SABITH SAHEB e59d118556 daemon: Create policy trust dir with mode 0o700 ...

The image policy verifier creates its trust directory (<root>/policy/tuf)
with the wrong mode (0o644) making it non-traversable. Update the permissions
to 0o700, matching other persistent state directories under the daemon root.

In addition, there is no need to pre-create the "tuf" subdirectory, which
is created (if needed) by policy-helpers/root.NewTrustProvider.

fixes 8890f815ca

Signed-off-by: SABITH SAHEB <shabi7204192361@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 93c94fd6ae)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

2026-07-16 14:57:47 +02:00

..

builder

fix formatting strings for go1.26

2026-04-21 15:59:27 +02:00

cluster

fix: propagate registry auth error in swarm image pull

2026-06-12 15:37:21 +02:00

command

daemon: Set umask to 0000

2026-06-17 14:22:50 +02:00

config

api: Bump to 1.55

2026-06-11 19:37:35 +02:00

container

daemon: support per-device blkio throttle in ContainerUpdate

2026-06-12 15:52:14 +02:00

containerd

Merge pull request #52773 from vvoland/c8d-amd64-variants

2026-06-18 20:43:08 +02:00

events

daemon/internal/timestamp: replace GetTimestamp for Parse

2026-03-03 21:51:41 +01:00

graphdriver

daemon: Adjust file permissions for umask 000

2026-06-17 14:57:17 +02:00

images

api: add GET /images/{name}/attestations endpoint

2026-06-12 13:40:58 +04:00

initlayer

…

internal

libcontainerd/supervisor: Document inherited containerd umask

2026-06-17 14:57:17 +02:00

libnetwork

Merge pull request #52892 from vvoland/daemon-clear-umask

2026-06-17 19:50:13 +02:00

links

modernize: Use b.Loop (introduced in Go 1.24)

2025-12-15 18:56:33 +01:00

listeners

daemon/listeners: Support Unix socket on Windows

2026-04-16 11:02:16 +02:00

logger

daemon/logger/jsonfilelog: cleanup tests

2026-05-13 12:47:13 +02:00

names

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

network

daemon/internal/timestamp: replace GetTimestamp for Parse

2026-03-03 21:51:41 +01:00

pkg

rootless: fix plugin install by running ToRootless on plugin spec

2026-06-02 04:01:13 +09:00

server

daemon/router: Gate ContainerUpdate blkio device fields by API version

2026-06-12 15:52:31 +02:00

snapshotter

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

stats

api/types/container: StatsResponse: add OSType field

2025-10-27 16:39:32 +01:00

testdata

…

volume

daemon/volume/local: New: ignore non-volume directories

2026-04-01 23:48:56 +02:00

apparmor_default_unsupported.go

daemon: Always reload AppArmor profile at daemon startup

2026-05-05 14:53:13 +02:00

apparmor_default.go

daemon: fix AppArmor support check for detached-netns

2026-05-14 21:25:24 +09:00

apparmor_linux.go

daemon: fix AppArmor support check for detached-netns

2026-05-14 21:25:24 +09:00

apparmor_unsupported.go

daemon: fix AppArmor support check for detached-netns

2026-05-14 21:25:24 +09:00

archive_tarcopyoptions_unix.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

