GetImageMetadata returns metadata about an image such as the UID/GID of the provided username and whether it contains an /sbin/init that we should run.
(ctx context.Context, log slog.Logger, client Client, img, username string)
| 176 | // GetImageMetadata returns metadata about an image such as the UID/GID of the |
| 177 | // provided username and whether it contains an /sbin/init that we should run. |
| 178 | func GetImageMetadata(ctx context.Context, log slog.Logger, client Client, img, username string) (ImageMetadata, error) { |
| 179 | // Creating a dummy container to inspect the filesystem. |
| 180 | created, err := client.ContainerCreate(ctx, |
| 181 | &container.Config{ |
| 182 | Image: img, |
| 183 | Entrypoint: []string{ |
| 184 | "sleep", |
| 185 | }, |
| 186 | Cmd: []string{ |
| 187 | "infinity", |
| 188 | }, |
| 189 | }, |
| 190 | &container.HostConfig{ |
| 191 | Runtime: "sysbox-runc", |
| 192 | }, nil, nil, "") |
| 193 | if err != nil { |
| 194 | return ImageMetadata{}, xerrors.Errorf("create container: %w", err) |
| 195 | } |
| 196 | |
| 197 | defer func() { |
| 198 | // We wanna remove this, but it's not a huge deal if it fails. |
| 199 | _ = client.ContainerRemove(ctx, created.ID, container.RemoveOptions{ |
| 200 | Force: true, |
| 201 | }) |
| 202 | }() |
| 203 | |
| 204 | err = client.ContainerStart(ctx, created.ID, container.StartOptions{}) |
| 205 | if err != nil { |
| 206 | return ImageMetadata{}, xerrors.Errorf("start container: %w", err) |
| 207 | } |
| 208 | |
| 209 | inspect, err := client.ContainerInspect(ctx, created.ID) |
| 210 | if err != nil { |
| 211 | return ImageMetadata{}, xerrors.Errorf("inspect: %w", err) |
| 212 | } |
| 213 | |
| 214 | mergedDir := inspect.GraphDriver.Data["MergedDir"] |
| 215 | // The mergedDir might be empty if we're running dockerd in recovery |
| 216 | // mode. |
| 217 | if mergedDir == "" && inspect.GraphDriver.Name != diskFullStorageDriver { |
| 218 | // The MergedDir is empty when the underlying filesystem does not support |
| 219 | // OverlayFS as an extension. A customer ran into this when using NFS as |
| 220 | // a provider for a PVC. |
| 221 | return ImageMetadata{}, xerrors.Errorf("CVMs do not support NFS volumes") |
| 222 | } |
| 223 | |
| 224 | _, err = ExecContainer(ctx, client, ExecConfig{ |
| 225 | ContainerID: inspect.ID, |
| 226 | Cmd: "stat", |
| 227 | Args: []string{"/sbin/init"}, |
| 228 | }) |
| 229 | initExists := err == nil |
| 230 | |
| 231 | out, err := ExecContainer(ctx, client, ExecConfig{ |
| 232 | ContainerID: inspect.ID, |
| 233 | Cmd: "getent", |
| 234 | Args: []string{"passwd", username}, |
| 235 | }) |
no test coverage detected