountpoint itself (0700) are largely irrelevant, since the permissions of the root directory of the filesystem that's mounted there are what you actually see when something's mounted there, and there wasn't a perceived need to relax them beyond that.

[yiminmv]

Thanks for the reply, will continue the discussion on slack channel.