What does "detected dubious ownership" mean?

Since version 2.35.2, Git refuses to use a repository whose folder is owned by a different user than the one running the command. It is a protection against CVE-2022-24765: on shared machines, an attacker could plant a malicious .git folder that executes code through hooks or config when someone else runs Git inside it.

Is it safe to run git config --add safe.directory?

Yes, as long as you know and trust the repository at that path. The command only tells Git "I trust this specific folder even though I do not own it". Avoid the wildcard "*" on shared machines, because it disables the protection everywhere.

Why does this happen in Docker, WSL, or CI?

Because the user running Git often differs from the user who owns the files. Docker volumes are frequently owned by root or a host UID, WSL mounts Windows drives with different ownership, and CI runners check out code as one user then build as another. The fix is the same: safe.directory for the workspace path, or align the UIDs.

Where is the safe.directory setting stored?

In your global Git config file, usually ~/.gitconfig, under the [safe] section. You can list entries with "git config --global --get-all safe.directory" and remove one with "git config --global --unset-all safe.directory ".

Download

fatal: detected dubious ownership in repository

This error means the repository folder belongs to a different user than the one running Git. It is a security feature added in Git 2.35.2, not a corruption. One command fixes it.

Learn Git hands-on See the fix

gitquest — enquête

Error explained

What this error means

Since version 2.35.2, Git checks that the repository folder is owned by the user running the command. If it is owned by someone else (root, www-data, another account), Git stops immediately. This protects you from a real attack: a malicious .git folder planted in a shared directory could execute code on your machine through hooks or config settings.

gitquest terminal: dubious ownership

$git status

fatal: detected dubious ownership in repository at '/srv/app'

To add an exception for this directory, call:

git config --global --add safe.directory /srv/app

Root causes

Why this happens

Docker volumes and containers

Files mounted into a container often belong to root or to the host user's UID, while the container runs Git as a different user. Git sees a mismatch and refuses.

WSL and network drives

Repositories on a Windows drive accessed from WSL (under /mnt/c), or on NTFS/network shares, can report an owner that does not match your Linux user.

Servers, CI, and sudo

On a server, a deploy user owns the code but you connect as someone else. In CI, the checkout user differs from the build user. Running Git with sudo once can also flip ownership of some files.

Step-by-step fix

How to fix it

Two clean options: declare the folder safe, or make yourself its owner.

Option 1: mark the folder as safe

If you trust the repository, copy the exact command Git suggests in the error message. It only affects that one path.

gitquest terminal: safe.directory

# 1. Check who owns the repository folder

$ls -ld /srv/app

drwxr-xr-x 12 www-data www-data 384 Aug 20 10:00 /srv/app

# 2. If you trust this repository, add it as safe

$git config --global --add safe.directory /srv/app

# 3. Git works again

$git status

On branch main

Option 2: fix the ownership

When you should genuinely own the files, change the owner instead. For containers and CI, a wildcard entry is common because the environment is controlled.

gitquest terminal: chown or wildcard

# Better fix when possible: make yourself the owner

$sudo chown -R $(whoami) /srv/app

# For CI or containers: trust everything (controlled envs only)

$git config --global --add safe.directory "*"

# The wildcard must be quoted so the shell does not expand it

Best practices

How to prevent it

Avoid sudo with Git

Running sudo git ... creates root-owned files inside your repository and causes this error later. Clone and work as your normal user.

Match UIDs in containers

In Docker, run the container with your host UID (--user $(id -u):$(id -g)) or bake a safe.directory entry into the image so builds do not break.

Scope exceptions narrowly

Prefer one safe.directory entry per path over the "*" wildcard, especially on shared machines. The protection exists for a reason.

Related commands

git config

Configure Git settings and identity

git status

Inspect the state of your repository

git clone

Copy a remote repository locally

GitQuest is created by Anaïs (nouvelle fenêtre), web developer and head of education, specializing in tech training and digital accessibility.

Questions about dubious ownership

Git errors become clues, not roadblocks

GitQuest teaches you to read what Git is really saying. Practice in a safe terminal simulator and turn every error message into a solved case.

Start practicing