podstorage: Fix pull_from_host_storage for containers-storage source

The previous fix (b64bed4) for unified storage with containers-storage
transport had a bug: pull_from_host_storage() called bind_storage_roots()
which made bootc storage the default for podman. When podman image push
ran, it looked for the source image in bootc storage instead of the
host's default storage (/var/lib/containers/storage), causing "image
not known" errors.

Fix this by:
- Not calling bind_storage_roots, so podman uses its default storage
- Passing an explicit storage_path parameter to pull_from_host_storage
- Specifying the bootc storage path in the destination transport

This allows podman to read from host storage and push to bootc storage
without changing any defaults.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>

Author: henrywang

crates/lib/src/cli.rs

@@ -1688,9 +1688,14 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
             ImageOpts::SetUnified => crate::image::set_unified_entrypoint().await,
             ImageOpts::PullFromDefaultStorage { image } => {
                 let storage = get_storage().await?;
+                let storage_path = format!(
+                    "{}/{}",
+                    storage.physical_root_path,
+                    crate::podstorage::CStorage::subpath()
+                );
                 storage
                     .get_ensure_imgstore()?
-                    .pull_from_host_storage(&image)
+                    .pull_from_host_storage(&image, &storage_path)
                     .await
             }
             ImageOpts::Cmd(opt) => {

crates/lib/src/deploy.rs

@@ -506,11 +506,19 @@ pub(crate) async fn prepare_for_pull_unified(
     let pull_msg = format!("Pulling {} to bootc storage", &image_ref_str);
     let is_containers_storage = imgref.transport == "containers-storage";
     let image_name = imgref.image.clone();
+    // Compute the storage path for pull_from_host_storage
+    let storage_path = format!(
+        "{}/{}",
+        store.physical_root_path,
+        crate::podstorage::CStorage::subpath()
+    );
     async_task_with_spinner(&pull_msg, async move {
         if is_containers_storage {
             // For containers-storage transport, use pull_from_host_storage which
             // properly copies from host container storage to bootc storage
-            imgstore.pull_from_host_storage(&image_name).await?;
+            imgstore
+                .pull_from_host_storage(&image_name, &storage_path)
+                .await?;
             Ok(true)
         } else {
             imgstore

crates/lib/src/image.rs

@@ -329,9 +329,16 @@ pub(crate) async fn set_unified(sysroot: &crate::store::Storage) -> Result<()> {
             &imgref.image
         );
         let image_name = imgref.image.clone();
+        let storage_path = format!(
+            "{}/{}",
+            sysroot.physical_root_path,
+            crate::podstorage::CStorage::subpath()
+        );
         let copy_msg = format!("Copying {} to bootc storage", &image_name);
         async_task_with_spinner(&copy_msg, async move {
-            imgstore.pull_from_host_storage(&image_name).await
+            imgstore
+                .pull_from_host_storage(&image_name, &storage_path)
+                .await
         })
         .await?;
     } else {
@@ -348,9 +355,16 @@ pub(crate) async fn set_unified(sysroot: &crate::store::Storage) -> Result<()> {
                 &imgref.image
             );
             let image_name = imgref.image.clone();
+            let storage_path = format!(
+                "{}/{}",
+                sysroot.physical_root_path,
+                crate::podstorage::CStorage::subpath()
+            );
             let copy_msg = format!("Copying {} to bootc storage", &image_name);
             async_task_with_spinner(&copy_msg, async move {
-                imgstore.pull_from_host_storage(&image_name).await
+                imgstore
+                    .pull_from_host_storage(&image_name, &storage_path)
+                    .await
             })
             .await?;
         } else {

crates/lib/src/install.rs

@@ -1827,9 +1827,16 @@ async fn install_with_sysroot(
         BoundImages::Skip => {}
         BoundImages::Resolved(resolved_bound_images) => {
             // Now copy each bound image from the host's container storage into the target.
+            let storage_path = format!(
+                "{}/{}",
+                storage.physical_root_path,
+                crate::podstorage::CStorage::subpath()
+            );
             for image in resolved_bound_images {
                 let image = image.image.as_str();
-                c_storage.pull_from_host_storage(image).await?;
+                c_storage
+                    .pull_from_host_storage(image, &storage_path)
+                    .await?;
             }
         }
         BoundImages::Unresolved(bound_images) => {

crates/lib/src/podstorage.rs

@@ -18,7 +18,6 @@ use anyhow::{Context, Result};
 use bootc_utils::{AsyncCommandRunExt, CommandRunExt, ExitStatusExt};
 use camino::{Utf8Path, Utf8PathBuf};
 use cap_std_ext::cap_std::fs::Dir;
-use cap_std_ext::cap_tempfile::TempDir;
 use cap_std_ext::cmdext::CapStdExtCommandExt;
 use cap_std_ext::dirext::CapStdExtDirExt;
 use cap_std_ext::{cap_std, cap_tempfile};
@@ -412,24 +411,38 @@ impl CStorage {
 
     /// Copy an image from the default container storage (/var/lib/containers/)
     /// to this storage.
+    ///
+    /// The `storage_path` parameter should be the absolute filesystem path to
+    /// the bootc storage directory (e.g., "/sysroot/ostree/bootc/storage").
     #[context("Pulling from host storage: {image}")]
-    pub(crate) async fn pull_from_host_storage(&self, image: &str) -> Result<()> {
+    pub(crate) async fn pull_from_host_storage(
+        &self,
+        image: &str,
+        storage_path: &str,
+    ) -> Result<()> {
+        // Use podman push with explicit destination storage path.
+        // We don't use bind_storage_roots here because that would make bootc storage
+        // the default, preventing podman from finding the source image in the
+        // host's default storage (/var/lib/containers/storage).
         let mut cmd = Command::new("podman");
         cmd.stdin(Stdio::null());
         cmd.stdout(Stdio::null());
-        // An ephemeral place for the transient state;
-        let temp_runroot = TempDir::new(cap_std::ambient_authority())?;
-        bind_storage_roots(&mut cmd, &self.storage_root, &temp_runroot)?;
-
-        // The destination (target stateroot) + container storage dest
-        let storage_dest = &format!(
-            "containers-storage:[overlay@{STORAGE_ALIAS_DIR}+/proc/self/fd/{STORAGE_RUN_FD}]"
-        );
-        cmd.args(["image", "push", "--remove-signatures", image])
-            .arg(format!("{storage_dest}{image}"));
+
+        // Create a temporary directory for the runtime state
+        let temp_runroot = tempfile::tempdir().context("Creating temp runroot")?;
+        let runroot_path = temp_runroot
+            .path()
+            .to_str()
+            .context("Invalid tempdir path")?;
+
+        // Destination: bootc storage with explicit paths
+        // Podman reads from its default storage and pushes to the specified destination
+        let dest = format!("containers-storage:[overlay@{storage_path}+{runroot_path}]{image}");
+
+        cmd.args(["image", "push", "--remove-signatures", image, &dest]);
         let mut cmd = AsyncCommand::from(cmd);
         cmd.run().await?;
-        temp_runroot.close()?;
+        drop(temp_runroot);
         Ok(())
     }