Docker Desktop (Docker VMM): fakeowner atomic_open binds newly created files to the backing virtiofs inode, breaking flock, POSIX locks, fchown, and inotify #765

sw_vers
uname -m
docker version --format 'Docker Desktop: {{.Server.Platform.Name}}  Engine: {{.Server.Version}}'
docker info --format 'VM kernel: {{.KernelVersion}}  OS: {{.OperatingSystem}}'
grep -h -i -E 'libkrun|virtualizationframework' \
  ~/Library/Group\ Containers/group.com.docker/settings*.json

mkdir -p ~/fakeowner-repro && cd ~/fakeowner-repro
docker run --rm -i -v "$PWD":/mnt python:3.13-slim python3 -u - /mnt /tmp <<'PY'
import ctypes
import fcntl
import os
import re
import shutil
import struct
import subprocess
import sys
import time

libc = ctypes.CDLL(None, use_errno=True)
IN_NONBLOCK = os.O_NONBLOCK
IN_EVENTS = {0x100: "IN_CREATE", 0x2: "IN_MODIFY", 0x8: "IN_CLOSE_WRITE"}


def fdinfo(fd):
    fields = {}
    with open(f"/proc/self/fdinfo/{fd}") as fh:
        for line in fh:
            key, _, value = line.partition(":")
            fields.setdefault(key.strip(), value.strip())
    return fields


def fs_magic(fd):
    buf = ctypes.create_string_buffer(512)
    if libc.fstatfs(fd, buf) != 0:
        return "?"
    return hex(struct.unpack_from("l", buf)[0])


def describe(label, fd):
    info = fdinfo(fd)
    st = os.fstat(fd)
    print(f"    {label}: readlink={os.readlink(f'/proc/self/fd/{fd}')}")
    print(
        f"    {label}: mnt_id={info['mnt_id']} f_type={fs_magic(fd)} "
        f"st_dev={os.major(st.st_dev)}:{os.minor(st.st_dev)} st_ino={st.st_ino} "
        f"flags={info['flags']} lock={info.get('lock', '-')}"
    )


def mnt_id_of_dir(d):
    fd = os.open(d, os.O_RDONLY | os.O_DIRECTORY)
    try:
        return fdinfo(fd)["mnt_id"]
    finally:
        os.close(fd)


def flock_nb(fd):
    try:
        fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
    except BlockingIOError:
        return "blocked"
    return "ACQUIRED"


def verdict(ok):
    return "ok" if ok else "BUG"


def mount_line(d):
    best_point, best_line = "", ""
    with open("/proc/self/mountinfo") as fh:
        for line in fh:
            mount_point = line.split()[4]
            covers = d == mount_point or d.startswith(mount_point.rstrip("/") + "/")
            if covers and len(mount_point) >= len(best_point):
                best_point, best_line = mount_point, line.strip()
    return best_line


def probe_flock(d):
    print("  [1] flock(2): creator vs. later openers of a new file")
    path = f"{d}/repro-flock-{os.getpid()}.lock"
    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND
    fds = []
    try:
        fds = [os.open(path, flags, 0o644) for _ in range(3)]
        results = [flock_nb(fd) for fd in fds]
        print(f"    fd1 (created the file): {results[0]}")
        print(f"    fd2 (file existed):     {results[1]}  expected blocked -> {verdict(results[1] == 'blocked')}")
        print(f"    fd3 (file existed):     {results[2]}  expected blocked -> {verdict(results[2] == 'blocked')}")
        for label, fd in zip(("fd1", "fd2", "fd3"), fds):
            describe(label, fd)
        st = os.stat(path)
        print(f"    stat(path): st_dev={os.major(st.st_dev)}:{os.minor(st.st_dev)} st_ino={st.st_ino}")
        pid = str(os.getpid())
        with open("/proc/locks") as fh:
            for line in fh:
                if line.split()[4] == pid:
                    print(f"    /proc/locks: {line.strip()}")
    finally:
        for fd in fds:
            os.close(fd)
        os.unlink(path)


