doos 1.0.0: images, size cap, subuid ids, working apt in host mode

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/image.hpp

@@ -0,0 +1,58 @@
+#pragma once
+#include <cstdint>
+#include <filesystem>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "idmap.hpp"
+
+namespace doos {
+
+// Where an image comes from, after resolving a catalog name, URL or file.
+struct ImageSource {
+    std::string name;             // store name
+    std::string location;         // https URL or local file path
+    std::string sha256;           // expected, empty only for local files
+    bool isFile = false;
+};
+
+struct ImageInfo {
+    std::string name;
+    std::string source;
+    IdMode ids = IdMode::Single;
+    long created = 0;
+    std::uint64_t bytes = 0;
+};
+
+// Built-in sources: alpine, ubuntu (latest LTS), ubuntu-VERSION. Resolved from the publishers over https.
+class Catalog {
+public:
+    static std::vector<std::string> names();
+    static bool knows(const std::string& imageName);
+    static ImageSource resolve(const std::string& imageName);
+};
+
+class ImageStore {
+public:
+    explicit ImageStore(std::filesystem::path root);
+
+    static std::string normalize(const std::string& name);  // "ubuntu:24.04" -> "ubuntu-24.04"
+    static void validateName(const std::string& name);
+
+    bool has(const std::string& name) const;
+    std::filesystem::path rootfs(const std::string& name) const;
+    IdMode ids(const std::string& name) const;
+    std::vector<ImageInfo> list() const;
+
+    // Downloads (catalog/URL) or reads (file), verifies the sha256, extracts under the id map.
+    ImageInfo add(const ImageSource& src, IdMode ids);
+    // Dry run unless confirmed. `usedBy` lists containers referencing the image; non-empty refuses.
+    std::string remove(const std::string& name, bool confirmed, const std::vector<std::string>& usedBy);
+
+private:
+    std::filesystem::path dir(const std::string& name) const { return root_ / name; }
+    std::filesystem::path root_;
+};
+
+}  // namespace doos