feat(shim): manage rootfs views in task lifecycle

Choose guest rootfs parameters after inner task creation and persist them
for runtime Exec. When enabled, prepare a rootfs view during Create, roll
it back on persistence failures, and clean it during Delete.

Signed-off-by: sidneychang <2190206983@qq.com>

Author: sidneychang

docs/package/index.md

@@ -73,6 +73,16 @@ Except of the above, `urunc` accepts the following optional annotations:
   requests from `urunc` to mount the container's image rootfs in the unikernel
   (either as a block device or through shared-fs).
 
+Per-container rootfs views are controlled by `[rootfs_view] enabled` in
+`/etc/urunc/config.toml`. See
+[configuration](../configuration.md#rootfs-view-configuration). When enabled,
+the container must also use `com.urunc.unikernel.mountRootfs=true` (typically
+from image annotations merged into `config.json` before shim task Create).
+Supported snapshotters include `devmapper` and `blockfile`. After the wrapped
+task service creates the task and mounts the bundle rootfs, the shim runs
+`ChooseRootfs` and prepares a view only when that selection is container block
+rootfs.
+
 Due to the fact that [Docker](https://www.docker.com/) and some high-level
 container runtimes do not pass the image annotations to the underlying container
 runtime, `urunc` can also read the above information from a file inside the

pkg/containerd-shim/containerd/annotations.go

@@ -86,7 +86,7 @@ func InjectUruncAnnotations(ctx context.Context, session *Session, bundlePath st
 		return nil
 	}
 
-	return patchConfigJSON(bundlePath, annotations)
+	return PatchConfigJSON(bundlePath, annotations)
 }
 
 func (f *annotationFetcher) fetchUruncAnnotations(ctx context.Context) (map[string]string, error) {
@@ -152,12 +152,12 @@ func readBlob(ctx context.Context, namespace string, contentClient contentapi.Co
 	return raw, nil
 }
 
-// patchConfigJSON injects missing annotations into the OCI runtime spec
-// stored in the bundle's config.json.
+// PatchConfigJSON injects missing annotations into the OCI runtime spec stored in
+// the bundle's config.json.
 //
 // Existing annotations in config.json are preserved. Only annotation keys that
 // are not already present in the runtime spec are added.
-func patchConfigJSON(bundlePath string, annotations map[string]string) error {
+func PatchConfigJSON(bundlePath string, annotations map[string]string) error {
 	configPath := filepath.Join(bundlePath, "config.json")
 
 	fi, err := os.Stat(configPath)

pkg/containerd-shim/guest_rootfs.go

@@ -24,44 +24,38 @@ import (
 	taskAPI "github.com/containerd/containerd/api/runtime/task/v2"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/urunc-dev/urunc/pkg/unikontainers"
+	"github.com/urunc-dev/urunc/pkg/unikontainers/types"
 )
 
-const annotRootfsParams = "com.urunc.internal.rootfs.params"
-
 var errGuestRootfsChoiceSkipped = errors.New("guest rootfs choice skipped")
 
 // chooseGuestRootfs runs the same ChooseRootfs logic as runtime Exec after inner
-// task Create (#684) and records the result in annotRootfsParams so Exec knows
-// selection already happened.
-func chooseGuestRootfs(r *taskAPI.CreateTaskRequest) error {
+// task Create (#684). The caller persists the result in bundle config.json so
+// Exec can reuse the selection.
+func chooseGuestRootfs(r *taskAPI.CreateTaskRequest) (types.RootfsParams, error) {
 	configPath := filepath.Join(r.Bundle, "config.json")
-	info, err := os.Stat(configPath)
-	if err != nil {
-		return fmt.Errorf("stat config.json: %w", err)
-	}
-
 	data, err := os.ReadFile(configPath)
 	if err != nil {
-		return fmt.Errorf("read config.json: %w", err)
+		return types.RootfsParams{}, fmt.Errorf("read config.json: %w", err)
 	}
 
 	var spec specs.Spec
 	if err := json.Unmarshal(data, &spec); err != nil {
-		return fmt.Errorf("unmarshal config.json: %w", err)
+		return types.RootfsParams{}, fmt.Errorf("unmarshal config.json: %w", err)
 	}
 	if spec.Root == nil {
-		return fmt.Errorf("invalid OCI spec: root section is required")
+		return types.RootfsParams{}, fmt.Errorf("invalid OCI spec: root section is required")
 	}
 
 	config, err := unikontainers.GetUnikernelConfig(filepath.Clean(r.Bundle), &spec)
 	if err != nil {
-		return fmt.Errorf("%w: %w", errGuestRootfsChoiceSkipped, err)
+		return types.RootfsParams{}, fmt.Errorf("%w: %w", errGuestRootfsChoiceSkipped, err)
 	}
 
