fs: Allow reading filesystems without storing objects in repository

For the `cfsctl oci compute-id` case we were making full copies of
the objects in a temporary repository - a completely unnecessary
performance hit.

Further that path expects `O_TMPFILE` which isn't supported everywhere.
(In theory we should support non-O_TMPFILE filesystems too)

Fixes: bootc-dev/bootc#1977

Assisted-by: OpenCode (Claude Opus 4)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

crates/cfsctl/src/lib.rs

@@ -36,9 +36,7 @@ use anyhow::{Context as _, Result};
 use clap::{Parser, Subcommand, ValueEnum};
 #[cfg(feature = "oci")]
 use comfy_table::{Table, presets::UTF8_FULL};
-use rustix::fs::{Mode, OFlags};
-
-use rustix::fs::CWD;
+use rustix::fs::{CWD, Mode, OFlags};
 use serde::Serialize;
 
 use composefs_boot::BootOps;
@@ -102,6 +100,11 @@ pub struct App {
     #[clap(long)]
     require_verity: bool,
 
+    /// Don't open a repository. Only valid for commands that don't need one
+    /// (compute-id, create-dumpfile).
+    #[clap(long)]
+    pub no_repo: bool,
+
     #[clap(subcommand)]
     cmd: Command,
 }
@@ -410,14 +413,15 @@ enum Command {
         /// optional reference name for the image, use as 'ref/<name>' elsewhere
         image_name: Option<String>,
     },
-    /// Read rootfs located at a path, add all files to the repo, then compute the composefs image object id of the rootfs.
-    /// Note that this does not create or commit the composefs image itself.
+    /// Read rootfs located at a path and compute the composefs image object id of the rootfs.
+    /// Note that this does not create or commit the composefs image itself, and does not
+    /// store any file objects in the repository.
     ComputeId {
         #[clap(flatten)]
         fs_opts: FsReadOptions,
     },
-    /// Read rootfs located at a path, add all files to the repo, then dump full content of the rootfs to a composefs dumpfile
-    /// and write to stdout.
+    /// Read rootfs located at a path and dump full content of the rootfs to a composefs dumpfile,
+    /// writing to stdout. Does not store any file objects in the repository.
     CreateDumpfile {
         #[clap(flatten)]
         fs_opts: FsReadOptions,
@@ -569,6 +573,14 @@ pub async fn run_app(args: App) -> Result<()> {
         );
     }
 
+    if args.no_repo {
+        let effective_hash = args.hash.unwrap_or(HashType::Sha512);
+        return match effective_hash {
+            HashType::Sha256 => run_cmd_without_repo::<Sha256HashValue>(args),
+            HashType::Sha512 => run_cmd_without_repo::<Sha512HashValue>(args),
+        };
+    }
+
     let repo_path = resolve_repo_path(&args)?;
     let effective_hash = resolve_hash_type(&repo_path, args.hash)?;
 
@@ -704,15 +716,25 @@ fn load_filesystem_from_oci_image<ObjectID: FsVerityHashValue>(
 
 fn load_filesystem_from_ondisk_fs<ObjectID: FsVerityHashValue>(
     fs_opts: &FsReadOptions,
-    repo: &Repository<ObjectID>,
+    repo: Option<&Repository<ObjectID>>,
 ) -> Result<FileSystem<RegularFile<ObjectID>>> {
     let mut fs = if fs_opts.no_propagate_usr_to_root {
-        composefs::fs::read_filesystem(CWD, &fs_opts.path, Some(repo))?
+        composefs::fs::read_filesystem(CWD, &fs_opts.path, repo)?
     } else {
-        composefs::fs::read_container_root(CWD, &fs_opts.path, Some(repo))?
+        composefs::fs::read_container_root(CWD, &fs_opts.path, repo)?
     };
     if fs_opts.bootable {
-        fs.transform_for_boot(repo)?;
+        if let Some(repo) = repo {
+            fs.transform_for_boot(repo)?;
+        } else {
+            let rootfd = rustix::fs::openat(
+                CWD,
+                &fs_opts.path,
+                OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC,
+                Mode::empty(),
+            )?;
+            fs.transform_for_boot_from_dir(rootfd)?;
+        }
     }
     Ok(fs)
 }
@@ -774,6 +796,25 @@ fn dump_file_impl(
     Ok(())
 }
 
