docker exec processes get umask 0000 because dockerd/containerd run with umask 0 #2759

Describe the bug

Processes started with docker exec run with umask 0000, so every file they create is world-writable (-rw-rw-rw-, directories drwxrwxrwx). A container's main process correctly gets 0022.

The cause seems to be that OrbStack starts the Docker daemons with umask 0. Inside the VM, dockerd, containerd and containerd-shim all report Umask: 0000 in /proc/<pid>/status. runc sets 0022 explicitly for a container's init process, but docker exec processes inherit 0000.

Many tools run everything through docker exec: dev container tools and editors (e.g., Zed), devcontainer exec, and scripts. Files they create in bind-mounted macOS folders end up world-writable on the Mac, so other local users could modify them. Shells that set their own umask hide the problem, but language servers, build tools, and git launched by an editor don't.

To Reproduce

C=$(docker run -d --rm alpine:3 sleep 120)
docker exec "$C" sh -c 'grep Umask /proc/1/status'    # main process: 0022
docker exec "$C" sh -c umask                          # 0000
docker exec -u 1000 "$C" sh -c umask                  # 0000
docker exec "$C" sh -c 'touch /tmp/f && ls -l /tmp/f' # -rw-rw-rw-
docker rm -f "$C"

# umask of the Docker daemons in the VM:
docker run --rm --pid=host --privileged alpine:3 sh -c '
  for p in /proc/[0-9]*; do n=$(cat $p/comm 2>/dev/null)
    case "$n" in dockerd|containerd|containerd-shim*) echo "$n $(grep Umask $p/status | cut -f2)";; esac
  done | sort -u'
# containerd 0000
# containerd-shim 0000
# dockerd 0000

Expected behavior

docker exec processes should start with umask 0022, like the container's main process and like a Docker Engine whose daemons run with the usual 0022 (systemd's default for services). Starting dockerd and containerd with umask 0022 should fix it. As far as I can tell, there's no user-side setting for this: orb config has none, Docker's daemon.json has none, and docker exec has no umask flag.

Diagnostic report (REQUIRED)

OrbStack info:
Version: 2.2.5
Commit: bf842321f95fc3ca7cda3227bf0cd41cb188c471 (v2.2.5)

System info:
macOS: 26.5.2 (25F84)
CPU: arm64, 8 cores
CPU model: Apple M3
Model: Mac15,12
Memory: 24 GiB

Full report: https://orbstack.dev/_admin/diag/orbstack-diagreport_2026-10-23T12-43-29.257009Z.zip

Screenshots and additional context (optional)

• Reproduced on OrbStack 2.2.5 (2020500) and 2.2.4 (2020400), macOS 26.5.2, Apple M3
• Docker 29.8.2, runc, kernel 7.2.12-orbstack-00394-gbecdd6130068
• orbstack-agent and the container's docker-init run with umask 0022; only the Docker daemons have 0000.