Documentation
¶
Overview ¶
Package buildcontext holds a build context: the files a Containerfile's COPY and ADD read, received as a tar stream (from wctr, or from a stage or image through the engine) and kept in memory. Nothing in it ever names a host path: a build reads only what was sent.
The stream is untrusted. Names are cleaned and must stay inside the context (no absolute names, no ".."); the total size, the number of entries, name length and depth are bounded; symbolic links are kept as links and only followed, when a source path goes through one, inside the context — a link that leads out of it is an error.
Index ¶
- Variables
- func CleanName(name string, lim Limits) (string, error)
- func HasMeta(p string) bool
- func ReadIgnore(fsys fs.FS) (*ignore.Matcher, string, error)
- type Context
- func (c *Context) Add(p string, e *Entry) error
- func (c *Context) Bytes() int64
- func (c *Context) Exclude(m *ignore.Matcher)
- func (c *Context) Get(p string) (*Entry, bool)
- func (c *Context) Glob(pattern string) ([]string, error)
- func (c *Context) IgnoreMatcher() (*ignore.Matcher, error)
- func (c *Context) Len() int
- func (c *Context) Paths() []string
- func (c *Context) ReadTar(r io.Reader, prefix string) error
- func (c *Context) Resolve(p string, follow bool) (string, error)
- func (c *Context) Under(p string) []string
- type Entry
- type Limits
- type PackStats
Constants ¶
This section is empty.
Variables ¶
var DefaultLimits = Limits{MaxBytes: 256 << 20, MaxFiles: 65536, MaxPathLen: 4096, MaxDepth: 128}
DefaultLimits suit a training lab and match the engine's default container quota.
var ErrEscape = errors.New("path leaves the build context")
ErrEscape reports a path or link that leaves the context.
var ErrLimit = errors.New("build context exceeds its limits")
ErrLimit reports a context beyond its limits.
var IgnoreFiles = []string{".containerignore", ".dockerignore"}
IgnoreFiles are looked for at the context root, in this order (containerignore(5)): the first one found is used.
Functions ¶
func CleanName ¶
CleanName turns a tar entry name into a context path, or fails when it would leave the context.
Types ¶
type Context ¶
type Context struct {
// contains filtered or unexported fields
}
Context is an in-memory file tree. Paths are slash-separated, relative, cleaned ("." is the root).
func FromTar ¶
FromTar reads a tar stream into a context, each name placed under prefix ("" or "." for the root). Hard links become copies of their target; devices, FIFOs and other types are skipped.
func (*Context) Add ¶
Add stores an entry (creating missing parent directories) and charges it to the limits.
func (*Context) Exclude ¶
Exclude removes every entry the matcher excludes. Directories that are excluded but hold a re-included entry are kept (as their parents).
func (*Context) Glob ¶
Glob returns the paths matching a filepath.Match pattern (each component matched at its own depth), sorted.
func (*Context) IgnoreMatcher ¶
IgnoreMatcher reads the context's own ignore file, if it holds one.
type Entry ¶
type Entry struct {
Mode fs.FileMode // type bits and permissions
Data []byte
Link string // symlink target
ModTime time.Time
UID, GID int
// Sum is the sha256 of Data (regular files).
Sum [32]byte
}
Entry is one file, directory or symbolic link.
type Limits ¶
type Limits struct {
MaxBytes int64 // file content, all files together
MaxFiles int // entries
MaxPathLen int
MaxDepth int
}
Limits bound a context.
type PackStats ¶
PackStats says what was sent.
func Pack ¶
Pack writes the directory dir as a context tar to w, leaving out what its ignore file excludes. The directory is opened as an os.Root, so no file outside it is ever read, whatever links it holds: symbolic links are sent as links, never followed. Owners are not sent (every entry is 0:0) and neither are devices, FIFOs or sockets.
Source Files