(
state: &State,
root_setup: &RootSetup,
sysroot: &ostree::Sysroot,
storage: &Storage,
has_ostree: bool,
)
| 1023 | |
| 1024 | #[context("Creating ostree deployment")] |
| 1025 | async fn install_container( |
| 1026 | state: &State, |
| 1027 | root_setup: &RootSetup, |
| 1028 | sysroot: &ostree::Sysroot, |
| 1029 | storage: &Storage, |
| 1030 | has_ostree: bool, |
| 1031 | ) -> Result<(ostree::Deployment, InstallAleph)> { |
| 1032 | let sepolicy = state.load_policy()?; |
| 1033 | let sepolicy = sepolicy.as_ref(); |
| 1034 | let stateroot = state.stateroot(); |
| 1035 | |
| 1036 | // TODO factor out this |
| 1037 | let (src_imageref, proxy_cfg) = if !state.source.in_host_mountns { |
| 1038 | (state.source.imageref.clone(), None) |
| 1039 | } else { |
| 1040 | let src_imageref = { |
| 1041 | // We always use exactly the digest of the running image to ensure predictability. |
| 1042 | let digest = state |
| 1043 | .source |
| 1044 | .digest |
| 1045 | .as_ref() |
| 1046 | .ok_or_else(|| anyhow::anyhow!("Missing container image digest"))?; |
| 1047 | let spec = crate::utils::digested_pullspec(&state.source.imageref.name, digest); |
| 1048 | ostree_container::ImageReference { |
| 1049 | transport: ostree_container::Transport::ContainerStorage, |
| 1050 | name: spec, |
| 1051 | } |
| 1052 | }; |
| 1053 | |
| 1054 | let proxy_cfg = crate::deploy::new_proxy_config(); |
| 1055 | (src_imageref, Some(proxy_cfg)) |
| 1056 | }; |
| 1057 | let src_imageref = ostree_container::OstreeImageReference { |
| 1058 | // There are no signatures to verify since we're fetching the already |
| 1059 | // pulled container. |
| 1060 | sigverify: ostree_container::SignatureSource::ContainerPolicyAllowInsecure, |
| 1061 | imgref: src_imageref, |
| 1062 | }; |
| 1063 | |
| 1064 | // Pull the container image into the target root filesystem. Since this is |
| 1065 | // an install path, we don't need to fsync() individual layers. |
| 1066 | let spec_imgref = ImageReference::from(src_imageref.clone()); |
| 1067 | let repo = &sysroot.repo(); |
| 1068 | repo.set_disable_fsync(true); |
| 1069 | |
| 1070 | // Determine whether to use unified storage path. |
| 1071 | // During install, we only use unified storage if explicitly requested. |
| 1072 | // Auto-detection (None) is only appropriate for upgrade/switch on a running system. |
| 1073 | let use_unified = state.target_opts.unified_storage_exp; |
| 1074 | |
| 1075 | let prepared = if use_unified { |
| 1076 | tracing::info!("Using unified storage path for installation"); |
| 1077 | crate::deploy::prepare_for_pull_unified( |
| 1078 | repo, |
| 1079 | &spec_imgref, |
| 1080 | Some(&state.target_imgref), |
| 1081 | storage, |
| 1082 | None, |
no test coverage detected