SPAM: [RFC PATCH v2 0/4] lxc: add safe OCI rootfs replacement

[copystring <copystring@gmail.com>]

This RFC adds an explicit rootfs replacement path for stopped LXC
containers created from OCI images. The intent is to support the common
"refresh the OCI image" workflow without pretending that data stored
inside the old rootfs can be merged safely.

The safety model is intentionally conservative:

* require an explicit confirmation parameter;
* only operate on stopped, non-template, non-HA, unprotected CTs without
  snapshots or pending config changes;
* only replace the active rootfs volume, while preserving mpX mount
  points;
* keep the previous rootfs as an unusedX volume instead of deleting it;
* fail if no unusedX slot is available;
* never remove the newly allocated rootfs once config writing has
  started;
* do not use overlayfs or path heuristics such as /config or /data
  detection;
* reject shrink-like requests by requiring the target size to be at
  least the current rootfs size.

This means data that only exists on / becomes data on the old unused
volume, not on the new active rootfs. Users are expected to keep
persistent application data on separate mount points or to have a backup
before replacing the rootfs.

By default, the endpoint also updates OCI-derived runtime config such as
entrypoint, environment, ostype, arch and OCI-generated lxc keys. A
caller can set update-oci-config=0 to preserve the existing runtime
config and only switch the rootfs.

Changes since v1:

* rebased on current master (ed062ee);
* renamed generic helpers that were not OCI-specific;
* split the new-rootfs allocation and temporary mount/populate flow into
  a generic helper, keeping the OCI archive restore as the populate
  callback and following the same allocate-before-unshare shape as
  copy_volume;
* moved the test Makefile integration into the test patch;
* fixed the new test runner file mode to 100755.

The pve-manager and pve-docs companion patches from v1 are not resent
here, since the backend API and user-facing semantics are unchanged. If
this backend shape looks reasonable, they can be resent/rebased once the
backend direction is clearer.

Tested on a disposable PVE 9.2.2 VM:

* git am --keep-cr on current origin/master;
* git diff --check origin/master...HEAD;
* src/test/run_oci_rootfs_replace_tests.pl;
* make -C src check;
* make clean deb.

copystring (4):
  lxc: create: add isolated OCI rootfs preparation
  api: lxc: add OCI rootfs replacement endpoint
  pct: add OCI rootfs replacement command
  test: cover OCI rootfs replacement API transaction

 src/PVE/API2/LXC.pm                      | 300 ++++++++++++++
 src/PVE/CLI/pct.pm                       |   8 +
 src/PVE/LXC/Create.pm                    | 115 ++++++
 src/test/Makefile                        |   4 +-
 src/test/api-oci-rootfs-replace-test.pm  | 486 +++++++++++++++++++++++
 src/test/oci-rootfs-replace-test.pm      | 250 ++++++++++++
 src/test/run_oci_rootfs_replace_tests.pl |  10 +
 7 files changed, 1172 insertions(+), 1 deletion(-)
 create mode 100644 src/test/api-oci-rootfs-replace-test.pm
 create mode 100644 src/test/oci-rootfs-replace-test.pm
 create mode 100755 src/test/run_oci_rootfs_replace_tests.pl

-- 
2.55.0.windows.3