fix(gateway-builder,cli): stage python-executor inside builder container

[renuka-fernando]

Purpose

Gateway image build fails with permission denied on Linux machines using a rootful Docker daemon. The gateway-builder container runs as root and writes output files owned by root:root into the bind-mounted temp workspace. The CLI then tries to copy python-executor/ into output/gateway-runtime/ on the host — a root-owned directory — and fails.

Resolves #2675

Backport of #2727 to ap/0.8.x.

Goals

Move all post-build file staging into the gateway-builder container itself, so the CLI never needs to touch root-owned output files after the container exits.

Approach

• Add fsutil.CopyDir to the shared gateway-builder/pkg/fsutil package (also eliminates the duplicate private copyDir in policyengine/generator.go)
• In gateway-builder/cmd/builder/main.go, stage output/python-executor/ → output/gateway-runtime/python-executor/ inside the container after Dockerfile generation — same pattern already used for build-manifest.yaml into the controller context
• Remove ensurePythonExecutorInRuntimeContext and ensureBuildLockInControllerContext from the CLI entirely; the CLI no longer touches the output directory after the builder exits
• Works on all platforms and Docker modes with no OS-level detection

User stories

As a developer using a rootful Docker daemon on Linux, ap gateway image build should complete successfully without permission errors.

Documentation

N/A

Automation tests

• Unit tests: existing gateway-builder unit tests continue to pass; fsutil.CopyDir follows the same pattern as the existing private copyDir
• Integration tests: N/A (requires a rootful Docker Linux environment to reproduce)

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? yes
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A

Related PRs

• fix(gateway-builder,cli): stage python-executor inside builder container #2727 (main branch)

Test environment

• Linux (Ubuntu) with rootful Docker daemon

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 27c7c5fa-6625-43eb-bb32-7d3d33f24933

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}