doos 1.0.0: images, size cap, subuid ids, working apt in host mode
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5.5
+196
-15
@@ -1,6 +1,9 @@
|
||||
#include "container.hpp"
|
||||
|
||||
#include <sys/stat.h>
|
||||
|
||||
#include <algorithm>
|
||||
#include <cstdio>
|
||||
#include <cctype>
|
||||
#include <ctime>
|
||||
#include <map>
|
||||
@@ -65,39 +68,158 @@ void Container::validateName(const std::string& name) {
|
||||
fs::path Container::layer(const std::string& hostDir) const { return dir_ / "layers" / slug(hostDir); }
|
||||
fs::path Container::privateDir(const std::string& hostDir) const { return dir_ / "private" / slug(hostDir); }
|
||||
|
||||
fs::path Container::etcDir() const {
|
||||
return imageMode() ? layer("/root") / "upper" / "etc" : privateDir("/etc");
|
||||
}
|
||||
|
||||
void Container::seed(const std::string& marker, const std::string& label,
|
||||
const std::function<fsutil::SeedStats()>& work) const {
|
||||
fs::path m = dir_ / ("seeded." + marker);
|
||||
if (fs::exists(m)) return;
|
||||
fsutil::SeedStats st = work();
|
||||
std::fprintf(stderr, "doos: seeded %s: %zu entries%s%s\n", label.c_str(), st.made,
|
||||
st.skipped ? ", unreadable skipped: " : "", st.skipped ? std::to_string(st.skipped).c_str() : "");
|
||||
fsutil::writeFile(m, "ok\n");
|
||||
}
|
||||
|
||||
void Container::prepareLayout() const {
|
||||
fsutil::mkdirs(rootfs());
|
||||
if (imageMode()) {
|
||||
fsutil::mkdirs(layer("/root") / "upper");
|
||||
fsutil::mkdirs(layer("/root") / "work");
|
||||
return;
|
||||
}
|
||||
std::vector<std::string> overlays;
|
||||
auto addOverlay = [&](std::string_view d) {
|
||||
std::string dir(d);
|
||||
fsutil::mkdirs(rootfs() / slug(d));
|
||||
fsutil::mkdirs(layer(dir) / "upper");
|
||||
fsutil::mkdirs(layer(dir) / "work");
|
||||
overlays.push_back(dir);
|
||||
};
|
||||
for (auto d : spec::kOverlayDirs) addOverlay(d);
|
||||
for (auto d : spec::kOverlayDirs) {
|
||||
fsutil::mkdirs(rootfs() / slug(d));
|
||||
addOverlay(d);
|
||||
}
|
||||
for (auto d : spec::kCompatDirs) {
|
||||
std::error_code ec;
|
||||
if (fs::is_directory(fs::symlink_status(std::string(d), ec)) && !ec) addOverlay(d);
|
||||
if (fs::is_directory(fs::symlink_status(std::string(d), ec)) && !ec) {
|
||||
fsutil::mkdirs(rootfs() / slug(d));
|
||||
addOverlay(d);
|
||||
}
|
||||
}
|
||||
for (auto d : spec::kPrivateDirs) {
|
||||
fsutil::mkdirs(rootfs() / slug(d));
|
||||
fsutil::mkdirs(privateDir(std::string(d)), 0755);
|
||||
}
|
||||
for (auto d : spec::kVarDirs) fsutil::mkdirs(privateDir("/var") / d.path, d.mode);
|
||||
for (auto d : spec::kVarOverlayDirs) {
|
||||
std::error_code ec;
|
||||
if (!fs::is_directory(std::string(d), ec)) continue;
|
||||
fsutil::mkdirs(privateDir("/var") / std::string(d).substr(5)); // below /var
|
||||
addOverlay(d);
|
||||
}
|
||||
for (auto d : spec::kEmptyDirs) fsutil::mkdirs(rootfs() / slug(d));
|
||||
|
||||
// Host dirs are owned by an unmapped uid (nobody) in the container: without a directory skeleton in the
|
||||
// upper layer nothing could ever be created in them (package installs, tool caches).