archive_tarcopyoptions.go

daemon: ContainerExtractToDir: make AllowOverwriteDirWithFile opt-in

2025-07-13 16:37:36 +02:00

archive_unix.go

daemon: Decompress archives before entering container filesystem

2026-05-18 16:20:32 +02:00

archive_windows.go

fix: typos in comments

2026-01-19 20:07:56 +09:00

archive.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

attach.go

api/pkg/stdcopy: move stdWriter to daemon/internal

2025-10-09 20:13:26 -04:00

auth.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

build.go

Create github.com/moby/moby/api module

2025-07-21 09:30:05 -07:00

cdi.go

daemon: CDI: fix missing error in logs

2026-02-21 21:43:11 +01:00

changes.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

checkpoint.go

api/types/checkpoint: move checkpoint options to client

2025-09-05 10:20:06 +02:00

cluster.go

daemon: report IPAM status for Swarm networks

2025-09-11 15:25:14 -04:00

commit.go

modernize: Use maps.Copy instead of for loops

2025-12-15 18:56:33 +01:00

configs.go

Create github.com/moby/moby/api module

2025-07-21 09:30:05 -07:00

container_linux.go

daemon: allow RawSysInfo to return an error

2026-06-11 17:39:03 +09:00

container_operations_test.go

Allow configured address with no configured subnet

2025-11-24 14:14:27 +00:00

container_operations_unix.go

daemon: retry secrets dir remount on transient EBUSY

2026-04-12 20:05:32 +02:00

container_operations_windows.go

chore: enable use-any rule from revive

2025-08-08 17:07:07 +02:00

container_operations.go

daemon: avoid redundant container lookup in service binding activation

2026-06-01 07:36:46 -07:00

container_unix_test.go

daemon: TestContainerWarningHostAndPublishPorts: use sub-tests

2026-05-14 00:42:27 +02:00

container_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

container.go

daemon: separate reserving SELinux label from loading

2026-05-07 12:11:13 +02:00

containerfs_linux_test.go

daemon/copy: Fix symlink escape in mount destination creation

2026-05-18 14:50:33 +02:00

containerfs_linux.go

daemon: resolve in-container symlinks before os.Root mount ops

2026-05-19 18:05:46 +02:00

content.go

…

create_unix.go

volume: Fix file subpath mount over existing image file

2026-05-11 13:55:43 +02:00

create_windows.go

Daemon.createContainerOSSpecificSettings - remove redundant param

2025-11-16 18:25:42 +00:00

create.go

daemon: add a deprecation warning about links on the default nw

2026-06-10 17:14:59 +02:00

daemon_linux_test.go

internal/testutils: merge with internal/testutil

2025-09-08 10:08:35 +02:00

daemon_linux.go

rootless: support detach-netns mode

2026-04-10 02:02:51 +09:00

daemon_test.go

fix formatting strings for go1.26

2026-04-21 15:59:27 +02:00

daemon_unix_test.go

daemon: use errdefs instead of string-matching in some places

2025-10-25 16:13:30 +02:00

daemon_unix.go

daemon: allow RawSysInfo to return an error

2026-06-11 17:39:03 +09:00

daemon_unsupported.go

rootless: support detach-netns mode

2026-04-10 02:02:51 +09:00

daemon_windows_test.go

…

daemon_windows.go

rootless: support detach-netns mode

2026-04-10 02:02:51 +09:00

daemon.go

daemon: Create policy trust dir with mode 0o700

2026-07-16 14:57:47 +02:00

debugtrap_unix.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

debugtrap_unsupported.go

…

debugtrap_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

delete_test.go

daemon/container: remove NewState() constructor

2025-09-19 15:33:36 +01:00

delete.go

daemon: separate reserving SELinux label from loading

2026-05-07 12:11:13 +02:00

dependency.go

…

devices_amd_linux.go

Use CDI for GPU injection for AMD devices for --gpus

2026-03-04 13:07:26 +00:00

devices_linux.go

daemon/devices: Turn RegisterGPUDeviceDrivers into func

2026-03-04 18:22:18 +01:00

devices_nonlinux.go

daemon/devices: Turn RegisterGPUDeviceDrivers into func

2026-03-04 18:22:18 +01:00

devices_nvidia_linux.go

Use CDI for GPU injection for AMD devices for --gpus

2026-03-04 13:07:26 +00:00

devices_test.go

Use CDI for GPU injection for AMD devices for --gpus

2026-03-04 13:07:26 +00:00

devices.go

go fix (GOOS=linux and windows)

2026-03-25 23:23:41 +01:00

disk_usage.go

daemon: Daemon.imageDiskUsage: explicitly exclude "-1" for containers

2026-04-10 21:57:45 +02:00

errors_test.go

…

errors.go

fix grammar: user defined / user specified -> user-(defined|specified)