 	annotations := config.Map()
 	uruncCfg, err := unikontainers.LoadUruncConfig(unikontainers.UruncConfigPath)
 	if err != nil && uruncCfg == nil {
-		return err
+		return types.RootfsParams{}, err
 	}
 
 	rootfsParams, err := unikontainers.ChooseRootfs(
@@ -71,22 +65,8 @@ func chooseGuestRootfs(r *taskAPI.CreateTaskRequest) error {
 		uruncCfg,
 	)
 	if err != nil {
-		return err
-	}
-
-	encoded, err := json.Marshal(rootfsParams)
-	if err != nil {
-		return err
-	}
-	if spec.Annotations == nil {
-		spec.Annotations = make(map[string]string)
-	}
-	spec.Annotations[annotRootfsParams] = string(encoded)
-
-	patched, err := json.MarshalIndent(spec, "", "  ")
-	if err != nil {
-		return fmt.Errorf("marshal config.json: %w", err)
+		return types.RootfsParams{}, err
 	}
 
-	return os.WriteFile(configPath, patched, info.Mode())
+	return rootfsParams, nil
 }

pkg/containerd-shim/task_plugin.go

@@ -15,6 +15,9 @@
 package containerdshim
 
 import (
+	"os"
+	"path/filepath"
+
 	"github.com/containerd/containerd/pkg/shutdown"
 	"github.com/containerd/containerd/plugin"
 	runcTask "github.com/containerd/containerd/runtime/v2/runc/task"
@@ -45,9 +48,15 @@ func init() {
 				return nil, err
 			}
 
+			cwd, err := os.Getwd()
+			if err != nil {
+				return nil, err
+			}
+
 			return &taskService{
 				TaskService:       inner,
 				containerdAddress: ic.Address,
+				stateRoot:         filepath.Dir(filepath.Dir(cwd)),
 			}, nil
 		},
 	})

pkg/containerd-shim/task_service.go

@@ -16,21 +16,31 @@ package containerdshim
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
+	"fmt"
+	"path/filepath"
 
 	taskAPI "github.com/containerd/containerd/api/runtime/task/v2"
+	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/log"
 	"github.com/containerd/ttrpc"
 	containerdShim "github.com/urunc-dev/urunc/pkg/containerd-shim/containerd"
+	"github.com/urunc-dev/urunc/pkg/unikontainers"
 )
 
+// Internal bundle annotation (duplicated in unikontainers; keep in sync).
+const annotRootfsParams = "com.urunc.internal.rootfs.params"
+
 // taskService is urunc's shim-side wrapper around containerd's runc task
 // service. It wires urunc task setup before forwarding calls to the wrapped
 // service.
 type taskService struct {
 	taskAPI.TaskService
 
 	containerdAddress string
+	// Used on Delete, where cwd may no longer be the bundle.
+	stateRoot string
 }
 
 func (s *taskService) Create(ctx context.Context, r *taskAPI.CreateTaskRequest) (*taskAPI.CreateTaskResponse, error) {
@@ -53,9 +63,8 @@ func (s *taskService) Create(ctx context.Context, r *taskAPI.CreateTaskRequest)
 		return resp, err
 	}
 
-	// ChooseRootfs after inner task Create so bundle rootfs is mounted;
-	// params are persisted in bundle config.json for runtime Exec.
-	if err := chooseGuestRootfs(r); err != nil {
+	rootfsChoice, err := chooseGuestRootfs(r)
+	if err != nil {
 		if errors.Is(err, errGuestRootfsChoiceSkipped) {
 			log.G(ctx).WithError(err).Debug("urunc(shim): guest rootfs choice skipped")
 			return resp, nil
@@ -64,14 +73,125 @@ func (s *taskService) Create(ctx context.Context, r *taskAPI.CreateTaskRequest)
 		return nil, err
 	}
 
