docker create/run supports container process umask
Introduced 2026-09-03 · score 0.91
HOW TO USE IT
When creating or running a container, set its process umask with `--umask <octal>`; the value applies to the entrypoint and, when honored by the OCI runtime, to `docker exec` processes and healthchecks.
docker run --rm --umask 077 <image> <command> [<arg>...]docker create --umask 077 <image> [<command> [<arg>...]]WHY THIS HELPS
Set a container process umask when creating or running a container.
REQUIREMENTS AND LIMITATIONS
- Version: 29.8.0
- --umask <octal>: Sets the container process umask in octal notation; leading zeros are optional. Without it, the OCI runtime applies its default. The create reference lists this option as API 1.56+.
- IMAGE (required): Image used to create or run the container.
- Prerequisite: The `docker create` reference marks `--umask` as requiring API 1.56+.
- Docs conflict: The release note describes the umask as applying to execs and healthchecks. Docker's run documentation qualifies this: OCI runtime support determines whether it is honored; it says runc honors it for execs and healthchecks.
FIRST-PARTY EVIDENCE
- https://github.com/moby/moby/releases/tag/docker-v29.8.0
- https://docs.docker.com/reference/cli/docker/container/run/
- https://docs.docker.com/reference/cli/docker/container/create/
Check the installed version and the source before using it. Entry JSON