Description
After upgrading to Docker Engine 29.7.0, the Gitea act_runner (gitea/runner:2.3.0) fails at "Set up job" when copying action content into the job container via the CopyToContainer API. The error is:
failed to copy content to container: Error response from daemon: statat var/run/act/actions/60120a02682c189ab422cd7ab32ed5be6df0b0b7b1c29c9ac2bfd7454e25932c/.git: path escapes from parent
The runner copies action files into /var/run/act/actions/ inside the container. Since virtually all standard Linux images symlink /var/run → /run, the path traversal is rejected as a path escape.
Downgrading to 29.6.1 immediately resolves the issue, confirming this is a regression introduced in 29.7.0.
Note: plain docker cp on the host does not reproduce the error — the regression is specific to the CopyToContainer API (tar archive extraction) path, not the CLI docker cp path.
Reproduce
- Start a Gitea instance with act_runner using
gitea/runner:2.3.0 against Docker Engine 29.7.0.
- Run any workflow that uses
actions/checkout@v4 or later.
- The job fails immediately at "Checkout repository" with the error above.
To confirm the regression is in CopyToContainer and not docker cp:
# This succeeds on 29.7.0 — plain docker cp is NOT affected
docker run -d --name test-symlink ubuntu:24.04 sleep 3600
mkdir -p /tmp/test-action/.git/refs
echo "ref: refs/heads/main" > /tmp/test-action/.git/HEAD
docker cp /tmp/test-action/. test-symlink:/var/run/act/actions/testaction/
# → Successfully copied
# Downgrade to 29.6.1 → Gitea runner works correctly
sudo apt install \
docker-ce=5:29.6.1-1~ubuntu.24.04~noble \
docker-ce-cli=5:29.6.1-1~ubuntu.24.04~noble \
containerd.io
# → Actions pass again
Expected behavior
CopyToContainer should successfully copy content into paths under /var/run/ inside a container, resolving in-container symlinks (such as the common /var/run → /run) before applying os.Root path validation, as was done in the 29.5.2 fix (#52655).
docker version
Client: Docker Engine - Community
Version: 29.7.0
API version: 1.55
Go version: go1.26.5
Git commit: c1eba93
Built: Thu Jul 30 20:20:28 2026
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 29.7.0
API version: 1.55 (minimum version 1.24)
Go version: go1.26.5
Git commit: 4b5cb71
Built: Thu Jul 30 20:20:28 2026
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v2.2.6
GitCommit: 11ce9d5f3c68c941867e82890e93e815c1304f1b
runc:
Version: 1.3.6
GitCommit: v1.3.6-0-g491b69ba
docker-init:
Version: 0.19.0
GitCommit: de40ad0
docker info
Client: Docker Engine - Community
Version: 29.6.1
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.36.0
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v5.3.1
Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
Containers: 64
Running: 58
Paused: 0
Stopped: 6
Images: 89
Server Version: 29.6.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 11ce9d5f3c68c941867e82890e93e815c1304f1b
runc version: v1.3.6-0-g491b69ba
init version: de40ad0
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.8.0-136-generic
Operating System: Linux Mint 22
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 31.13GiB
Name: BL-MINIPC-1
ID: 9cbb19bf-9740-4068-b1df-f3c0a83eec94
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
::1/128
127.0.0.0/8
Live Restore Enabled: false
Default Address Pools:
Base: 172.31.0.0/16, Size: 24
Base: 192.168.0.0/16, Size: 24
Firewall Backend: iptables
EnableUserlandProxy: true
UserlandProxyPath: /usr/bin/docker-proxyAdditional Info
Description
After upgrading to Docker Engine 29.7.0, the Gitea act_runner (gitea/runner:2.3.0) fails at "Set up job" when copying action content into the job container via the
CopyToContainerAPI. The error is:The runner copies action files into
/var/run/act/actions/inside the container. Since virtually all standard Linux images symlink/var/run → /run, the path traversal is rejected as a path escape.Downgrading to 29.6.1 immediately resolves the issue, confirming this is a regression introduced in 29.7.0.
Note: plain
docker cpon the host does not reproduce the error — the regression is specific to theCopyToContainerAPI (tar archive extraction) path, not the CLIdocker cppath.Reproduce
gitea/runner:2.3.0against Docker Engine 29.7.0.actions/checkout@v4or later.To confirm the regression is in
CopyToContainerand notdocker cp:Expected behavior
CopyToContainershould successfully copy content into paths under/var/run/inside a container, resolving in-container symlinks (such as the common/var/run → /run) before applyingos.Rootpath validation, as was done in the 29.5.2 fix (#52655).docker version
Client: Docker Engine - Community Version: 29.7.0 API version: 1.55 Go version: go1.26.5 Git commit: c1eba93 Built: Thu Jul 30 20:20:28 2026 OS/Arch: linux/amd64 Context: default Server: Docker Engine - Community Engine: Version: 29.7.0 API version: 1.55 (minimum version 1.24) Go version: go1.26.5 Git commit: 4b5cb71 Built: Thu Jul 30 20:20:28 2026 OS/Arch: linux/amd64 Experimental: false containerd: Version: v2.2.6 GitCommit: 11ce9d5f3c68c941867e82890e93e815c1304f1b runc: Version: 1.3.6 GitCommit: v1.3.6-0-g491b69ba docker-init: Version: 0.19.0 GitCommit: de40ad0docker info
Additional Info
docker cpCLI — only theCopyToContainerAPI tar extraction path is affecteddocker cpfails when target container has any file mounted with symlinked target #52653 (original report), daemon: resolve in-container symlinks before os.Root mount ops #52655 (29.5.2 fix) — the 29.5.2 fix resolved in-container symlink resolution fordocker cpbut a parallel code path used byCopyToContainerappears to be affected by the new 29.7.0 security hardening