2026-01-19 13:43:06 +01:00

events_test.go

daemon: prevent invalid swarm events from unknown action kinds

2026-02-22 15:26:24 +09:00

events.go

daemon: prevent invalid swarm events from unknown action kinds

2026-02-22 15:26:24 +09:00

exec_linux_test.go

daemon: fix AppArmor support check for detached-netns

2026-05-14 21:25:24 +09:00

exec_linux.go

daemon: fix AppArmor support check for detached-netns

2026-05-14 21:25:24 +09:00

exec_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

exec.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

export.go

remove uses of deprecated go-archive consts

2025-12-19 17:51:03 +01:00

health_test.go

daemon: fix healthcheck empty-cmd panic

2026-05-08 14:24:53 +02:00

health.go

daemon: replace minInt helper with builtin min

2026-06-16 07:27:51 +07:00

hosts_test.go

image: pull/load/save attestation manifest and signatures with image

2025-11-12 07:53:46 -08:00

hosts.go

image: pull/load/save attestation manifest and signatures with image

2025-11-12 07:53:46 -08:00

id.go

…

image_service.go

api: add GET /images/{name}/attestations endpoint

2026-06-12 13:40:58 +04:00

image_store_choice_test.go

daemon: Fix image store choice priority for prior graphdriver state

2025-11-13 10:05:49 +01:00

image_store_choice.go

daemon: Fix image store choice priority for prior graphdriver state

2025-11-13 10:05:49 +01:00

info_unix_test.go

…

info_unix.go

go.mod: github.com/rootless-containers/rootlesskit/v3 v3.0.0

2026-04-25 22:48:19 +09:00

info_windows.go

daemon: remove deprecation warning for "windows-dns-proxy" feature flag

2026-02-17 16:19:34 +01:00

info.go

daemon: allow RawSysInfo to return an error

2026-06-11 17:39:03 +09:00

inspect_test.go

daemon: make getInspectData() reusable

2026-05-12 12:48:03 +02:00

inspect.go

daemon: make getInspectData() reusable

2026-05-12 12:48:03 +02:00

keys_unsupported.go

…

keys.go

…

kill.go

Fix typos and misspellings in comments, tests, and docs

2026-04-02 14:20:22 -07:00

licensing_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

licensing.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

links.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

list_test.go

modernize: Use slices.Contains

2025-12-15 18:56:34 +01:00

list_unix.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

list_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

list.go

modernize: Use min built-in

2025-12-15 18:56:34 +01:00

logdrivers_linux.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

logdrivers_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

logs_test.go

Create github.com/moby/moby/api module

2025-07-21 09:30:05 -07:00

logs.go

daemon/server/backend: ContainerLogsOptions: use time.Time for since, until

2026-03-03 21:53:23 +01:00

migration_test.go

Fix typos and misspellings in comments, tests, and docs

2026-04-02 14:20:22 -07:00

migration.go

daemon/server: move GetImageOpts, ImageInspectOpts to imagebackend

2025-10-05 13:41:22 +02:00

monitor.go

bugfix: handle duplicate exit events via task status

2026-03-09 13:48:31 -04:00

mounts.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

names.go

modernize: Use range int

2025-12-15 18:56:34 +01:00

network_test.go

api/types/network: use netip types as appropriate

2025-10-03 21:39:14 +02:00

network_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

network.go

rootless: support detach-netns mode

2026-04-10 02:02:51 +09:00

oci_linux_test.go

daemon: preserve CDI additional GIDs

2026-05-08 15:24:38 +02:00

oci_linux.go

daemon: allow RawSysInfo to return an error

2026-06-11 17:39:03 +09:00

oci_opts.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

oci_utils.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

oci_windows_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

oci_windows.go

go fix (GOOS=linux and windows)

2026-03-25 23:23:41 +01:00

pause.go

daemon: use errdefs instead of string-matching in some places

2025-10-25 16:13:30 +02:00

prune.go

daemon/internal/timestamp: replace GetTimestamp for Parse

2026-03-03 21:51:41 +01:00

reload_test.go

daemon: Fix DNS config corruption on reload

2026-02-19 11:13:04 +01:00

reload_unix.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

reload_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

reload.go

daemon: log event after reload is committed

2026-05-08 17:05:15 -04:00

rename.go

daemon: improve validation for container rename

2025-10-29 18:42:36 +01:00

resize_test.go

daemon: use t.Context() in tests

2025-09-25 22:53:48 +02:00

resize.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

restart.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

runtime_unix_test.go

chore: enable use-any rule from revive

2025-08-08 17:07:07 +02:00

runtime_unix.go

daemon: isPermissibleC8dRuntimeName: fx link to c8d runtime conventions

2026-05-14 00:42:57 +02:00

runtime_windows.go

chore: enable use-any rule from revive

2025-08-08 17:07:07 +02:00

seccomp_linux_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

seccomp_linux.go

daemon: allow RawSysInfo to return an error

2026-06-11 17:39:03 +09:00

seccomp_unsupported.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

secrets.go

Create github.com/moby/moby/api module

2025-07-21 09:30:05 -07:00

start_linux.go

rootless: support detach-netns mode

2026-04-10 02:02:51 +09:00

start_notlinux.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

start_unix.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

start_windows.go

Fix custom runtimes handling on Windows

2025-08-08 21:41:17 +02:00

start.go

daemon/container: Container.Reset: remove "lock" argument

2026-01-28 15:13:41 +01:00

stats_collector.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

stats_unix_test.go

…

stats_unix.go

daemon: gofumpt

2026-01-24 17:16:05 +01:00

stats_windows.go

api/types/container: StatsResponse: add OSType field

2025-10-27 16:39:32 +01:00

stats.go

api/types/container: StatsResponse: add OSType field

2025-10-27 16:39:32 +01:00

stop.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

top_unix_test.go

…

top_unix.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

top_windows.go

Fix missing error check in ContainerTop on Windows

2026-02-10 12:35:48 -05:00

unpause.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

update_linux_test.go

daemon: support per-device blkio throttle in ContainerUpdate

2026-06-12 15:52:14 +02:00

update_linux.go

daemon: support per-device blkio throttle in ContainerUpdate

2026-06-12 15:52:14 +02:00

update_windows.go

daemon: support per-device blkio throttle in ContainerUpdate

2026-06-12 15:52:14 +02:00

update.go

daemon: support per-device blkio throttle in ContainerUpdate

2026-06-12 15:52:14 +02:00

volumes_linux_test.go

Create github.com/moby/moby/api module

2025-07-21 09:30:05 -07:00

volumes_linux.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

volumes_unit_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

volumes_unix.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

volumes_windows.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

volumes.go

daemon: rename vars that shadowed imports

2026-01-21 16:36:05 +01:00

wait.go

explicitly access Container.State instead of through embedded struct

2025-09-19 16:02:14 +02:00

workdir.go

update github links to moby/moby

2025-08-01 01:48:55 +02:00