Docker Engine 29.8 adds --umask flag to fix permissions gap in exec and healthchecks

Docker Engine 29.8.0, released on 3 September 2026, introduces a native --umask flag for docker run and docker create, designed to apply a consistent umask across a container's main process, exec sessions, and healthchecks. Previously, the standard workaround of setting the umask inside an entrypoint script only affected PID 1 and its child processes, leaving docker exec sessions and healthcheck commands to inherit the container runtime's default umask of 022. This meant files created via docker exec could receive unintended permissions — for example, 644 instead of the intended 640 — a discrepancy that could silently break deploy scripts or monitoring tools. Testing confirmed the old entrypoint approach consistently produced wrong permissions for exec and healthcheck processes, while the new --umask flag enforced the correct permissions across all three. The flag also validates input strictly, rejecting non-numeric or malformed values before the container is even created.