{
  "slug": "docker-create-run-supports-container-process-umask-8551306d57bb",
  "title": "docker create/run supports container process umask",
  "tools": [
    "docker"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-03T22:31:49.000Z",
  "announced_at": "2026-09-03T22:31:49.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating or running a container, set its process umask with `--umask <octal>`; the value applies to the entrypoint and, when honored by the OCI runtime, to `docker exec` processes and healthchecks.",
    "examples": [
      "docker run --rm --umask 077 <image> <command> [<arg>...]",
      "docker create --umask 077 <image> [<command> [<arg>...]]"
    ],
    "gotchas": [
      "Version: 29.8.0",
      "--umask <octal>: Sets the container process umask in octal notation; leading zeros are optional. Without it, the OCI runtime applies its default. The create reference lists this option as API 1.56+.",
      "IMAGE (required): Image used to create or run the container.",
      "Prerequisite: The `docker create` reference marks `--umask` as requiring API 1.56+.",
      "Docs conflict: The release note describes the umask as applying to execs and healthchecks. Docker's run documentation qualifies this: OCI runtime support determines whether it is honored; it says runc honors it for execs and healthchecks."
    ]
  },
  "why_it_matters": "Set a container process umask when creating or running a container.",
  "sources": [
    "https://github.com/moby/moby/releases/tag/docker-v29.8.0",
    "https://docs.docker.com/reference/cli/docker/container/run/",
    "https://docs.docker.com/reference/cli/docker/container/create/"
  ],
  "rank": 0.91034,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-tools-20261017",
    "verdict_id": "wave1b-tools-20261017:wave1b-tools-20261017-38c23f00f36b3b83-0:gate",
    "evidence_hash": "3b61ac2b5cfbda3d167eef287a4229927ba70d9eae7ff540a18dbce7755ea530"
  },
  "review": {
    "draft_hash": "e1236ff4c4135c8859097954feb5d3ffbf732f776d694a94392c40cd3de5bc58",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-tools-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.91 >= 0.9; 2 needed) and Jev gave 0.67 (>= 0.6 needed)."
  }
}