[EN-1595] fix(orchestrator): unpack OCI layers in chroot like Docker daemon#3215
Conversation
Layers containing relative symlinks that lexically escape the layer dir but resolve fine at runtime (e.g. /nix/store/.links entries created by nix store optimise) failed with 'invalid symlink'. Use moby/go-archive chrootarchive, which untars on an OS thread chrooted into the layer dir so the breakout check clamps at the layer root. Drops the containers/storage dependency.
PR SummaryMedium Risk Overview Reviewed by Cursor Bugbot for commit 26f6535. Bugbot is set up for automated code reviews on this repo. Configure here. |
❌ 1 Tests Failed:
View the top 1 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d00ec07. Configure here.
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
jakubno
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d00ec074f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Layers with .wh.foo + foo/.wh.bar (rm -rf-style deletes, emitted by kaniko and others) fail with ENOTDIR on moby chrootarchive; the previous containers/storage path tolerated the redundant child whiteout.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3cd8331573
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jakubno
force-pushed
the
fix/clamp-symlinks-to-root
branch
from
3cd8331 to
9386304
Compare
euid 0 alone is not enough: rootful containers without CAP_SYS_ADMIN fail unshare(CLONE_NEWNS) with EPERM. Probe on a discarded locked OS thread and skip when unavailable.
Layers with redundant nested whiteouts (.wh.foo + foo/.wh.bar) are rejected by stock Docker too (overlay2 and containerd snapshotter both fail with ENOTDIR); only containers/storage tolerates them. Not worth carrying a custom tar filter for images Docker cannot pull. Test now documents the limitation.
| ) | ||
|
|
||
| // untarLayer runs the same unpack call used by createExport in oci.go. | ||
| func untarLayer(t *testing.T, layer *bytes.Buffer) (string, error) { |
There was a problem hiding this comment.
the tests here are testing if the library works as expected (which they shouldn't), not if our implementation works as expected
2 participants
/../../a/b/cto be resolved to/a/b/cIgnoreChownErrorsshouldn't be needed as it's run as rootLayers containing relative symlinks that lexically escape the layer dir but resolve fine at runtime (e.g. /nix/store/.links entries created by nix store optimise) failed with 'invalid symlink'. Use moby/go-archive chrootarchive, which untars on an OS thread chrooted into the layer dir so the breakout check clamps at the layer root. Drops the containers/storage dependency.