|
||||
for (const auto& o : overlays) {
|
||||
std::error_code ec;
|
||||
if (!fs::is_directory(o, ec)) continue;
|
||||
std::string key = slug(o);
|
||||
std::replace(key.begin(), key.end(), '/', '_');
|
||||
seed("skeleton-" + key, "directory skeleton " + o, [&] { return fsutil::mirrorDirs(o, layer(o) / "upper"); });
|
||||
}
|
||||
for (auto d : spec::kUpperCopyDirs) {
|
||||
for (const auto& o : overlays) {
|
||||
if (std::string(d) != o && std::string(d).rfind(o + "/", 0) != 0) continue;
|
||||
std::string rel = std::string(d).substr(o.size());
|
||||
std::string key = slug(d);
|
||||
std::replace(key.begin(), key.end(), '/', '_');
|
||||
fs::path target = layer(o) / "upper" / (rel.empty() ? "" : rel.substr(1));
|
||||
std::error_code ec;
|
||||
if (!fs::is_directory(std::string(d), ec) || !fs::is_directory(target, ec)) continue;
|
||||
seed("files-" + key, "files of " + std::string(d), [&] { return fsutil::copyFiles(std::string(d), target); });
|
||||
}
|
||||
}
|
||||
for (auto f : spec::kUpperLockFiles) {
|
||||
for (const auto& o : overlays) {
|
||||
if (std::string(f).rfind(o + "/", 0) != 0) continue;
|
||||
fs::path target = layer(o) / "upper" / std::string(f).substr(o.size() + 1);
|
||||
std::error_code ec;
|
||||
if (!fs::is_directory(target.parent_path(), ec) || fs::exists(target, ec)) continue;
|
||||
fsutil::writeFile(target, "");
|
||||
::chmod(target.c_str(), 0640);
|
||||
}
|
||||
}
|
||||
for (auto d : spec::kCopiedDirs) {
|
||||
std::error_code ec;
|
||||
if (!fs::is_directory(std::string(d), ec)) continue;
|
||||
seed("copy-" + std::string(slug(d)), "copy of " + std::string(d),
|
||||
[&] { return fsutil::copyTree(std::string(d), privateDir(std::string(d))); });
|
||||
}
|
||||
}
|
||||
|
||||
void Container::create(NetMode net) {
|
||||
namespace {
|
||||
void findUppers(const fs::path& dir, std::size_t depth, std::vector<fs::path>& out) {
|
||||
std::error_code ec;
|
||||
if (depth > 6) return;
|
||||
for (const auto& e : fs::directory_iterator(dir, ec)) {
|
||||
if (!e.is_directory(ec) || e.is_symlink(ec)) continue;
|
||||
std::string n = e.path().filename().string();
|
||||
if (n == "upper") out.push_back(e.path());
|
||||
else if (n != "work") findUppers(e.path(), depth + 1, out);
|
||||
}
|
||||
}
|
||||
} // namespace
|
||||
|
||||
std::uint64_t Container::usedBytes(std::size_t& skipped) const {
|
||||
std::vector<fs::path> dirs;
|
||||
std::error_code ec;
|
||||
if (fs::exists(dir_ / "layers", ec)) findUppers(dir_ / "layers", 0, dirs);
|
||||
if (fs::exists(dir_ / "private", ec)) dirs.push_back(dir_ / "private");
|
||||
std::uint64_t total = 0;
|
||||
for (const auto& d : dirs) total += fsutil::diskUsage(d, skipped);
|
||||
return total;
|
||||
}
|
||||
|
||||
void Container::writeMeta() const {
|
||||
fsutil::writeFile(metaFile(), "net=" + Network::name(net_) + "\ncreated=" + std::to_string(created_) +
|
||||
"\nversion=" DOOS_VERSION "\nimage=" + image_ + "\nids=" + IdMap::name(ids_) +
|
||||
"\nsize=" + std::to_string(size_) + "\n");
|
||||
}
|
||||
|
||||
void Container::setSizeCap(std::uint64_t bytes) {
|
||||
if (bytes < spec::kMinSizeBytes || bytes > spec::kMaxSizeBytes) {
|
||||
throw std::runtime_error("size must be between " + formatSize(spec::kMinSizeBytes) + " and " +
|
||||
formatSize(spec::kMaxSizeBytes));
|
||||
}
|
||||
size_ = bytes;
|
||||
writeMeta();
|
||||
}
|
||||
|
||||
void Container::create(const NetMode& net, const std::string& image, IdMode ids, std::uint64_t size) {
|
||||
net_ = net;
|
||||
image_ = image;
|
||||
ids_ = ids;
|
||||
size_ = size;
|
||||
