mount,cache: internal lockfiles must not be part of user's cache content

internal/parse/parse.go

@@ -33,6 +33,9 @@ const (
 	BuildahCacheDir = "buildah-cache"
 	// mount=type=cache allows users to lock a cache store while its being used by another build
 	BuildahCacheLockfile = "buildah-cache-lockfile"
+	// All the lockfiles are stored in a separate directory inside `BuildahCacheDir`
+	// Example `/var/tmp/buildah-cache/<target>/buildah-cache-lockfile`
+	BuildahCacheLockfileDir = "buildah-cache-lockfiles"
 )
 
 var (
@@ -187,6 +190,7 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st
 func GetCacheMount(args []string, store storage.Store, imageMountLabel string, additionalMountPoints map[string]internal.StageMountDetails) (specs.Mount, []string, error) {
 	var err error
 	var mode uint64
+	var buildahLockFilesDir string
 	lockedTargets := make([]string, 0)
 	var (
 		setDest           bool
@@ -336,8 +340,10 @@ func GetCacheMount(args []string, store storage.Store, imageMountLabel string, a
 
 		if id != "" {
 			newMount.Source = filepath.Join(cacheParent, filepath.Clean(id))
+			buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, filepath.Clean(id))
 		} else {
 			newMount.Source = filepath.Join(cacheParent, filepath.Clean(newMount.Destination))
+			buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, filepath.Clean(newMount.Destination))
 		}
 		idPair := idtools.IDPair{
 			UID: uid,
@@ -348,18 +354,25 @@ func GetCacheMount(args []string, store storage.Store, imageMountLabel string, a
 		if err != nil {
 			return newMount, lockedTargets, fmt.Errorf("unable to change uid,gid of cache directory: %w", err)
 		}
+
+		// create a subdirectory inside `cacheParent` just to store lockfiles
+		buildahLockFilesDir = filepath.Join(cacheParent, buildahLockFilesDir)
+		err = os.MkdirAll(buildahLockFilesDir, os.FileMode(0700))
+		if err != nil {
+			return newMount, lockedTargets, fmt.Errorf("unable to create build cache lockfiles directory: %w", err)
+		}
 	}
 
 	switch sharing {
 	case "locked":
 		// lock parent cache
-		lockfile, err := lockfile.GetLockfile(filepath.Join(newMount.Source, BuildahCacheLockfile))
+		lockfile, err := lockfile.GetLockfile(filepath.Join(buildahLockFilesDir, BuildahCacheLockfile))
 		if err != nil {
 			return newMount, lockedTargets, fmt.Errorf("unable to acquire lock when sharing mode is locked: %w", err)
 		}
 		// Will be unlocked after the RUN step is executed.
 		lockfile.Lock()
-		lockedTargets = append(lockedTargets, filepath.Join(newMount.Source, BuildahCacheLockfile))
+		lockedTargets = append(lockedTargets, filepath.Join(buildahLockFilesDir, BuildahCacheLockfile))
 	case "shared":
 		// do nothing since default is `shared`
 		break

run_common.go

@@ -1519,7 +1519,7 @@ func (b *Builder) runSetupRunMounts(mounts []string, sources runMountInfo, idMap
 			}
 			finalMounts = append(finalMounts, *mount)
 			mountTargets = append(mountTargets, mount.Destination)
-			lockedTargets = lockedPaths
+			lockedTargets = append(lockedTargets, lockedPaths...)
 		default:
 			return nil, nil, fmt.Errorf("invalid mount type %q", mountType)
 		}

tests/bud.bats

@@ -25,6 +25,14 @@ load helpers
   expect_output --substring "options use-vc"
 }
 
+#Verify https://github.com/containers/buildah/issues/4342
+@test "buildkit-mount type=cache should not hang if cache is wiped in between" {
+  containerfile=$BUDFILES/cache-mount-locked/Containerfile
+  run_buildah build $WITH_POLICY_JSON --build-arg WIPE_CACHE=1 -t source -f $containerfile $BUDFILES/cache-mount-locked
+  # build should be success and must contain `hello` from `file` in last step
+  expect_output --substring "hello"
+}
+
 # Test for https://github.com/containers/buildah/pull/4295
 @test "build test warning for preconfigured TARGETARCH, TARGETOS, TARGETPLATFORM or TARGETVARIANT" {
   _prefetch alpine

tests/bud/cache-mount-locked/Containerfile

@@ -0,0 +1,21 @@
+FROM quay.io/centos/centos:7
+
+ARG WIPE_CACHE
+
+COPY file .
+
+RUN --mount=type=cache,target=/cache1,sharing=locked \
+    --mount=type=cache,target=/cache2 \
+    set -ex; \
+    ls -l /cache1; \
+    if [[ -v WIPE_CACHE ]]; then \
+      >&2 echo "Wiping cache"; \
+      find /cache1 -mindepth 1 -delete; \
+    fi; \
+    echo "foo" > /cache1/foo.txt; \
+    ls -l /cache1; \
+    chmod --recursive g=u /cache1; \
+    : ;
+
+# Cache was wiped-out but lock should not hang here: https://github.com/containers/buildah/issues/4342
+RUN --mount=type=cache,target=/cache1,sharing=locked cat file

tests/bud/cache-mount-locked/file

@@ -0,0 +1 @@
+hello