cli/context/store: create directories with 0700 permissions - #7428

• Fixes: Inconsistent directory permissions for ~/.docker directory #2727

Summary

The config-file writer creates the CLI config directory (~/.docker) with 0700 permissions (cli/config/configfile/file.go), but the context store created its directories with 0755. If a context command ran before anything had saved the config file, for example docker context create when ~/.docker did not exist yet, then ~/.docker itself and the contexts, contexts/meta and contexts/meta/<id> directories were created with 0755:

$ export DOCKER_CONFIG="$(mktemp -d)/cfg"
$ docker context create foo --docker host=tcp://127.0.0.1:2375
foo
Successfully created context "foo"
$ cd "$DOCKER_CONFIG/.." && find cfg -type d -exec stat -f '%Sp %N' {} \;
drwxr-xr-x cfg
drwxr-xr-x cfg/contexts
drwxr-xr-x cfg/contexts/meta
drwxr-xr-x cfg/contexts/meta/2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae

The TLS store had the same problem. It first created the parent of its root (~/.docker/contexts, and ~/.docker if missing) with 0755, and then created the TLS directories themselves with 0700.

This PR:

• metadatastore.go: creates the metadata directories with 0700 (was 0755).
• tlsstore.go: removes the os.MkdirAll(parentOfRoot, 0o755) step. Its only effect was to create the parent directories with more permissive permissions than the TLS directories. The os.MkdirAll(endpointDir, 0o700) that follows already creates any missing parent directories with 0700.

With this change, the same command creates every directory with drwx------, also when the context has TLS material. The TLS directories and files keep the 0700/0600 permissions they already had.

Notes:

• Existing directories are not changed, because os.MkdirAll does not modify directories that already exist. Only newly created directories are affected.
• meta.json is still written with 0644. I left it unchanged to keep this PR to the directories the issue is about. The directories that contain it are now 0700.
• cli/manifest/store also creates its directories under ~/.docker/manifests with 0755, so docker manifest create can still create a missing ~/.docker with 0755. I left it out of this PR because the issue and discussion are about the context store. I can include it here or in a follow-up if you want.

Tests:

• Added TestMetadataCreateDirectoryPermissions and TestTlsCreateDirectoryPermissions. Each creates a store rooted under a .docker directory that does not exist yet, writes one entry, and checks that every directory on the path, including .docker, has mode 0700. They are skipped on Windows.

• Without the fix (umask 022), both tests fail:

  --- FAIL: TestMetadataCreateDirectoryPermissions (0.03s)
      metadata_test.go:96: assertion failed: -rwxr-xr-x (fs.FileMode) != -rwx------ (fs.FileMode): <tmp>/.docker
      metadata_test.go:96: assertion failed: -rwxr-xr-x (fs.FileMode) != -rwx------ (fs.FileMode): <tmp>/.docker/contexts
      metadata_test.go:96: assertion failed: -rwxr-xr-x (fs.FileMode) != -rwx------ (fs.FileMode): <tmp>/.docker/contexts/meta
      metadata_test.go:96: assertion failed: -rwxr-xr-x (fs.FileMode) != -rwx------ (fs.FileMode): <tmp>/.docker/contexts/meta/<id>
  --- FAIL: TestTlsCreateDirectoryPermissions (0.01s)
      tlsstore_test.go:61: assertion failed: -rwxr-xr-x (fs.FileMode) != -rwx------ (fs.FileMode): <tmp>/.docker
      tlsstore_test.go:61: assertion failed: -rwxr-xr-x (fs.FileMode) != -rwx------ (fs.FileMode): <tmp>/.docker/contexts
  

  With the fix, both pass.

• Commands run on macOS arm64 with go1.26.10:

  • scripts/with-go-mod.sh go test ./cli/context/... ./cli/command/context/...: pass
  • scripts/with-go-mod.sh go test $(go list ./... | grep -vE '/vendor/|/e2e/|/cmd/docker-trust') (the make test-unit package set): pass
  • golangci-lint run ./cli/context/... (v2.10.1, the version pinned in dockerfiles/Dockerfile.lint): 0 issues. golangci-lint fmt --diff (gofumpt, goimports): no changes.
  • GOOS=windows go test -c ./cli/context/store/: compiles

• Manual check: I built ./cmd/docker and ran docker context create (with and without ca=) against a fresh DOCKER_CONFIG. Before the fix: cfg, contexts, contexts/meta and contexts/meta/<id> were drwxr-xr-x. After the fix: all directories are drwx------.

Release notes (optional)

Fix `docker context` commands creating the CLI config directory and context store directories with `0755` instead of `0700` permissions.