Function openUserFile

pkg/oci/spec_opts.go:1851–1883

openUserFile attempts to open a file within the root fs. It handles cases where the file is an absolute symlink (e.g., NixOS /etc/passwd -> /nix/store/...), which triggers "path escapes from parent" errors in Go 1.24+ due to stricter os.DirFS validation. The returned file rejects non-regular source

(root fs.FS, name string)

// The returned file rejects non-regular sources and returns an error if more
// than maxUserFileBytes are read from it.
func openUserFile(root fs.FS, name string) (fs.File, error) {
	f, err := root.Open(name)
	if err == nil {
		return wrapUserFile(f, name)
	}

	// Check if the FS implements our local ReadLink interface.
	// We use a local interface instead of fs.ReadLinkFS to avoid strict dependency
	// issues in some build environments.
	if lfs, ok := root.(readLinker); ok {
		if target, lerr := lfs.ReadLink(name); lerr == nil {
			// Use filepath.IsAbs to handle platform-agnostic absolute path checks
			if filepath.IsAbs(target) {
				// Re-anchor the absolute path to the root.
				// e.g. /nix/store/... becomes nix/store/... (relative to root fs)
				// We use filepath.Rel to safely strip the leading separator.
				rel, rerr := filepath.Rel(string(filepath.Separator), target)
				if rerr == nil {
					// filepath.Rel might return OS-specific separators (backslashes on Windows).
					// fs.Open strictly expects forward slashes, so we convert it.
					f, oerr := root.Open(filepath.ToSlash(rel))
					if oerr != nil {
						return nil, oerr
					}
					return wrapUserFile(f, name)
				}
			}
		}
	}

	// Return the original error if we couldn't resolve it
	return nil, err
}

// maxUserFileBytes caps how much data is read from any user-database file
// opened via openUserFile. Real systems keep these files well under 1 MiB;