docker: allow host git operations from within docker
What the developer wrote
Authored by Jon Griffiths
docker: allow host git operations from within docker
What changed, and why it matters
This commit changes the project's Docker build environment so that Git inside the container treats a folder shared from the host computer (/host/jade) as a 'safe directory.' This is a convenience change for developers using Docker Compose, not a fix for a product vulnerability. It slightly lowers a Git security guardrail that exists to prevent attacks when a repository is owned by a different user, but only within the isolated development container context.
No urgent action required. If the project wants to retain the ownership check, it can avoid the global safe.directory override by ensuring the container user matches the host directory ownership (e.g., matching UID/GID) instead. Document the rationale for this configuration in the Dockerfile comment.
Security signals we found
Disables Git safe.directory ownership check for a host-mounted path
Container-side configuration change only; no firmware or runtime code modified
No mention of vulnerability, CVE, researcher, or security advisory in commit
Evidence from the diff
The Dockerfile now runs git config --global --add safe.directory /host/jade. This disables Git’s ownership-safety check (introduced to mitigate CVE-2022-24765) for the host-mounted /host/jade path inside the container. The change is scoped to the Docker build/development environment and does not alter the Jade firmware, wallet logic, or production device behavior. Risk is limited to scenarios where an attacker who already controls the host’s /host/jade directory can influence Git operations performed inside the container.
Changed components
Dockerfile (development/build container configuration)Inspect captured patch +4 / −0
diff --git a/Dockerfile b/Dockerfile
index 76ebdb6..5e3a30a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,3 +24,7 @@ ENV PYTHONDONTWRITEBYTECODE=1
# Install our Python dependencies directly into the idf environment,
# to prevent any confusion over which env we are in at any given time.
RUN cd /opt/esp/idf && . ./export.sh && pip install --require-hashes -r /requirements.txt && pip install sphinx
+
+# Allow git operations from docker compose where the jade tree is
+# mounted on /host/jade
+RUN git config --global --add safe.directory /host/jade
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.