detected dubious ownership in repository at '/tmp/build/get'

[NullOranje]

Describe the bug

When attempting to get a git-resource, we receive the git error detected dubious ownership instead of pulling the source code.

Reproduction steps

1. Deploy concourse quickstart using provided docker-compose.yml (using Concourse 7.9.1)

2. Deploy a simple pipeline:

resources:
  - name: git-repo
    type: git
    icon: git
    source:
      uri: http://gitea:3000/org1/myproject
      username: ((gitea.username))
      password: ((gitea.password))
jobs:
- name: validate-repo
  plan:
    - get: git-repo
      trigger: false
    - task: list-files
      config:
        inputs:
          - name: git-repo
        platform: linux
        image_resource:
          type: registry-image
          source:
            repository: busybox
        run:
          path: tree

3. Unpause the pipeline
4. Receive the following error:

selected worker: 31354ca107d3
Cloning into '/tmp/build/get'...
fatal: detected dubious ownership in repository at '/tmp/build/get'
To add an exception for this directory, call:

	git config --global --add safe.directory /tmp/build/get

...

Expected behavior

Expect the git repo to be available for pipeline consumption,

Additional context

No response

[NullOranje]

This seems to be an issue with houdini/Docker for Mac. Running this on a Kubernetes cluster on the same Docker for Mac instance with containerd does not encounter this issue.

[dennstack]

Alternative workaround if you work on a local concourse instance:

git_config:
- name: safe.directory
  value: /tmp/build/get

[ismail-temiz]

Alternative workaround if you work on a local concourse instance:

git_config:
- name: safe.directory
  value: /tmp/build/get

This has worked for me on the get step but having the same issue now in the put step as

Identity added: /tmp/git-resource-private-key (/tmp/git-resource-private-key)
fatal: detected dubious ownership in repository at '/tmp/build/put/repo'
To add an exception for this directory, call:

	git config --global --add safe.directory /tmp/build/put/repo

[ismail-temiz]

    git_config:
    - name: safe.directory
      value: '*'

Solved the issues for me

[reshmiasish]

this didnt solve issue for me :(

[pm3ndoza]

    git_config:
    - name: safe.directory
      value: '*'

Solved the issues for me

Question, where do you writ that, because, i tried on the task, on the resource section, and not be able to works

Even I try this. but still failing

resources:
- name: concourse-examples
  type: git
  icon: github
  check_every: 30m
  source:
    uri: https://github.com/concourse/examples
    branch: master
    safe_directory: /tmp/build/*

[ismail-temiz]

    git_config:
    - name: safe.directory
      value: '*'

Solved the issues for me

Question, where do you writ that, because, i tried on the task, on the resource section, and not be able to works

Even I try this. but still failing

resources:
- name: concourse-examples
  type: git
  icon: github
  check_every: 30m
  source:
    uri: https://github.com/concourse/examples
    branch: master
    safe_directory: /tmp/build/*

Like this

resources:
- name: repo
  type: git
  source:
    uri: https://github.com/foo.git
    # this is to avoid git permission error.
    git_config:
    - name: safe.directory
      value: '*'

[pm3ndoza]

    git_config:
    - name: safe.directory
      value: '*'

Solved the issues for me

Question, where do you writ that, because, i tried on the task, on the resource section, and not be able to works
Even I try this. but still failing

resources:
- name: concourse-examples
  type: git
  icon: github
  check_every: 30m
  source:
    uri: https://github.com/concourse/examples
    branch: master
    safe_directory: /tmp/build/*

Like this

resources:
- name: repo
  type: git
  source:
    uri: https://github.com/foo.git
    # this is to avoid git permission error.
    git_config:
    - name: safe.directory
      value: '*'

Have the same issue, i can not be able to get the repo, because I don't know where i can put those lines.

[ismail-temiz]

@pm3ndoza not sure what you mean. I show where you need to put those lines in the example above.

[taylorsilva]

Based on this initial comment:

This seems to be an issue with houdini/Docker for Mac.

I'm not going to try and fix this. I'd rather put effort into getting an ARM concourse build so folks don't need to use houdini at all when playing around with Concourse on ARM mac's.

[jamie-pate]

FYI this is not just an ARM/mac/Houdini problem, I'm facing it on my amd64/linux vm using containerd

The workaround posted above works for me, so it's NBD i think

Linux concourse-worker0-1452 5.15.0-134-generic #145-Ubuntu SMP Wed Feb 12 20:08:39 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

CONCOURSE_WORK_DIR=/mnt/concourse-worker/worker
CONCOURSE_LOG_LEVEL=error
CONCOURSE_TSA_HOST=<host>:2222
CONCOURSE_TSA_PUBLIC_KEY=/mnt/concourse-worker/keys/tsa_host_key.pub
CONCOURSE_TSA_WORKER_PRIVATE_KEY=/mnt/concourse-worker/keys/worker_key

CONCOURSE_BAGGAGECLAIM_LOG_LEVEL=error
CONCOURSE_BAGGAGECLAIM_BIND_IP=0.0.0.0
CONCOURSE_BAGGAGECLAIM_DRIVER=btrfs

CONCOURSE_ENABLE_P2P_VOLUME_STREAMING=1

CONCOURSE_RUNTIME=containerd

[taylorsilva]

Thanks for the update @jamie-pate - I'll re-open.

That said, I could use some help figuring out a reproducible. I regularly make little test pipelines that reference git repos on Github and have never seen this issue. For example:

resources:
- name: repo
  type: git
  source:
    uri: https://github.com/concourse/git-resource.git

jobs:
- name: get-repo
  plan:
    - get: repo

Works just fine:

# bring up quickstart Concourse from concourse/docs
$ docker compose up -d
$ fly -t local login -c http://localhost:8080 -u test -p test
logging in to team 'main'

target saved
$ fly -t local sp -p test -c pipe.yml
$ fly -t local unpause-pipeline -p test
$ fly -t local tj -j test/get-repo -w
started test/get-repo #1

selected worker: d3df9f1bc36f
Cloning into '/tmp/build/get'...
b0ee669 Merge pull request #436 from concourse/hide-extra-boolean-output
succeeded

It works, no error message.

OP was using a local gitea server. What if I use a repo hosted on a gitea server? https://gitea.com/gitea/docs

resources:
- name: repo
  type: git
  source:
    uri: https://gitea.com/gitea/docs.git

jobs:
- name: get-repo
  plan:
    - get: repo

$ fly -t local tj -j test/get-repo -w
started test/get-repo #2

selected worker: d3df9f1bc36f
Cloning into '/tmp/build/get'...
2a39f74 add oidc introspection endpoint to list (#217)
succeeded

Still works.

If someone can share a reproducible that would be helpful and save me a bunch of time investigating this.