+/// Run commands that don't require a repository.
+pub fn run_cmd_without_repo<ObjectID: FsVerityHashValue>(args: App) -> Result<()> {
+    match args.cmd {
+        Command::ComputeId { fs_opts } => {
+            let fs = load_filesystem_from_ondisk_fs::<ObjectID>(&fs_opts, None)?;
+            let id = fs.compute_image_id();
+            println!("{}", id.to_hex());
+        }
+        Command::CreateDumpfile { fs_opts } => {
+            let fs = load_filesystem_from_ondisk_fs::<ObjectID>(&fs_opts, None)?;
+            fs.print_dumpfile()?;
+        }
+        _ => {
+            anyhow::bail!("--no-repo is only supported for compute-id and create-dumpfile");
+        }
+    }
+    Ok(())
+}
+
 /// Run with cmd
 pub async fn run_cmd_with_repo<ObjectID>(repo: Repository<ObjectID>, args: App) -> Result<()>
 where
@@ -1047,17 +1088,17 @@ where
             fs_opts,
             ref image_name,
         } => {
-            let fs = load_filesystem_from_ondisk_fs(&fs_opts, &repo)?;
+            let fs = load_filesystem_from_ondisk_fs(&fs_opts, Some(&repo))?;
             let id = fs.commit_image(&repo, image_name.as_deref())?;
             println!("{}", id.to_id());
         }
         Command::ComputeId { fs_opts } => {
-            let fs = load_filesystem_from_ondisk_fs(&fs_opts, &repo)?;
+            let fs = load_filesystem_from_ondisk_fs(&fs_opts, Some(&repo))?;
             let id = fs.compute_image_id();
             println!("{}", id.to_hex());
         }
         Command::CreateDumpfile { fs_opts } => {
-            let fs = load_filesystem_from_ondisk_fs(&fs_opts, &repo)?;
+            let fs = load_filesystem_from_ondisk_fs::<ObjectID>(&fs_opts, None)?;
             fs.print_dumpfile()?;
         }
         Command::Mount { name, mountpoint } => {

crates/composefs-boot/src/selabel.rs

@@ -19,7 +19,7 @@ use fn_error_context::context;
 use regex_automata::{Anchored, Input, hybrid::dfa, util::syntax};
 use rustix::{
     fd::AsFd,
-    fs::{openat, Mode, OFlags},
+    fs::{Mode, OFlags, openat},
     io::Errno,
 };
 

crates/composefs/src/fs.rs

@@ -162,8 +162,8 @@ pub fn write_to_path<ObjectID: FsVerityHashValue>(
 
 /// Helper for reading filesystem trees from disk into composefs representation.
 ///
-/// Tracks hardlinks via inode numbers and handles integration with repositories
-/// for storing large file content.
+/// Tracks hardlinks via inode numbers and optionally stores large file objects
+/// in a repository.
 #[derive(Debug)]
 pub struct FilesystemReader<'repo, ObjectID: FsVerityHashValue> {
     repo: Option<&'repo Repository<ObjectID>>,
@@ -295,8 +295,7 @@ impl<ObjectID: FsVerityHashValue> FilesystemReader<'_, ObjectID> {
     /// Reads a directory from disk into composefs representation.
     ///
     /// Recursively reads directory contents, tracking hardlinks and optionally
-    /// reading the directory's own metadata. Large files are stored in the repository
-    /// if one was provided.
+    /// storing large file objects in the repository.
     #[context("Reading directory {}", name.to_string_lossy())]
     fn read_directory(&mut self, dirfd: impl AsFd, name: &OsStr) -> Result<Directory<ObjectID>> {
         let fd = openat(
@@ -341,9 +340,12 @@ impl<ObjectID: FsVerityHashValue> FilesystemReader<'_, ObjectID> {
     }
 }
 