def probe_recreate(d):
    print("  [2] unlink + recreate repeats the split")
    path = f"{d}/repro-recreate-{os.getpid()}.lock"
    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND
    for round_no in (1, 2):
        fd1 = os.open(path, flags, 0o644)
        fd2 = os.open(path, flags, 0o644)
        first, second = flock_nb(fd1), flock_nb(fd2)
        print(f"    round {round_no}: fd1 {first}, fd2 {second}  expected blocked -> {verdict(second == 'blocked')}")
        os.close(fd1)
        os.close(fd2)
        os.unlink(path)


def probe_scope(d):
    print("  [3] scope: opens of an already-existing file (creator closed first), and a hard link")
    path = f"{d}/repro-scope-{os.getpid()}.lock"
    dir_mnt = mnt_id_of_dir(d)
    os.close(os.open(path, os.O_WRONLY | os.O_CREAT, 0o644))
    try:
        fd_creat = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o644)
        fd_plain = os.open(path, os.O_RDWR)
        mnts = (fdinfo(fd_creat)["mnt_id"], fdinfo(fd_plain)["mnt_id"])
        print(f"    directory mnt_id={dir_mnt}; O_CREAT reopen mnt_id={mnts[0]}; O_RDWR reopen mnt_id={mnts[1]}")
        first, second = flock_nb(fd_creat), flock_nb(fd_plain)
        print(f"    flock: first {first}, second {second}  expected blocked -> {verdict(second == 'blocked')}")
        os.close(fd_creat)
        os.close(fd_plain)
        os.link(path, f"{path}.hardlink")
        fd_name, fd_link = os.open(path, os.O_RDWR), os.open(f"{path}.hardlink", os.O_RDWR)
        first, second = flock_nb(fd_name), flock_nb(fd_link)
        print(f"    hard link: via name {first}, via link {second}  expected blocked -> {verdict(second == 'blocked')}")
        os.close(fd_name)
        os.close(fd_link)
        os.unlink(f"{path}.hardlink")
    finally:
        os.unlink(path)


def probe_posix(d):
    print("  [4] POSIX fcntl(F_SETLK)/lockf(3): creator process vs. second process")
    path = f"{d}/repro-posix-{os.getpid()}.lock"
    fd = os.open(path, os.O_RDWR | os.O_CREAT, 0o644)
    try:
        fcntl.lockf(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
        describe("parent", fd)
        read_end, write_end = os.pipe()
        child = os.fork()
        if child == 0:
            os.close(read_end)
            child_fd = os.open(path, os.O_RDWR)
            try:
                fcntl.lockf(child_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
                info = fdinfo(child_fd)
                message = f"ACQUIRED (mnt_id={info['mnt_id']} lock={info.get('lock', '-')})"
            except OSError:
                message = "blocked"
            os.write(write_end, message.encode())
            os._exit(0)
        os.close(write_end)
        os.waitpid(child, 0)
        message = os.read(read_end, 4096).decode()
        os.close(read_end)
        print(f"    child: {message}  expected blocked -> {verdict(message == 'blocked')}")
    finally:
        os.close(fd)
        os.unlink(path)


def probe_ownership(d):
    print("  [5] fchown(2)/fchmod(2) through the creating descriptor vs. a later descriptor")
    path = f"{d}/repro-chown-{os.getpid()}.txt"
    fd = os.open(path, os.O_RDWR | os.O_CREAT, 0o644)
    try:
        os.fchown(fd, 1000, 1000)
        os.fchmod(fd, 0o751)
        st = os.stat(path)
        owner_ok = (st.st_uid, st.st_gid) == (1000, 1000)
        print(f"    creating fd: fchown(1000:1000) -> stat {st.st_uid}:{st.st_gid} {verdict(owner_ok)}")
        mode_ok = st.st_mode & 0o7777 == 0o751
        print(f"    creating fd: fchmod(0751)      -> stat {oct(st.st_mode & 0o7777)} {verdict(mode_ok)}")
        os.close(fd)
        fd = os.open(path, os.O_RDWR)
        os.fchown(fd, 1001, 1001)
        st = os.stat(path)
        owner_ok = (st.st_uid, st.st_gid) == (1001, 1001)
        print(f"    later fd:    fchown(1001:1001) -> stat {st.st_uid}:{st.st_gid} {verdict(owner_ok)}")
    finally:
        os.close(fd)
        os.unlink(path)


