Re: SPAM: [RFC PATCH 1/4] lxc: create: add isolated OCI rootfs preparation

[Filip Schauer <f.schauer@proxmox.com>]

On 09/07/2026 10:21, copystring wrote:
> +my sub oci_rootfs_size_to_gb {
> +    my ($size) = @_;
> +
> +    my $size_mib = int(($size + 1024 * 1024 - 1) / (1024 * 1024));
> +    my $size_gb = sprintf('%.6f', $size_mib / 1024);
> +    $size_gb =~ s/0+$//;
> +    $size_gb =~ s/\.$//;
> +
> +    return $size_gb;
> +}

This looks like a generic utility, not specific to OCI.


> +sub create_oci_rootfs {
> +    my ($storage_cfg, $vmid, $archive, $storage, $size, $conf, $rootdir_base) = @_;
> +
> +    die "archive '$archive' is not an OCI image archive\n"
> +        if !archive_is_oci_format($storage_cfg, $archive);
> +
> +    my $size_gb = oci_rootfs_size_to_gb($size);
> +    my $rootfs = PVE::LXC::Config->parse_volume('rootfs', $conf->{rootfs});
> +    my $new_rootfs_config = {
> +        %$rootfs,
> +        volume => "$storage:$size_gb",
> +    };
> +    delete $new_rootfs_config->{type};
> +    delete $new_rootfs_config->{size};
> +
> +    my $settings = {
> +        rootfs => PVE::LXC::Config->print_ct_mountpoint($new_rootfs_config, 1),
> +    };
> +    my $new_conf = {
> +        lxc => oci_config_lxc_copy($conf),
> +    };
> +    $new_conf->{unprivileged} = $conf->{unprivileged} if exists($conf->{unprivileged});
> +
> +    $rootdir_base //= "/var/lib/lxc/$vmid";
> +    File::Path::make_path($rootdir_base);
> +    my $rootdir = "$rootdir_base/.oci-replace-rootfs";
> +
> +    my $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $settings, $new_conf);
> +    my $new_rootfs = PVE::LXC::Config->parse_volume('rootfs', $new_conf->{rootfs});
> +    my $new_volid = $new_rootfs->{volume};
> +
> +    eval {
> +        my (undef, $root_uid, $root_gid) = PVE::LXC::parse_id_maps($conf);
> +
> +        $new_conf = PVE::LXC::run_unshared(sub {
> +            die "temporary OCI rootfs path '$rootdir' already exists\n" if -e $rootdir;
> +
> +            my @mounted;
> +            eval {
> +                mkdir $rootdir
> +                    or die "failed to create temporary OCI rootfs path '$rootdir': $!\n";
> +
> +                my $mountpoint = { %$new_rootfs, mp => '/', ro => 0 };
> +                PVE::LXC::mountpoint_mount(
> +                    $mountpoint, $rootdir, $storage_cfg, undef, $root_uid, $root_gid,
> +                );
> +                push @mounted, $rootdir;
> +
> +                restore_oci_archive($storage_cfg, $archive, $rootdir, $new_conf);
> +                PVE::LXC::Setup->new($new_conf, $rootdir); # detect OS and architecture
> +            };
> +            my $err = $@;
> +            my $cleanup_err = '';
> +
> +            foreach my $mount (reverse @mounted) {
> +                eval {
> +                    PVE::Tools::run_command(['/bin/umount', $mount], errfunc => sub { });
> +                };
> +                $cleanup_err .= "can't unmount temporary OCI rootfs path '$mount': $@\n" if $@;
> +            }
> +
> +            $cleanup_err .= "failed to remove temporary OCI rootfs path '$rootdir': $!\n"
> +                if -d $rootdir && !rmdir $rootdir;
> +
> +            die $err if $err;
> +            die $cleanup_err if $cleanup_err;
> +
> +            return $new_conf;
> +        });
> +    };
> +    if (my $err = $@) {
> +        PVE::LXC::destroy_disks($storage_cfg, $vollist);
> +        die $err;
> +    }
> +
> +    return ($new_conf->{rootfs}, $new_volid, $new_conf);
> +}

This looks very similar to PVE::LXC::copy_volume.


> diff --git a/src/test/Makefile b/src/test/Makefile
> index 91ae6ff..8da35ee 100644
> --- a/src/test/Makefile
> +++ b/src/test/Makefile
> @@ -2,7 +2,7 @@ RUN_USERNS := lxc-usernsexec -m "u:0:`id -u`:1" -m "g:0:`id -g`:1" --
>   
>   all: test
>   
> -test: test_setup test_snapshot test_bindmount test_idmap
> +test: test_setup test_snapshot test_bindmount test_idmap test_oci_rootfs_replace
>   
>   test_setup: run_setup_tests.pl
>   	if test -e /run/lock/sbuild; then \
> @@ -24,5 +24,7 @@ test_bindmount: bindmount_test.pl
>   test_idmap: run_idmap_tests.pl
>   	./run_idmap_tests.pl
>   
> +test_oci_rootfs_replace: run_oci_rootfs_replace_tests.pl
> +	./run_oci_rootfs_replace_tests.pl
>   clean:
>   	rm -rf tmprootfs
Tests should be factored out into a separate patch.