validate: the staleness probe must not make the file unreadable - #1272
Merged
Conversation
The static staleness probe built its replacement with mktemp, which creates the file 0600. mv carries the source mode onto the destination, so after the replace the static file was mode 0600 owned by the invoking user. Any container running as a non-root user then got EACCES reading it, the probe saw bytes that never matched, and the entry was failed for "serving a copy taken at image build" -- the exact opposite of what it was doing. phoenix-bandit runs as nobody and failed on that alone; it passes 70/0 with the mode carried over. Entries that happened to pass were all running as root, so the bug penalised precisely the images following good practice. Carry the mode of the file being replaced onto the replacement.
MDA2AV
added a commit
that referenced
this pull request
Aug 22, 2026
plug-cowboy a second Plug.Cowboy listener in front of the same router.
Plug.Cowboy derives its ref from plug + scheme, so the two
children do not collide.
phoenix-bandit the endpoint's https: config already holds 8443 for the h2
profiles and Phoenix binds one https listener per endpoint,
so json-tls gets a second Bandit listener in front of the
same endpoint plug -- the identical pipeline, not a copy.
Both guarded on the PEMs, which the harness only mounts for TLS profiles.
validate: plug-cowboy 37/0, phoenix-bandit 70/0 (the latter needs #1272,
which fixes a probe bug that fails any container running as non-root)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The static staleness probe added in #1267 built its replacement file with
mktemp, which creates it0600.mvcarries the source mode onto the destination, so after the replace the static file was0600owned by the invoking user.Any container running as a non-root user then got
EACCESreading it. The probe never saw bytes matching the replacement and failed the entry with:which is the opposite of what those entries were doing.
The bias is the wrong way round: every entry that passed the probe so far runs as
root, so the bug penalised precisely the images following good practice.Repro
phoenix-banditruns asnobody(65534) and fails the probe on this alone. It reads the mounted directory correctly — replacinghero.webpby hand and requesting it back shows the new bytes within 1s over both HTTP/1.1 and h2. Undervalidate.shit failed twice in a row.Fix
Carry the mode of the file being replaced onto the replacement, so the server sees it exactly as it saw the original.
phoenix-bandit: 69 passed / 1 failed → 70 passed / 0 failed.🤖 Generated with Claude Code