Summary
The "default" sentinel used for the container-default user (UserContainerDefault in cli/config.go) is a magic string that collides with a hypothetical real user named default. Any job that would legitimately want to run as a container user literally called default cannot — the value is always translated to "" (container default).
This is the classic "a sentinel value cannot be distinguished from the same string used as a real value" footgun. It is pre-existing, not introduced by #717 — but #717 (correctly) widens its reach: now [global] default-user = default also triggers the sentinel, so the literal username is unaddressable via the global setting too, not just per-job.
Where
// cli/config.go
const UserContainerDefault = "default"
func (c *Config) applyDefaultUser(user *string) {
if *user == "" {
*user = c.Global.DefaultUser
}
if *user == UserContainerDefault {
*user = "" // container's default user
}
}Impact
Low/theoretical in practice — a passwd user literally named default is extremely rare to nonexistent. Filing for the record so the design tradeoff is explicit and discoverable.
Options to consider (not urgent)
- Document the reservation — note in the docs that
default is reserved as a sentinel and cannot name a real user.
- Pick a non-colliding sentinel — e.g. only the empty string means "container default" (drop the
"default" magic string), or use a token that can't be a valid Unix username.
- Type the option — model the field so "container default" is a distinct state rather than a string value (ties into the related ambiguity in the companion issue).
Refs
Summary
The
"default"sentinel used for the container-default user (UserContainerDefaultincli/config.go) is a magic string that collides with a hypothetical real user nameddefault. Any job that would legitimately want to run as a container user literally calleddefaultcannot — the value is always translated to""(container default).This is the classic "a sentinel value cannot be distinguished from the same string used as a real value" footgun. It is pre-existing, not introduced by #717 — but #717 (correctly) widens its reach: now
[global] default-user = defaultalso triggers the sentinel, so the literal username is unaddressable via the global setting too, not just per-job.Where
Impact
Low/theoretical in practice — a passwd user literally named
defaultis extremely rare to nonexistent. Filing for the record so the design tradeoff is explicit and discoverable.Options to consider (not urgent)
defaultis reserved as a sentinel and cannot name a real user."default"magic string), or use a token that can't be a valid Unix username.Refs
default-user = defaultis passed verbatim to docker exec (sentinel not honored) #716)