image: support UID/GID mapping options in the storage transport

Add uidMap/gidMap fields to storageReference and storageImageDestination
so that callers can specify ID mappings when pulling images.

This is the first half of a fix to avoid the expensive post-pull chown
that happens when creating containers with user namespace remapping
(e.g., --userns=keep-id) when there is no idmapped mount support like
in rootless Podman.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Author: giuseppe

image/storage/storage_dest.go

@@ -37,6 +37,7 @@ import (
 	"go.podman.io/storage/pkg/archive"
 	"go.podman.io/storage/pkg/chunked"
 	"go.podman.io/storage/pkg/chunked/toc"
+	"go.podman.io/storage/pkg/idtools"
 	"go.podman.io/storage/pkg/ioutils"
 )
 
@@ -58,6 +59,8 @@ type storageImageDestination struct {
 	stubs.AlwaysSupportsSignatures
 
 	imageRef              storageReference
+	uidMap                []idtools.IDMap
+	gidMap                []idtools.IDMap
 	directory             string                   // Temporary directory where we store blobs until Commit() time
 	nextTempFileID        atomic.Int32             // A counter that we use for computing filenames to assign to blobs
 	manifest              []byte                   // (Per-instance) manifest contents, or nil if not yet known.
@@ -164,6 +167,8 @@ func newImageDestination(sys *types.SystemContext, imageRef storageReference) (*
 		}),
 
 		imageRef:     imageRef,
+		uidMap:       imageRef.uidMap,
+		gidMap:       imageRef.gidMap,
 		directory:    directory,
 		signatureses: make(map[digest.Digest][]byte),
 		metadata: storageImageMetadata{
@@ -1274,12 +1279,17 @@ func (s *storageImageDestination) createNewLayer(index int, trusted trustedLayer
 	defer file.Close()
 	// Build the new layer using the diff, regardless of where it came from.
 	// TODO: This can take quite some time, and should ideally be cancellable using ctx.Done().
-	layer, _, err := s.imageRef.transport.store.PutLayer(newLayerID, parentLayer, nil, "", false, &storage.LayerOptions{
+	layerOptions := &storage.LayerOptions{
 		OriginalDigest: trustedOriginalDigest,
 		OriginalSize:   trustedOriginalSize, // nil in many cases
 		// This might be "" if trusted.layerIdentifiedByTOC; in that case PutLayer will compute the value from the stream.
 		UncompressedDigest: trusted.diffID,
-	}, file)
+	}
+	if len(s.uidMap) > 0 || len(s.gidMap) > 0 {
+		layerOptions.UIDMap = s.uidMap
+		layerOptions.GIDMap = s.gidMap
+	}
+	layer, _, err := s.imageRef.transport.store.PutLayer(newLayerID, parentLayer, nil, "", false, layerOptions, file)
 	if err != nil && !errors.Is(err, storage.ErrDuplicateID) {
 		return nil, fmt.Errorf("adding layer with blob %s: %w", trusted.logString(), err)
 	}

image/storage/storage_reference.go

@@ -15,6 +15,7 @@ import (
 	"go.podman.io/image/v5/transports"
 	"go.podman.io/image/v5/types"
 	"go.podman.io/storage"
+	"go.podman.io/storage/pkg/idtools"
 )
 
 // A storageReference holds an arbitrary name and/or an ID, which is a 32-byte
@@ -25,6 +26,15 @@ type storageReference struct {
 	transport storageTransport
 	named     reference.Named // may include a tag and/or a digest
 	id        string
+	uidMap    []idtools.IDMap
+	gidMap    []idtools.IDMap
+}
+
+// SetIDMappingOptions sets the UID/GID mapping options for the image reference.
+// When set, layers created for this image will use these mappings.
+func (ref *storageReference) SetIDMappingOptions(uidMap, gidMap []idtools.IDMap) {
+	ref.uidMap = uidMap
+	ref.gidMap = gidMap
 }
 
 func newReference(transport storageTransport, named reference.Named, id string) (*storageReference, error) {