doos 1.0.0: images, size cap, subuid ids, working apt in host mode

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/container.hpp

@@ -1,15 +1,28 @@
 #pragma once
 #include <sys/types.h>
 
+#include <cstdint>
 #include <filesystem>
+#include <functional>
 #include <optional>
 #include <string>
 #include <vector>
 
+#include "idmap.hpp"
+#include "image.hpp"
 #include "network.hpp"
+#include "util.hpp"
 
 namespace doos {
 
+// What the user asked for. Unset fields mean "default on create, no constraint on existing".
+struct Options {
+    std::optional<NetMode> net;
+    std::optional<std::string> image;
+    std::optional<IdMode> ids;
+    std::optional<std::uint64_t> size;
+};
+
 class Container {
 public:
     Container(std::filesystem::path dir, std::string name) : dir_(std::move(dir)), name_(std::move(name)) {}
@@ -24,26 +37,42 @@ public:
     std::filesystem::path lockFile() const { return dir_ / "lock"; }
     std::filesystem::path pidFile() const { return dir_ / "pid"; }
     std::filesystem::path metaFile() const { return dir_ / "meta"; }
+    // Where /etc lives on disk for this container (resolv.conf and tool config are written there).
+    std::filesystem::path etcDir() const;
 
     NetMode net() const { return net_; }
     long created() const { return created_; }
+    const std::string& image() const { return image_; }
+    bool imageMode() const { return !image_.empty(); }
+    IdMode ids() const { return ids_; }
+    std::uint64_t sizeCap() const { return size_; }
+    void setSizeCap(std::uint64_t bytes);
 
-    void create(NetMode net);  // writes layout and meta
-    void load();               // reads meta
+    void create(const NetMode& net, const std::string& image, IdMode ids, std::uint64_t size);
+    void readMeta();  // meta only, no side effects
+    void load();      // readMeta + heal the layout
 
     // Process id (outside view) of the container's init, if it is alive.
     std::optional<pid_t> runningPid() const;
     void recordPid(pid_t pid) const;
     void clearPid() const;
 
-    // Creates the (empty) mountpoint skeleton and layer dirs. Idempotent.
+    // Mountpoints, layer dirs, and one-time seeding (skeleton, /etc copy). Idempotent.
     void prepareLayout() const;
+    // Bytes the container wrote (writable layers and private dirs), as the host user can see them.
+    std::uint64_t usedBytes(std::size_t& skipped) const;
 
 private:
+    void writeMeta() const;
+    void seed(const std::string& marker, const std::string& label, const std::function<fsutil::SeedStats()>& work) const;
+
     std::filesystem::path dir_;
     std::string name_;
     NetMode net_ = NetMode::Slirp;
     long created_ = 0;
+    std::string image_;
+    IdMode ids_ = IdMode::Single;
+    std::uint64_t size_ = 0;
 };
 
 class Store {
@@ -52,11 +81,13 @@ public:
     static Store fromEnvironment();
 
     std::vector<Container> list() const;
-    // Returns the container and whether it was created by this call.
-    std::pair<Container, bool> getOrCreate(const std::string& name, std::optional<NetMode> net);
+    // Returns the container and whether it was created by this call. Pulls a catalog image on demand.
+    std::pair<Container, bool> getOrCreate(const std::string& name, const Options& opts);
     // Dry-run unless confirmed. Returns a human-readable report line.
     std::string remove(const std::string& name, bool confirmed);
 
+    ImageStore images() const { return ImageStore(root_ / "images"); }
+    std::vector<std::string> containersUsing(const std::string& image) const;
     const std::filesystem::path& root() const { return root_; }
 
 private: