The Inconsistent Permissions Problem
For years, Docker users have encountered a subtle but persistent issue: file permissions created within a container would differ depending on whether they were generated by the main application process or by a command executed later using docker exec. This discrepancy arose because the entrypoint script, often used to set the container's umask (a setting that determines default file permissions), did not propagate to processes launched via docker exec.
A common workaround involved using the umask command within the container's entrypoint, followed by exec to replace the shell process with the application. For example, umask 027; exec myapp would correctly set the umask for myapp. Files created by myapp would adhere to the intended policy, such as having 640 permissions. However, any subsequent docker exec command, like touching a new file, would fall back to the default umask inherited from the Docker daemon or the container runtime, often resulting in less restrictive permissions like 644. This meant the same container, ostensibly running under a single, intended security policy, would produce files with different permission sets based solely on how they were created.
This inconsistency posed a security risk and a compliance headache, particularly for applications that rely on strict file permission controls. Developers had to build complex workarounds into their applications or resort to manual permission adjustments post-creation, adding unnecessary complexity and potential for error.
Docker Engine 29.8.0 Introduces a Native Solution
Docker Engine version 29.8.0, released on September 3, 2026, directly addresses this long-standing problem with the introduction of a native --umask flag. This flag, available on docker create and docker run commands, is designed to apply the specified umask consistently across a container's lifecycle. According to Docker's documentation, it covers the container's main process, any subsequent exec calls, and even health checks.
Previously, users would check for the --umask flag in the docker run --help output and find it absent in versions prior to 29.8. The static build for version 29.8.1, available from download.docker.com, now includes this crucial functionality. The new flag simplifies the process of enforcing uniform file permissions within containers, eliminating the need for complex entrypoint tricks and ensuring that security policies are applied uniformly, regardless of how a file is created.
How the `--umask` Flag Works
The HostConfig.Umask field in the Docker API and the corresponding --umask flag in the CLI allow users to specify a umask value that the Docker daemon will enforce for all processes within the container. This value is a three-digit octal number, similar to how the umask command works in Linux. For example, setting --umask 027 means that newly created files will have their write and execute permissions for 'others' removed (octal 007), and newly created directories will have their write and execute permissions for 'others' removed. This ensures that files created by the main process, docker exec commands, and health checks all adhere to the same permission baseline.
The impact is significant. Developers can now confidently set a desired umask at container creation time, knowing that it will be respected by all processes running within that container. This simplifies security configurations, reduces the attack surface by preventing overly permissive file creation by default, and improves the predictability of containerized applications. The previous workaround of umask ...; exec ... was brittle and often incomplete; the new native flag provides a robust and reliable solution.
Implications and Future Considerations
The introduction of the --umask flag is a welcome improvement for security-conscious developers and operations teams. It closes a gap that has existed in Docker's permission model for a long time. For users running older versions of Docker Engine, upgrading is highly recommended to leverage this fix.
While the new flag addresses the core issue of permission consistency between the main process and exec calls, it's important to understand its scope. The documentation states it covers