def drain_inotify(ifd):
    names = []
    try:
        buf = os.read(ifd, 65536)
    except BlockingIOError:
        return names
    offset = 0
    while offset < len(buf):
        _wd, mask, _cookie, name_len = struct.unpack_from("iIII", buf, offset)
        names.extend(name for bit, name in IN_EVENTS.items() if mask & bit)
        offset += 16 + name_len
    return names


def probe_inotify(d):
    print("  [6] inotify on the directory: create+write+close, then reopen+write+close")
    ifd = libc.inotify_init1(IN_NONBLOCK)
    libc.inotify_add_watch(ifd, d.encode(), sum(IN_EVENTS))
    path = f"{d}/repro-inotify-{os.getpid()}.txt"
    try:
        fd = os.open(path, os.O_WRONLY | os.O_CREAT, 0o644)
        os.write(fd, b"data")
        os.close(fd)
        created = drain_inotify(ifd)
        ok = created == ["IN_CREATE", "IN_MODIFY", "IN_CLOSE_WRITE"]
        print(f"    creating fd: {created}  expected IN_CREATE, IN_MODIFY, IN_CLOSE_WRITE -> {verdict(ok)}")
        fd = os.open(path, os.O_WRONLY | os.O_APPEND)
        os.write(fd, b"more")
        os.close(fd)
        later = drain_inotify(ifd)
        ok = later == ["IN_MODIFY", "IN_CLOSE_WRITE"]
        print(f"    later fd:    {later}  expected IN_MODIFY, IN_CLOSE_WRITE -> {verdict(ok)}")
    finally:
        os.close(ifd)
        os.unlink(path)


def probe_workaround(d):
    print("  [7] workaround: create and close first, then open the lock without O_CREAT")
    path = f"{d}/repro-workaround-{os.getpid()}.lock"
    os.close(os.open(path, os.O_WRONLY | os.O_CREAT, 0o644))
    try:
        fd1 = os.open(path, os.O_RDWR)
        fd2 = os.open(path, os.O_RDWR)
        first, second = flock_nb(fd1), flock_nb(fd2)
        print(f"    fd1 {first}, fd2 {second}  expected blocked -> {verdict(second == 'blocked')}")
        os.close(fd1)
        os.close(fd2)
    finally:
        os.unlink(path)


def holds_flock(pid):
    with open("/proc/locks") as fh:
        return any(line.split()[1] == "FLOCK" and line.split()[4] == str(pid) for line in fh)


def probe_flock_cli(d):
    print("  [8] util-linux flock(1): first invocation creates and holds the lock file, second tries it")
    if shutil.which("flock") is None:
        print("    skipped: flock(1) not installed")
        return
    path = f"{d}/repro-cli-{os.getpid()}.lock"
    holder = subprocess.Popen(["flock", "-n", path, "sleep", "10"])
    try:
        deadline = time.monotonic() + 5
        while not holds_flock(holder.pid) and time.monotonic() < deadline:
            time.sleep(0.05)
        if not holds_flock(holder.pid):
            print("    inconclusive: first flock(1) never took its lock")
            return
        second = subprocess.run(["flock", "-n", path, "true"], check=False).returncode
        outcome = "blocked" if second == 1 else f"ACQUIRED (exit {second})"
        print(f"    second invocation: {outcome}  expected blocked -> {verdict(second == 1)}")
    finally:
        holder.terminate()
        holder.wait()
        os.unlink(path)


def environment():
    print("== Environment")
    print(f"  uname: {' '.join(os.uname())}")
    print(f"  python: {sys.version.split()[0]}")
    with open("/proc/modules") as fh:
        for line in fh:
            if line.startswith("fakeowner "):
                print(f"  /proc/modules: {line.strip()}")
    symbols = re.compile(
        r"\sfakeowner_(atomic_open|open|open_realfile|lookup|create|inode_test|inode_set|flock|lock)\s"
    )
    found = []
    try:
        with open("/proc/kallsyms") as fh:
            found.extend(line.strip() for line in fh if symbols.search(line))
    except OSError as exc:
        print(f"  /proc/kallsyms unreadable: {exc}")
    for line in found:
        print(f"  /proc/kallsyms: {line}")
    lock_ops = [line for line in found if re.search(r"\sfakeowner_(flock|lock)\s", line)]
    print(f"  fakeowner_flock/fakeowner_lock symbols present: {bool(lock_ops)}")


