apko paths fails to create a folder with a symlink

[mbrancato]

My use case here is I have an application that expects data at a folder /var/lib/foo, but there is an existing configuration script that uses the path /foo instead. So I want the folder /var/lib/foo to exist with the correct permissions, and a symlink to there from /foo. Sounds simple enough.

In a shell, that would be, roughly:

mkdir -p /var/lib/foo
ls -s /var/lib/foo /foo

The expected way:

paths:
  - path: /var/lib/foo
    type: directory
    uid: 10000
    gid: 10000
    permissions: 0755
  - path: /foo
    type: symlink
    source: /var/lib/foo

This results in the /foo symlink existing, but the real path /var/lib/foo has all permissions removed.

$ ls -lad /foo /var/lib/foo
lrwxrwxrwx 1 root root   12 Jan  1  1970 /foo -> /var/lib/foo
d--------- 2 root root 4096 Jan  1  1970 /var/lib/foo

Reversing the order won't work:

paths:
  - path: /foo
    type: symlink
    source: /var/lib/foo
  - path: /var/lib/foo
    type: directory
    uid: 10000
    gid: 10000
    permissions: 0755

Results, expectedly, in:

Error: building "arm64" layer: failed to mutate paths: symlink mutation on /foo: chmod "/foo": file does not exist
2025/03/11 11:51:59 INFO error during command execution: building "arm64" layer: failed to mutate paths: symlink mutation on /foo: chmod "/foo": file does not exist

The workaround - create the directory, create the symlink, set permissions on the directory. So the directory is listed twice:

paths:
  - path: /var/lib/foo
    type: directory
  - path: /foo
    type: symlink
    source: /var/lib/foo
  - path: /var/lib/foo
    type: directory
    uid: 10000
    gid: 10000
    permissions: 0755

Produces the desired result:

$ ls -lad /foo /var/lib/foo
lrwxrwxrwx 1 root   root     12 Jan  1  1970 /foo -> /var/lib/foo
drwxr-xr-x 2 nobody nobody 4096 Jan  1  1970 /var/lib/foo

[mbrancato]

I've also confirmed that simply running this:

  - path: /foo
    type: symlink
    source: /var/lib/foo

Where the path /var/lib/foo already exists from an installed package, the symlink again removes all permissions from the existing folder. It seems very surprising that a symlink will delete all permissions on the original folder.