From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 5E38A1FF0E5 for ; Wed, 15 Jul 2026 14:02:36 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id B4F23213ED; Wed, 15 Jul 2026 14:02:35 +0200 (CEST) Message-ID: <517f5e19-4dd5-4b43-af7f-44183ca94c98@proxmox.com> Date: Wed, 15 Jul 2026 14:02:01 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: SPAM: [RFC PATCH 1/4] lxc: create: add isolated OCI rootfs preparation To: copystring , pve-devel@lists.proxmox.com References: <20260706194059.280257-1-copystring@gmail.com> <20260706194059.280257-2-copystring@gmail.com> Content-Language: en-US From: Filip Schauer In-Reply-To: <20260706194059.280257-2-copystring@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784116904084 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.125 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: JZ7DLHBR7KEHVNWCFEXSEK5AM6L4IKBF X-Message-ID-Hash: JZ7DLHBR7KEHVNWCFEXSEK5AM6L4IKBF X-MailFrom: f.schauer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 09/07/2026 10:21, copystring wrote: > +my sub oci_rootfs_size_to_gb { > + my ($size) = @_; > + > + my $size_mib = int(($size + 1024 * 1024 - 1) / (1024 * 1024)); > + my $size_gb = sprintf('%.6f', $size_mib / 1024); > + $size_gb =~ s/0+$//; > + $size_gb =~ s/\.$//; > + > + return $size_gb; > +} This looks like a generic utility, not specific to OCI. > +sub create_oci_rootfs { > + my ($storage_cfg, $vmid, $archive, $storage, $size, $conf, $rootdir_base) = @_; > + > + die "archive '$archive' is not an OCI image archive\n" > + if !archive_is_oci_format($storage_cfg, $archive); > + > + my $size_gb = oci_rootfs_size_to_gb($size); > + my $rootfs = PVE::LXC::Config->parse_volume('rootfs', $conf->{rootfs}); > + my $new_rootfs_config = { > + %$rootfs, > + volume => "$storage:$size_gb", > + }; > + delete $new_rootfs_config->{type}; > + delete $new_rootfs_config->{size}; > + > + my $settings = { > + rootfs => PVE::LXC::Config->print_ct_mountpoint($new_rootfs_config, 1), > + }; > + my $new_conf = { > + lxc => oci_config_lxc_copy($conf), > + }; > + $new_conf->{unprivileged} = $conf->{unprivileged} if exists($conf->{unprivileged}); > + > + $rootdir_base //= "/var/lib/lxc/$vmid"; > + File::Path::make_path($rootdir_base); > + my $rootdir = "$rootdir_base/.oci-replace-rootfs"; > + > + my $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $settings, $new_conf); > + my $new_rootfs = PVE::LXC::Config->parse_volume('rootfs', $new_conf->{rootfs}); > + my $new_volid = $new_rootfs->{volume}; > + > + eval { > + my (undef, $root_uid, $root_gid) = PVE::LXC::parse_id_maps($conf); > + > + $new_conf = PVE::LXC::run_unshared(sub { > + die "temporary OCI rootfs path '$rootdir' already exists\n" if -e $rootdir; > + > + my @mounted; > + eval { > + mkdir $rootdir > + or die "failed to create temporary OCI rootfs path '$rootdir': $!\n"; > + > + my $mountpoint = { %$new_rootfs, mp => '/', ro => 0 }; > + PVE::LXC::mountpoint_mount( > + $mountpoint, $rootdir, $storage_cfg, undef, $root_uid, $root_gid, > + ); > + push @mounted, $rootdir; > + > + restore_oci_archive($storage_cfg, $archive, $rootdir, $new_conf); > + PVE::LXC::Setup->new($new_conf, $rootdir); # detect OS and architecture > + }; > + my $err = $@; > + my $cleanup_err = ''; > + > + foreach my $mount (reverse @mounted) { > + eval { > + PVE::Tools::run_command(['/bin/umount', $mount], errfunc => sub { }); > + }; > + $cleanup_err .= "can't unmount temporary OCI rootfs path '$mount': $@\n" if $@; > + } > + > + $cleanup_err .= "failed to remove temporary OCI rootfs path '$rootdir': $!\n" > + if -d $rootdir && !rmdir $rootdir; > + > + die $err if $err; > + die $cleanup_err if $cleanup_err; > + > + return $new_conf; > + }); > + }; > + if (my $err = $@) { > + PVE::LXC::destroy_disks($storage_cfg, $vollist); > + die $err; > + } > + > + return ($new_conf->{rootfs}, $new_volid, $new_conf); > +} This looks very similar to PVE::LXC::copy_volume. > diff --git a/src/test/Makefile b/src/test/Makefile > index 91ae6ff..8da35ee 100644 > --- a/src/test/Makefile > +++ b/src/test/Makefile > @@ -2,7 +2,7 @@ RUN_USERNS := lxc-usernsexec -m "u:0:`id -u`:1" -m "g:0:`id -g`:1" -- > > all: test > > -test: test_setup test_snapshot test_bindmount test_idmap > +test: test_setup test_snapshot test_bindmount test_idmap test_oci_rootfs_replace > > test_setup: run_setup_tests.pl > if test -e /run/lock/sbuild; then \ > @@ -24,5 +24,7 @@ test_bindmount: bindmount_test.pl > test_idmap: run_idmap_tests.pl > ./run_idmap_tests.pl > > +test_oci_rootfs_replace: run_oci_rootfs_replace_tests.pl > + ./run_oci_rootfs_replace_tests.pl > clean: > rm -rf tmprootfs Tests should be factored out into a separate patch.