runtime

func CacheSubpath ¶

func CacheSubpath(target string) string

CacheSubpath derives the stable per-target cache key: the first 8 hex chars of the sha256 of the target path. Hashing keeps the key order-independent and collision-safe as profiles add or remove cache paths.

func DerivedRef ¶

func DerivedRef(repoTag string) string

DerivedRef normalizes a RepoTag from ImageList into the canonical tpd/packages:<hash> form, or "" if the tag doesn't belong to a derived image. Engines qualify RepoTags with their registry (docker.io/, localhost/, quay.io/, ...), so the match is on the reference path, not a string prefix — a locally built image keeps its tag even though its hash is what identifies it.

func DerivedTag ¶

func DerivedTag(baseID string, packages []string, repos map[string]Repo) string

DerivedTag returns the content-addressed tag tpd lays on a derived image built from baseID with the given packages and apt repos. The tag is the first 16 hex chars of a sha256 over baseID, the sorted package list, and (when non-empty) the sorted canonical repo descriptors:

no repos:   sha256(baseID \x00 sorted(packages).join(\x01))
with repos: sha256(baseID \x00 sorted(packages).join(\x01) \x00 sorted(canonical-repos).join(\x02))

The repos segment is appended only when non-empty, so a packages-only profile keeps the byte-identical pre-repos hash and its cached derived image survives the upgrade. Pure; does not touch the Docker daemon. Package and repo order is canonicalised before hashing so catalog authors can't trigger rebuilds by reordering.

Returns "" when both packages and repos are empty — the prepare path short-circuits and no derived image is built.

func EnsureVolume ¶

func EnsureVolume(ctx context.Context, cli *client.Client, name string) error

EnsureVolume creates name if it does not already exist, tagging it with the ownership label so prune only ever removes volumes tpd created.

func OwnershipLabels ¶

func OwnershipLabels() map[string]string

func QueryRootless ¶

func QueryRootless(ctx context.Context, cli *client.Client) (bool, error)

QueryRootless makes a raw GET to /info and parses the "rootless" field from the JSON response. Podman's Docker-compatible API includes this field; Docker's does not (it's absent, so json.Unmarshal leaves it as false). Exported so the doctor package can reuse it (Plan 3) without duplication.

func ResolveImageID ¶

func ResolveImageID(ctx context.Context, cli *client.Client, ref string) (string, error)

ResolveImageID returns the content-addressed image-config SHA of the locally-present image referenced by ref. Used as the hash input for DerivedTag and for invalidating derived images when the local base image changes. Callers handle a missing-local-image error by skipping the profile's contribution to the "used" derived-tag set (no local base ⇒ no possible derived image).

func SELinuxEnforcing ¶

func SELinuxEnforcing() bool

SELinuxEnforcing reports whether SELinux is enforcing on this host. Exported for tpd doctor, which mirrors the launch-time detection.