From 4a18c11bdc1300692def2453c441190d73e1e942 Mon Sep 17 00:00:00 2001 From: Tonis Tiigi Date: Wed, 30 May 2018 14:41:17 -0700 Subject: [PATCH] builder: fix layer leak on multi-stage wildcard copy Signed-off-by: Tonis Tiigi --- builder/dockerfile/copy.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/builder/dockerfile/copy.go b/builder/dockerfile/copy.go index cb9f24d205..43f40b62f9 100644 --- a/builder/dockerfile/copy.go +++ b/builder/dockerfile/copy.go @@ -172,7 +172,9 @@ func (o *copier) calcCopyInfo(origPath string, allowWildcards bool) ([]copyInfo, // TODO: do this when creating copier. Requires validateCopySourcePath // (and other below) to be aware of the difference sources. Why is it only // done on image Source? - if imageSource != nil { + if imageSource != nil && o.activeLayer == nil { + // this needs to be protected against repeated calls as wildcard copy + // will call it multiple times for a single COPY var err error rwLayer, err := imageSource.NewRWLayer() if err != nil {