Changed ownership of the logs/ folder causing outage

[gudata]

Apache Airflow version

Airflow 3 version (please specify below)

3.0.4

What happened?

I am running an airflow from the compose file found at airflow samples.
I have ~150 virtual machines accross 4 aws accounts running the airflow-airflow-worker-1 process only, The workers are scaled from 1 to N.
I have each aws account one main node with the api-server, scheduler, triggerer.

Today all 3 production, 2 dev environments was not working because the logs/ folder has root:root ownership instead of airflow:root ownership as previously.

Only the qa setup was working because it was on airflow 3.0.6 version.

What you think should happen instead?

The logs/ folder should not be changed.

How to reproduce

No idea.

Operating System

amazon linux 2023

Versions of Apache Airflow Providers

the ones from the compose -apache/airflow:3.0.4

Deployment

Docker-Compose

Deployment details

Using celery.
On each node, the logs/ folder is mounted in each container.

Anything else?

This setup was working 31 days without any changes.
Today at the same time, with the same error failed 5 airflow installs in 4 different aws accounts with the same problem.

I assume airflow has changed some script which is dynamically pulled on boot of the workers/airflow
This starts happening from 2025-09-26 00:00:00 EET

after manually restoring the permissions everythings works fine.

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[gudata]

On the machines there are also running crowdstrike agent, and datadog.
From their logs we see that the logs/ folder is not modified by them.