Permission denied to mkdir /.docker

[cmoulliard]

Issue

When the step-source-default of a build's pod is executed, then the following error is reported

2021/10/07 12:46:59 warning: unsuccessful cred copy: ".docker" from "/tekton/creds" to "/": 
unable to create destination directory: mkdir /.docker: permission denied

Remark: The builder image used is created using this project: https://github.com/quarkusio/quarkus-buildpacks

Steps to reproduce

• Create a k8s cluster + TLS/Secured container registry using this bash script: https://github.com/snowdrop/k8s-infra/blob/main/kind/kind-tls-secured-reg.sh
• Deploy tekton/shipwright
• Follow steps defined here: https://github.com/halkyonio/r-d/blob/536b94dafa08546672edf8c41e88a5282b739401/buildpack/README.md#3-shipwright-and-buildpack-v3

[cmoulliard]

The same error is in fact reported in several steps

1. step-build-and-push

warning: unsuccessful cred copy: ".docker" from "/tekton/creds" to "/home/jboss": unable to create destination directory: mkdir /home/jboss/.docker: permission │
2021/10/07 16:05:05 Skipping step because a previous step failed

2. step-prepare

chown: cannot access '/builder/home': No such file or directory

3. step-source-default

│ 2021/10/07 16:04:54 warning: unsuccessful cred copy: ".docker" from "/tekton/creds" to "/": unable to create destination directory: mkdir /.docker: permission denied               │
│ {"level":"info","ts":1633622703.2607796,"logger":"git","msg":"ssh","path":"/usr/bin/ssh","version":"OpenSSH_8.0p1, OpenSSL 1.1.1g FIPS  21 Apr 2020"}                               │
│ {"level":"info","ts":1633622703.2733266,"logger":"git","msg":"git","path":"/usr/bin/git","version":"git version 2.27.0"}                                                            │
│ {"level":"info","ts":1633622703.3135676,"logger":"git","msg":"git-lfs","path":"/usr/bin/git-lfs","version":"git-lfs/2.11.0 (GitHub; linux amd64; go 1.14.4)"}                       │
│ {"level":"debug","ts":1633622703.3136945,"logger":"git","msg":"/usr/bin/git clone --quiet --no-tags --depth 1 --single-branch -- https://github.com/snowdrop/quarkus-tap-petclinic  │
│ {"level":"debug","ts":1633622705.3551846,"logger":"git","msg":"/usr/bin/git -C /workspace/source submodule update --init --recursive"}                                              │
│ {"level":"debug","ts":1633622705.4192505,"logger":"git","msg":"/usr/bin/git -C /workspace/source rev-parse --verify HEAD"}                                                          │

[SaschaSchwarze0]

This will get resolved by As a shipwright developer, I want to stop relying on service accounts for mounting my secrets at the pod level #679 as we then will stop using Tekton's creds-init feature which is the source of this message. In particular this happens when different steps in a BuildRun (including our own steps like the Git step that runs as user 1000 by default) use different users.