-/// Load a filesystem tree from the given path. A repository may
-/// be provided; if it is, then all files found in the filesystem
-/// are copied in.
+/// Load a filesystem tree from the given path.
+///
+/// If a repository is provided, all files found in the filesystem are
+/// stored in it. If `None`, fsverity digests are computed in memory
+/// without writing to disk — suitable for computing image IDs and
+/// dumpfiles without requiring O_TMPFILE support.
 #[context("Reading filesystem from {}", path.display())]
 pub fn read_filesystem<ObjectID: FsVerityHashValue>(
     dirfd: impl AsFd,
@@ -373,7 +375,7 @@ pub fn read_filesystem<ObjectID: FsVerityHashValue>(
 /// use composefs::fs::{read_filesystem_filtered, CONTAINER_XATTR_ALLOWLIST};
 ///
 /// // Filter to only allow security.capability
-/// let fs = read_filesystem_filtered(dirfd, path, repo, |name| {
+/// let fs = read_filesystem_filtered(dirfd, path, None, |name| {
 ///     name.as_encoded_bytes() == b"security.capability"
 /// })?;
 /// ```

crates/integration-tests/src/tests/cli.rs

@@ -1079,6 +1079,96 @@ fn test_oci_fsck_single_image() -> Result<()> {
 }
 integration_test!(test_oci_fsck_single_image);
 
+fn test_compute_id_no_repo() -> Result<()> {
+    let sh = Shell::new()?;
+    let cfsctl = cfsctl()?;
+    let fixture_dir = tempfile::tempdir()?;
+    let rootfs = create_test_rootfs(fixture_dir.path())?;
+
+    let output = cmd!(
+        sh,
+        "{cfsctl} --no-repo compute-id --no-propagate-usr-to-root {rootfs}"
+    )
+    .read()?;
+    assert!(
+        !output.trim().is_empty(),
+        "expected image ID output, got nothing"
+    );
+    // Should be a valid hex digest
+    assert!(
+        output.trim().chars().all(|c| c.is_ascii_hexdigit()),
+        "expected hex digest, got: {output}"
+    );
+    Ok(())
+}
+integration_test!(test_compute_id_no_repo);
+
+fn test_compute_id_no_repo_matches_repo() -> Result<()> {
+    let sh = Shell::new()?;
+    let cfsctl = cfsctl()?;
+    let fixture_dir = tempfile::tempdir()?;
+    let rootfs = create_test_rootfs(fixture_dir.path())?;
+    let repo_dir = tempfile::tempdir()?;
+    let repo = repo_dir.path();
+
+    let id_no_repo = cmd!(
+        sh,
+        "{cfsctl} --no-repo compute-id --no-propagate-usr-to-root {rootfs}"
+    )
+    .read()?;
+    let id_with_repo = cmd!(
+        sh,
+        "{cfsctl} --insecure --repo {repo} compute-id --no-propagate-usr-to-root {rootfs}"
+    )
+    .read()?;
+    assert_eq!(
+        id_no_repo.trim(),
+        id_with_repo.trim(),
+        "--no-repo and --repo should produce the same digest"
+    );
+    Ok(())
+}
+integration_test!(test_compute_id_no_repo_matches_repo);
+
+fn test_create_dumpfile_no_repo() -> Result<()> {
+    let sh = Shell::new()?;
+    let cfsctl = cfsctl()?;
+    let fixture_dir = tempfile::tempdir()?;
+    let rootfs = create_test_rootfs(fixture_dir.path())?;
+
+    let output = cmd!(
+        sh,
+        "{cfsctl} --no-repo create-dumpfile --no-propagate-usr-to-root {rootfs}"
+    )
+    .read()?;
+    assert!(
+        output.contains("/usr/bin/hello"),
+        "expected dumpfile to contain /usr/bin/hello, got: {output}"
+    );
+    assert!(
+        output.contains("/etc/hostname"),
+        "expected dumpfile to contain /etc/hostname, got: {output}"
+    );
+    Ok(())
+}
+integration_test!(test_create_dumpfile_no_repo);
+
+fn test_no_repo_rejects_create_image() -> Result<()> {
+    let sh = Shell::new()?;
+    let cfsctl = cfsctl()?;
+    let fixture_dir = tempfile::tempdir()?;
+    let rootfs = create_test_rootfs(fixture_dir.path())?;
+
+    cmd!(
+        sh,
+        "{cfsctl} --no-repo create-image --no-propagate-usr-to-root {rootfs}"
+    )
+    .run()
+    .expect_err("create-image should fail with --no-repo");
+    Ok(())
+}
+integration_test!(test_no_repo_rejects_create_image);
+
 fn test_fsck_detects_broken_image_ref() -> Result<()> {
     use cap_std_ext::cap_std;