created_ = std::time(nullptr);
|
||||
fsutil::mkdirs(dir_);
|
||||
prepareLayout();
|
||||
fsutil::writeFile(metaFile(), "net=" + Network::name(net_) + "\ncreated=" + std::to_string(created_) +
|
||||
"\nversion=" DOOS_VERSION "\n");
|
||||
writeMeta();
|
||||
}
|
||||
|
||||
void Container::load() {
|
||||
readMeta();
|
||||
prepareLayout();
|
||||
}
|
||||
|
||||
void Container::readMeta() {
|
||||
auto kv = parseKv(fsutil::readFile(metaFile()));
|
||||
net_ = Network::parse(kv.count("net") ? kv["net"] : "slirp");
|
||||
created_ = kv.count("created") ? std::stol(kv["created"]) : 0;
|
||||
prepareLayout(); // heals a container created by an older layout
|
||||
image_ = kv.count("image") ? kv["image"] : "";
|
||||
ids_ = IdMap::parse(kv.count("ids") ? kv["ids"] : "single");
|
||||
size_ = kv.count("size") ? std::stoull(kv["size"]) : spec::kDefaultSizeBytes;
|
||||
}
|
||||
|
||||
std::optional<pid_t> Container::runningPid() const {
|
||||
@@ -148,7 +270,7 @@ std::vector<Container> Store::list() const {
|
||||
try {
|
||||
Container::validateName(name);
|
||||
Container c(e.path(), name);
|
||||
c.load();
|
||||
c.readMeta();
|
||||
out.push_back(std::move(c));
|
||||
} catch (const std::exception& ex) {
|
||||
std::fprintf(stderr, "doos: skipping %s: %s\n", name.c_str(), ex.what());
|
||||
@@ -159,18 +281,39 @@ std::vector<Container> Store::list() const {
|
||||
return out;
|
||||
}
|
||||
|
||||
std::pair<Container, bool> Store::getOrCreate(const std::string& name, std::optional<NetMode> net) {
|
||||
std::vector<std::string> Store::containersUsing(const std::string& image) const {
|
||||
std::vector<std::string> out;
|
||||
for (const auto& c : list()) {
|
||||
if (c.image() == image) out.push_back(c.name());
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
std::pair<Container, bool> Store::getOrCreate(const std::string& name, const Options& opts) {
|
||||
Container::validateName(name);
|
||||
fs::path dir = containersDir() / name;
|
||||
Container c(dir, name);
|
||||
std::error_code ec;
|
||||
std::optional<std::string> image;
|
||||
if (opts.image && !opts.image->empty()) image = ImageStore::normalize(*opts.image);
|
||||
|
||||
auto verifyExisting = [&] {
|
||||
auto fixed = [&](const char* what, const std::string& have, const std::string& want) {
|
||||
if (have != want) {
|
||||
throw std::runtime_error("container '" + name + "' exists with " + what + "=" + have +
|
||||
"; this is fixed at creation");
|
||||
}
|
||||
};
|
||||
if (opts.net) fixed("net", Network::name(c.net()), Network::name(*opts.net));
|
||||
if (image) fixed("image", c.image().empty() ? "none" : c.image(), *image);
|
||||
if (opts.ids) fixed("ids", IdMap::name(c.ids()), IdMap::name(*opts.ids));
|
||||
if (opts.size && *opts.size != c.sizeCap()) c.setSizeCap(*opts.size);
|
||||
};
|
||||
|
||||
if (fs::exists(dir / "meta", ec)) {
|
||||
FileLock lock(c.lockFile(), spec::kLockTimeoutMs);
|
||||
c.load();
|
||||
if (net && *net != c.net()) {
|
||||
throw std::runtime_error("container '" + name + "' exists with net=" + Network::name(c.net()) +
|
||||
"; network mode is fixed at creation");
|
||||
}
|
||||
verifyExisting();
|
||||
return {c, false};
|
||||
}
|
||||
std::size_t count = 0;
|
||||
@@ -179,13 +322,38 @@ std::pair<Container, bool> Store::getOrCreate(const std::string& name, std::opti
|
||||
throw std::runtime_error("container limit reached (" + std::to_string(spec::kMaxContainers) +
|
||||
"); delete one first");
|
||||
}
|
||||
|
||||
// Resolve the image first (may download); ids follow the image so the layer ownership matches.