+	rootfsViewState, shouldPrepareRootfsView, err := containerdShim.PrepareRootfsView(ctx, session, rootfsChoice, r.Bundle)
+	rootfsViewPrepared := err == nil && shouldPrepareRootfsView
+	switch {
+	case err != nil && shouldPrepareRootfsView:
+		log.G(ctx).WithError(err).Warn("urunc(shim): failed to prepare rootfs view; falling back to legacy boot artifact extraction")
+	case err != nil:
+		log.G(ctx).WithError(err).Warn("urunc(shim): failed to load urunc config; rootfs view disabled")
+	case rootfsViewPrepared:
+		log.G(ctx).Debug("urunc(shim): rootfs view prepared")
+	case session != nil:
+		log.G(ctx).WithField("rootfs_type", rootfsChoice.Type).Debug("urunc(shim): rootfs view prepare skipped")
+	}
+
+	rootfsViewPersisted := false
+	defer func() {
+		if rootfsViewPrepared && !rootfsViewPersisted {
+			cleanupRootfsView(ctx, session, "", rootfsViewState.Mountpoint, "create rollback")
+		}
+	}()
+
+	rootfsParamsJSON, err := json.Marshal(rootfsChoice)
+	if err != nil {
+		log.G(ctx).WithError(err).Warn("urunc(shim): failed to encode rootfs params")
+		return nil, err
+	}
+
+	if err := containerdShim.PatchConfigJSON(r.Bundle, map[string]string{
+		annotRootfsParams: string(rootfsParamsJSON),
+	}); err != nil {
+		log.G(ctx).WithError(err).Warn("urunc(shim): failed to persist shim create annotations")
+		return nil, err
+	}
+
+	if rootfsViewPrepared {
+		if err := unikontainers.WriteBundleRootfsView(r.Bundle, rootfsViewState); err != nil {
+			log.G(ctx).WithError(err).Warn("urunc(shim): failed to persist rootfs view state")
+			return nil, err
+		}
+		rootfsViewPersisted = true
+	}
+
 	return resp, nil
 }
 
+func cleanupRootfsView(ctx context.Context, session *containerdShim.Session, snapshotter, mountpoint, reason string) {
+	if err := containerdShim.CleanupRootfsView(ctx, session, snapshotter, mountpoint); err != nil {
+		log.G(ctx).WithError(err).WithField("reason", reason).Warn("urunc(shim): failed to clean up rootfs view")
+	}
+}
+
 func (s *taskService) Delete(ctx context.Context, r *taskAPI.DeleteRequest) (*taskAPI.DeleteResponse, error) {
-	return s.TaskService.Delete(ctx, r)
+	shouldCleanup := false
+	snapshotter := ""
+	rootfsViewMountpoint := ""
+	var loadErr error
+
+	if r.ExecID == "" {
+		bundle, err := s.bundlePathFor(ctx, r.ID)
+		if err != nil {
+			log.G(ctx).WithError(err).Warn("urunc(shim): resolve bundle path during Delete failed")
+			loadErr = err
+		} else {
+			// Read view state before inner Delete; snapshotter is taken from bundle
+			// (written at Prepare) because container metadata may be gone after Delete.
+			var mountpoint string
+			shouldCleanup, snapshotter, mountpoint, loadErr = containerdShim.ShouldCleanupRootfsView(bundle)
+			if loadErr == nil {
+				rootfsViewMountpoint = mountpoint
+			}
+		}
+	}
+
+	// Delete tears down the monitor namespace before removing the view it may pin.
+	resp, err := s.TaskService.Delete(ctx, r)
+
+	if loadErr != nil {
+		if err != nil {
+			return resp, err
+		}
+		return resp, loadErr
+	}
+
+	if shouldCleanup {
+		session, sessionErr := containerdShim.OpenSession(ctx, s.containerdAddress, r.ID)
+		if sessionErr != nil {
+			log.G(ctx).WithError(sessionErr).Warn("urunc(shim): open containerd session for rootfs view cleanup failed")
+			if err == nil {
+				err = sessionErr
+			}
+		} else {
+			defer func() {
+				if err := session.Close(); err != nil {
+					log.G(ctx).WithError(err).Warn("urunc(shim): failed to close containerd session after rootfs view cleanup")
+				}
+			}()
+			if cleanupErr := containerdShim.CleanupRootfsView(ctx, session, snapshotter, rootfsViewMountpoint); cleanupErr != nil {
+				log.G(ctx).WithError(cleanupErr).Warn("urunc(shim): delete rootfs view during Delete failed")
+				if err == nil {
+					err = cleanupErr
+				}
+			}
+		}
+	}
+
+	return resp, err
 }
 
 func (s *taskService) RegisterTTRPC(server *ttrpc.Server) error {
 	taskAPI.RegisterTaskService(server, s)
 	return nil
 }
+
+func (s *taskService) bundlePathFor(ctx context.Context, containerID string) (string, error) {
+	if s.stateRoot == "" {
+		return "", fmt.Errorf("task service state root is empty (shim cwd layout assumption violated)")
+	}
+	ns, err := namespaces.NamespaceRequired(ctx)
+	if err != nil {
+		return "", fmt.Errorf("namespace required: %w", err)
+	}
+	return filepath.Join(s.stateRoot, ns, containerID), nil
+}