Documentation
¶
Overview ¶
Package image stages approved OCI image filesystems without running code.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ParseManifest ¶
ParseManifest accepts bounded single-platform OCI metadata and validates every descriptor against the aggregate compressed budget, including metadata bytes. Callers must verify the manifest digest and current source authority separately.
func ValidDigest ¶
ValidDigest accepts a lowercase, explicitly prefixed SHA256 content pin.
Types ¶
type Config ¶
type Config struct {
Root, Architecture string
OwnerUID uint32
Source Source
Authorize func(context.Context, string) error
CompressedBytes, ExpandedBytes int64
Entries int
Timeout time.Duration
}
Config is trusted host policy. Authorize must bind the authenticated context to current image access and an approved manifest digest. Root must be private; its owner must keep staged files unchanged until the workload is destroyed. Production workers use OwnerUID zero. Limits are aggregate across all layers; compressed bytes include the manifest and config. Timeout is at most ten minutes.
type Filesystem ¶
type Filesystem struct {
Digest, Directory, Rootfs string
}
Filesystem binds a private, newly staged rootfs to its approved manifest. It is not a durable cache entry, job claim or runtime qualification. The host owns Directory's lifecycle and must not follow guest symlinks from the host.
func Stage ¶
Stage supports a single-platform OCI manifest with tar or gzip layers. It verifies compressed digests, uncompressed DiffIDs and archive policy before applying each layer with containerd's confined OCI extractor. Image process defaults are never returned or applied. Failed attempts remove only their own temporary directory; retries create a fresh copy and reauthorize access.
type Limits ¶
type Limits struct {
CompressedBytes int64 `json:"compressed_bytes"`
ExpandedBytes int64 `json:"expanded_bytes"`
Entries int `json:"entries"`
Timeout time.Duration `json:"timeout_ns"`
}
Limits bounds aggregate image staging work across all layers. The outer workspace filesystem enforces an independent storage and inode ceiling.
type LocalLimits ¶
LocalLimits bounds verified image snapshots and aggregate reader capacity.
func (LocalLimits) Validate ¶
func (l LocalLimits) Validate() error
Validate checks per-blob, reader and aggregate snapshot bounds.
type LocalSource ¶
type LocalSource struct {
// contains filtered or unexported fields
}
LocalSource reads installed blobs from root/blobs/sha256/<digest>. It uses only digest references, not OCI index tags or registry URLs. The protected host owns provisioning; source access grants remain the caller's responsibility. Each successful Open holds a capacity slot until its reader is closed.
func NewLocalSource ¶
func NewLocalSource(root string, maximum int64, readers int) (*LocalSource, error)
NewLocalSource requires root-owned mode-0700 content directories and mode-0400 single-link blobs. maximum bounds each snapshot to 64 MiB; readers is 1..32, with at most 256 MiB of aggregate snapshot capacity. Keep this installation on a responsive local filesystem: Open checks cancellation between file calls but cannot interrupt a stalled kernel call. Returned reads use only memory. The trusted owner must prevent path and file mutations during Open.
func (*LocalSource) Open ¶
func (s *LocalSource) Open(ctx context.Context, digest string) (io.ReadCloser, error)
Open verifies the digest and protected file metadata before returning a bounded snapshot. Errors return no reader or content, and release capacity.
Source Files