Files
podman/pkg/machine/ocipull/source.go
Brent Baude ea4775ec9e Consume OCI images for machine image
allow podman machine to extract its disk image from an oci registry or
oci-dir locally.  for now, the image must be relatively inflexible. it
must have 1 layer.  the layer must possess one image. so a dockerfile
like:

FROM scratch
COPY ./myimage.xz /myimage.xz

when using an oci dir, the directory structure must adhere to the
typical directory structure of a an oci image (with one layer).

── blobs
│   └── sha256
│       ├── 53735773573b3853bb1cae16dd21061beb416239ceb78d4ef1f2a0609f7e843b
│       ├── 80577866ec13c041693e17de61444b4696137623803c3d87f92e4f28a1f4e87b
│       └── af57637ac1ab12f833e3cfa886027cc9834a755a437d0e1cf48b5d4778af7a4e
├── index.json
└── oci-layout

in order to identify this new input, you must use a transport/schema to
differentiate from current podman machine init --image-path behavior. we
will support `oci-dir://` and `docker://` as transports.

when using the docker transport, you can only use an empty transport for
input.  for example, `podman machine init --image-path docker://`.  A
fully quailified image name will be supported in the next iteration.

the transport absent anything means, i want to pull the default fcos
image stored in a registry.  podman will determine its current version
and then look for its correlating manifest.  in this default use case,
it would look for:

quay.io/libpod/podman-machine-images:<version>

that manifest would then point to specific images that contain the
correct arch and provider disk image. i.e.

quay.io/libpod/podman-machine-images:4.6-qcow2

this PR does not enable something like
docker://quay.io/mycorp/myimage:latest yet.

names, addresses, andf schema/transports are all subject to change. the
plan is to keep this all undocumented until things firm up.

[NO NEW TESTS NEEDED]

Signed-off-by: Brent Baude <bbaude@redhat.com>
2023-11-02 10:23:14 -05:00

121 lines
3.4 KiB
Go

package ocipull
import (
"context"
"encoding/json"
"errors"
"fmt"
"strings"
"github.com/containers/image/v5/docker"
"github.com/containers/image/v5/oci/layout"
"github.com/containers/image/v5/types"
"github.com/opencontainers/go-digest"
specV1 "github.com/opencontainers/image-spec/specs-go/v1"
)
// readManifestFromImageSource reads the manifest from the specified image
// source. Note that the manifest is expected to be an OCI v1 manifest.
func readManifestFromImageSource(ctx context.Context, src types.ImageSource) (*specV1.Manifest, *digest.Digest, int64, error) {
rawData, mimeType, err := src.GetManifest(ctx, nil)
if err != nil {
return nil, nil, -1, err
}
if mimeType != specV1.MediaTypeImageManifest {
return nil, nil, -1, fmt.Errorf("image %q is of type %q (expected: %q)", strings.TrimPrefix(src.Reference().StringWithinTransport(), "//"), mimeType, specV1.MediaTypeImageManifest)
}
manifest := specV1.Manifest{}
if err := json.Unmarshal(rawData, &manifest); err != nil {
return nil, nil, -1, fmt.Errorf("reading manifest: %w", err)
}
manifestDigest := digest.FromBytes(rawData)
return &manifest, &manifestDigest, int64(len(rawData)), nil
}
// readManifestFromOCIPath returns the manifest of the specified source image
// at `sourcePath` along with its digest. The digest can later on be used to
// locate the manifest on the file system.
func readManifestFromOCIPath(ctx context.Context, sourcePath string) (*specV1.Manifest, *digest.Digest, int64, error) {
ociRef, err := layout.ParseReference(sourcePath)
if err != nil {
return nil, nil, -1, err
}
ociSource, err := ociRef.NewImageSource(ctx, &types.SystemContext{})
if err != nil {
return nil, nil, -1, err
}
defer ociSource.Close()
return readManifestFromImageSource(ctx, ociSource)
}
func GetLocalBlob(ctx context.Context, path string) (*types.BlobInfo, error) {
ociRef, err := layout.ParseReference(path)
if err != nil {
return nil, err
}
img, err := ociRef.NewImage(ctx, &types.SystemContext{})
if err != nil {
return nil, err
}
b, _, err := img.Manifest(ctx)
if err != nil {
return nil, err
}
localManifest := specV1.Manifest{}
if err := json.Unmarshal(b, &localManifest); err != nil {
return nil, err
}
blobs := img.LayerInfos()
if err != nil {
return nil, err
}
if len(blobs) != 1 {
return nil, errors.New("invalid disk image")
}
fmt.Println(blobs[0].Digest.Hex())
return &blobs[0], nil
}
func GetRemoteManifest(ctx context.Context, dest string) (*specV1.Manifest, error) {
ref, err := docker.ParseReference(fmt.Sprintf("//%s", dest))
if err != nil {
return nil, err
}
imgSrc, err := ref.NewImage(ctx, &types.SystemContext{})
if err != nil {
return nil, err
}
b, _, err := imgSrc.Manifest(ctx)
if err != nil {
return nil, err
}
remoteManifest := specV1.Manifest{}
err = json.Unmarshal(b, &remoteManifest)
return &remoteManifest, err
}
func GetRemoteDescriptor(ctx context.Context, dest string) (*specV1.Descriptor, error) {
remoteManifest, err := GetRemoteManifest(ctx, dest)
if err != nil {
return nil, err
}
if len(remoteManifest.Layers) != 1 {
return nil, errors.New("invalid remote disk image")
}
return &remoteManifest.Layers[0], nil
}
func ReadImageManifestFromOCIPath(ctx context.Context, ociImagePath string) (*specV1.Manifest, error) {
imageManifest, _, _, err := readManifestFromOCIPath(ctx, ociImagePath)
return imageManifest, err
}