environment()
for directory in sys.argv[1:]:
    print(f"\n== {directory} (directory mnt_id={mnt_id_of_dir(directory)})")
    print(f"  mountinfo: {mount_line(directory)}")
    for probe in (
        probe_flock,
        probe_recreate,
        probe_scope,
        probe_posix,
        probe_ownership,
        probe_inotify,
        probe_workaround,
        probe_flock_cli,
    ):
        probe(directory)
PY

docker run --rm -i --privileged --pid=host python:3.13-slim python3 - <<'PY'
import os

namespaces = {}
for pid in sorted((p for p in os.listdir("/proc") if p.isdigit()), key=int):
    try:
        ns = os.readlink(f"/proc/{pid}/ns/mnt")
        if ns in namespaces:
            continue
        with open(f"/proc/{pid}/comm") as fh:
            comm = fh.read().strip()
        with open(f"/proc/{pid}/mountinfo") as fh:
            lines = [line.rstrip() for line in fh if " - virtiofs " in line or " - fakeowner " in line]
    except OSError:
        continue
    namespaces[ns] = (pid, comm, lines)

with_virtiofs = 0
for ns, (pid, comm, lines) in namespaces.items():
    has_virtiofs = any(" - virtiofs " in line for line in lines)
    with_virtiofs += has_virtiofs
    if pid == "1" or has_virtiofs:
        print(f"== {ns}, first pid {pid} ({comm})")
        print("\n".join(lines) if lines else "  (no virtiofs or fakeowner mounts)")
print(f"\n{len(namespaces)} mount namespaces scanned; {with_virtiofs} contain a virtiofs mount")
PY

Client:
 Version:           29.9.1
 API version:       1.56
 Go version:        go1.26.9
 Git commit:        dfc520d
 Built:             Wed Oct 14 18:31:22 2026
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.96.0 (243774)
 Engine:
  Version:          29.9.1
  API version:      1.56 (minimum version 1.40)
  Go version:       go1.26.9
  Git commit:       b26fb77
  Built:            Wed Oct 14 18:31:50 2026
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.4.2
  GitCommit:        b7a25261e029d68978bbf290df0a62fc819b3c51
 runc:
  Version:          1.5.2
  GitCommit:        v1.5.2-0-g29dd3dc2
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
Client:
 Version:    29.9.1
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  agent: Docker AI Agent Runner (Docker Inc.)
    Version:  v1.149.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-agent
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
    Version:  v1.31.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-ai
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.38.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.6.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.47
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Docker Inc.)
    Version:  4.96.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-desktop
  dhi: CLI for managing Docker Hardened Images (Docker Inc.)
    Version:  v0.0.7
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-dhi
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.31
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-extension
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-init
  mcp: Docker MCP Plugin (Docker Inc.)
    Version:  v0.44.1
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-mcp
  model: Docker Model Runner (Docker Inc.)
    Version:  v1.2.6
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-model
  offload: Docker Offload (Docker Inc.)
    Version:  v0.7.4
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-offload
  pass: Docker Pass Secrets Manager Plugin (beta) (Docker Inc.)
    Version:  v0.3.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-pass
  sandbox: "docker sandbox" is deprecated, use Docker Sandboxes instead (Docker Inc.)
    Version:  v0.13.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-sandbox
  scout: Docker Scout (Docker Inc.)
    Version:  v1.26.0
    Path:     /Users/andrewlester/.docker/cli-plugins/docker-scout

Server:
 Containers: 2
  Running: 2
  Paused: 0
  Stopped: 0
 Images: 3
 Server Version: 29.9.1
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: local
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Discovered Devices:
  cdi: docker.com/gpu=webgpu
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: b7a25261e029d68978bbf290df0a62fc819b3c51
 runc version: v1.5.2-0-g29dd3dc2
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 7.0.14-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 12
 Total Memory: 11.67GiB
 Name: docker-desktop
 ID: 69d91972-450c-4f06-91ad-3ef9b1314e5a
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=unix:///Users/andrewlester/Library/Containers/com.docker.docker/Data/docker-cli.sock
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
  ::1/128
 Live Restore Enabled: false
 Firewall Backend: iptables