2 · Imagem OCI#

/// Desempacota `layout` em `bundle/rootfs` e gera `bundle/config.json`.
pub fn unpack(layout: &Path, bundle: &Path) -> Result<()> {
    let index: Index = read_json(&layout.join("index.json"))?;
    let entry = index
        .manifests
        .iter()
        .find(|d| d.media_type == "application/vnd.oci.image.manifest.v1+json")
        .ok_or_else(|| Error::Unsupported("index.json without an OCI image manifest".into()))?;

    let manifest: Manifest = read_json(&verified_blob(layout, &entry.digest)?)?;
    let config: ImageConfig = read_json(&verified_blob(layout, &manifest.config.digest)?)?;

    // Verifica TODAS as layers antes de escrever qualquer byte no bundle.
    let layers: Vec<(PathBuf, &str)> = manifest
        .layers
        .iter()
        .map(|d| Ok((verified_blob(layout, &d.digest)?, d.media_type.as_str())))
        .collect::<Result<_>>()?;

    let rootfs = bundle.join("rootfs");
    fs::create_dir_all(&rootfs).ctx(|| format!("creating {}", rootfs.display()))?;
    for (path, media_type) in &layers {
        apply_layer(path, media_type, &rootfs)?;
    }

    let cfg = &config.config;
    let mut args = cfg.entrypoint.clone();
    args.extend(cfg.cmd.iter().cloned());
    if args.is_empty() {
        return Err(Error::Spec("image has neither Entrypoint nor Cmd".into()));
    }
    let mut spec = Spec::new_default(args);
    if !cfg.env.is_empty() {
        spec.process.env = cfg.env.clone();
    }
    if !cfg.working_dir.is_empty() {
        spec.process.cwd = cfg.working_dir.clone();
    }
    let json = serde_json::to_vec_pretty(&spec)
        .map_err(|source| Error::Json { path: bundle.join("config.json"), source })?;
    write_atomic(&bundle.join("config.json"), &json)
}

fn apply_layer(blob: &Path, media_type: &str, rootfs: &Path) -> Result<()> {
    let file = fs::File::open(blob).ctx(|| format!("opening {}", blob.display()))?;
    let reader: Box<dyn Read> = match media_type {
        "application/vnd.oci.image.layer.v1.tar+gzip" => Box::new(flate2::read::GzDecoder::new(file)),
        "application/vnd.oci.image.layer.v1.tar" => Box::new(file),
        other => return Err(Error::Unsupported(format!("layer media type {other}"))),
    };
    let mut archive = tar::Archive::new(reader);
    archive.set_preserve_ownerships(false); // sem root não há chown; e não devia haver.
    archive.set_overwrite(true);

    for entry in archive.entries().ctx(|| format!("reading {}", blob.display()))? {
        let mut entry = entry.ctx(|| "reading tar entry".to_string())?;
        let path = entry.path().ctx(|| "tar entry path".to_string())?.into_owned();
        let kind = entry.header().entry_type();

        // Whiteouts: `.wh.<nome>` apaga o que as layers de baixo puseram; `.wh..wh..opq` esvazia o dir.
        if let Some(name) = path.file_name().and_then(|n| n.to_str())
            && let Some(target) = name.strip_prefix(".wh.")
        {
            let parent =
                crate::fsutil::resolve_in_root(rootfs, path.parent().unwrap_or_else(|| Path::new("")), false);
            if let Ok(parent) = parent {
                if target == ".wh..opq" {
                    empty_dir(&parent)?;
                } else {
                    remove_any(&parent.join(target))?;
                }
            }
            continue;
        }
        // Sem root não se criam device nodes — e um device dentro de uma imagem é suspeito.
        if kind.is_block_special() || kind.is_character_special() {
            eprintln!("warning: skipping device node {}", path.display());
            continue;
        }
        // `unpack_in` recusa `..` e symlinks que escapem do destino.
        if !entry.unpack_in(rootfs).ctx(|| format!("unpacking {}", path.display()))? {
            return Err(Error::UnsafePath(path));
        }
    }
    make_dirs_writable(rootfs)
}