|
||||
IdMode ids = opts.ids.value_or(IdMap::best());
|
||||
if (image) {
|
||||
ImageStore store = images();
|
||||
if (!store.has(*image)) {
|
||||
if (!Catalog::knows(*image)) {
|
||||
throw std::runtime_error("unknown image '" + *image + "'. Add it: doos image add SOURCE [NAME] (catalog: alpine, ubuntu)");
|
||||
}
|
||||
std::fprintf(stderr, "doos: image '%s' not present, fetching it\n", image->c_str());
|
||||
store.add(Catalog::resolve(*image), ids);
|
||||
}
|
||||
IdMode imageIds = store.ids(*image);
|
||||
if (opts.ids && *opts.ids != imageIds) {
|
||||
throw std::runtime_error("image '" + *image + "' was extracted with ids=" + IdMap::name(imageIds) +
|
||||
"; use the same, or add the image again under another name");
|
||||
}
|
||||
ids = imageIds;
|
||||
}
|
||||
std::uint64_t size = opts.size.value_or(spec::kDefaultSizeBytes);
|
||||
if (size < spec::kMinSizeBytes || size > spec::kMaxSizeBytes) {
|
||||
throw std::runtime_error("size must be between " + formatSize(spec::kMinSizeBytes) + " and " +
|
||||
formatSize(spec::kMaxSizeBytes));
|
||||
}
|
||||
fsutil::mkdirs(dir, 0700);
|
||||
FileLock lock(c.lockFile(), spec::kLockTimeoutMs);
|
||||
if (fs::exists(dir / "meta", ec)) { // lost a creation race
|
||||
c.load();
|
||||
verifyExisting();
|
||||
return {c, false};
|
||||
}
|
||||
c.create(net.value_or(NetMode::Slirp));
|
||||
c.create(opts.net.value_or(NetMode::Slirp), image.value_or(""), ids, size);
|
||||
return {c, true};
|
||||
}
|
||||
|
||||
@@ -207,7 +375,20 @@ std::string Store::remove(const std::string& name, bool confirmed) {
|
||||
std::size_t n = fsutil::countEntries(dir, 1000000);
|
||||
return "dry run: would delete " + dir.string() + " (" + std::to_string(n) + " entries). Add --yes to confirm.";
|
||||
}
|
||||
fsutil::removeTree(dir);
|
||||
IdMode ids = IdMode::Single;
|
||||
try {
|
||||
c.readMeta();
|
||||
ids = c.ids();
|
||||
} catch (const std::exception&) {
|
||||
// damaged or half-created container: remove as plain user, files may be left behind loudly
|
||||
}
|
||||
if (ids == IdMode::Subuid) {
|
||||
// files owned by subuids can only be removed from inside the id map
|
||||
int rc = UserNsJob::run(ids, [&] { fsutil::removeTree(dir); return 0; });
|
||||
if (rc != 0) throw std::runtime_error("could not remove all files of '" + name + "'");
|
||||
} else {
|
||||
fsutil::removeTree(dir);
|
||||
}
|
||||
return "deleted " + name;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user