Fix kicbase image load permission denied by using docker CLI by princebirring · Pull Request #22787 · kubernetes/minikube

princebirring · 2026-03-28T01:35:51Z

Summary

Replace direct Docker daemon socket access (daemon.Write and daemon.Image from go-containerregistry) with Docker CLI commands (docker load -i, docker image inspect) in pkg/minikube/download/image.go
This fixes the "permission denied" error when loading the kicbase image for users who access Docker via sudo wrappers or other privilege-escalation mechanisms
Removes the now-unused go-containerregistry/pkg/v1/daemon import

Root Cause

When loading the kicbase image, minikube used daemon.Write() and daemon.Image() from the go-containerregistry library, which connect directly to the Docker socket (/var/run/docker.sock). Users who intentionally restrict direct socket access and use sudo-based Docker wrappers get "permission denied" errors, even though other minikube Docker operations (like docker system info) work fine because they go through the Docker CLI.

Test Plan

go build ./pkg/minikube/download/ compiles successfully
go test ./pkg/minikube/download/ passes
Manual test: run minikube start --driver=docker on a system where Docker requires sudo (user not in docker group, using a docker wrapper script)

Fixes #22780

k8s-ci-robot · 2026-03-28T01:35:57Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: princebirring
Once this PR has been reviewed and has the lgtm label, please assign prezha for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2026-03-28T01:36:00Z

Welcome @princebirring!

It looks like this is your first PR to kubernetes/minikube 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/minikube has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-03-28T01:36:01Z

Hi @princebirring. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

linux-foundation-easycla · 2026-03-28T01:36:02Z

The committers listed above are authorized under a signed CLA.

✅ login: princebirring / name: Prince Birring (d7914a8)

Replace direct Docker daemon socket access (daemon.Write and daemon.Image from go-containerregistry) with docker CLI commands (docker load, docker image inspect) so that users who access docker via sudo wrappers or other privilege-escalation mechanisms are supported.

minikube-bot · 2026-03-28T01:39:04Z

Can one of the admins verify this patch?

medyagh · 2026-04-22T22:51:24Z

I am not sure if this is what we want, histrocially we have wanted to reduce depenency on having Docker installed by the user .... @afbjorklund can comment more

Copilot

Pull request overview

This PR switches kicbase image loading/inspection from direct Docker daemon socket access (go-containerregistry daemon.*) to invoking Docker via its CLI, addressing “permission denied” failures on systems that restrict /var/run/docker.sock access and rely on sudo/wrapper-based Docker usage.

Changes:

Replaced daemon.Image() usage with docker image inspect to determine image architecture.
Replaced daemon.Write() loading logic with docker load -i for cached tarballs.
Removed the unused go-containerregistry/pkg/v1/daemon import.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-22T22:54:43Z

+	output, err := cmd.Output()
 	if err != nil {


cmd.Output() drops stderr, so failures from docker image inspect will return an unhelpful error (e.g. only exit status 1). Consider using CombinedOutput() and include the captured output in the returned error to make diagnosing inspect failures easier.

Suggested change

output, err := cmd.Output()

if err != nil {

output, err := cmd.CombinedOutput()

if err != nil {

inspectOutput := strings.TrimSpace(string(output))

if inspectOutput != "" {

return false, fmt.Errorf("failed to inspect image %s: %v: %s", img, err, inspectOutput)

}

Copilot · 2026-04-22T22:54:44Z

-	klog.V(2).Infof("response: %s", resp)
-	if err != nil {
-		return "", err
+		return "", fmt.Errorf("error loading image: %w", err)


On docker load failure, the returned error wraps only err (often just exit status 1) while the more useful details are in output and only logged at -v=2. Include the docker load output (and/or command) in the returned error so users get actionable diagnostics at default log levels.

Suggested change

return "", fmt.Errorf("error loading image: %w", err)

trimmedOutput := strings.TrimSpace(string(output))

if trimmedOutput != "" {

return "", fmt.Errorf("error loading image with %v: %s: %w", cmd.Args, trimmedOutput, err)

}

return "", fmt.Errorf("error loading image with %v: %w", cmd.Args, err)

Copilot · 2026-04-22T22:54:44Z

+	_, ref, err := parseImage(img)
 	if err != nil {


parseImage now returns a tag that is immediately discarded (_, ref, err := parseImage(img)). Since this is the only call site, consider simplifying parseImage to return just what CacheToDaemon needs (or avoid computing/returning the unused tag) to reduce confusion and unnecessary work.

afbjorklund · 2026-04-24T13:04:00Z

I am not sure if this is what we want, histrocially we have wanted to reduce depenency on having Docker installed by the user ....

Most people that have a running docker daemon also have a docker client installed, so I don't think that would be much difference?

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Mar 28, 2026

k8s-ci-robot requested review from ComradeProgrammer and nirs March 28, 2026 01:35

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 28, 2026

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Mar 28, 2026

princebirring force-pushed the Prince-Birring/minikube-fails-to-pull-kicbase-image-due-to-permis branch from 6aca42d to d7914a8 Compare March 28, 2026 01:38

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Mar 28, 2026

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Mar 28, 2026

medyagh requested review from afbjorklund and Copilot April 22, 2026 22:50

Copilot started reviewing on behalf of medyagh April 22, 2026 22:51 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix kicbase image load permission denied by using docker CLI#22787

Fix kicbase image load permission denied by using docker CLI#22787
princebirring wants to merge 1 commit intokubernetes:masterfrom
princebirring:Prince-Birring/minikube-fails-to-pull-kicbase-image-due-to-permis

princebirring commented Mar 28, 2026 •

edited

Loading

Uh oh!

k8s-ci-robot commented Mar 28, 2026

Uh oh!

k8s-ci-robot commented Mar 28, 2026

Uh oh!

k8s-ci-robot commented Mar 28, 2026

Uh oh!

linux-foundation-easycla Bot commented Mar 28, 2026 •

edited

Loading

Uh oh!

minikube-bot commented Mar 28, 2026

Uh oh!

medyagh commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

afbjorklund commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

-	output, err := cmd.Output()
-	if err != nil {
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		inspectOutput := strings.TrimSpace(string(output))
+		if inspectOutput != "" {
+			return false, fmt.Errorf("failed to inspect image %s: %v: %s", img, err, inspectOutput)
+		}

-		return "", fmt.Errorf("error loading image: %w", err)
+		trimmedOutput := strings.TrimSpace(string(output))
+		if trimmedOutput != "" {
+			return "", fmt.Errorf("error loading image with %v: %s: %w", cmd.Args, trimmedOutput, err)
+		}
+		return "", fmt.Errorf("error loading image with %v: %w", cmd.Args, err)

Conversation

princebirring commented Mar 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause

Test Plan

Uh oh!

k8s-ci-robot commented Mar 28, 2026

Uh oh!

k8s-ci-robot commented Mar 28, 2026

Uh oh!

k8s-ci-robot commented Mar 28, 2026

Uh oh!

linux-foundation-easycla Bot commented Mar 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

minikube-bot commented Mar 28, 2026

Uh oh!

medyagh commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

afbjorklund commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

princebirring commented Mar 28, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Mar 28, 2026 •

edited

Loading