meta-virtualization/classes/image-oci-umoci.inc
Bruce Ashfield 57fe8d0364 image-oci-unmoci: preserve file modes
Based on the following patch:

   Subject: [meta-virtualization][PATCH] image-oci-umoci: preserve file modes in rootfs
   From: "Florian Wickert via lists.yoctoproject.org" <FlorianWickert=gmail.com@lists.yoctoproject.org>

   cp does not preserve file modes by default.
   This will break sudo (among others) which needs the suid flag to do its
   work.

   This patch adds the --preserve=mode flag to the cp call to fix this.

   Signed-off-by: Florian Wickert <FlorianWickert@gmail.com>

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2025-01-17 19:17:10 +00:00

136 lines
5.7 KiB
PHP

IMAGE_CMD:oci() {
umoci_options=""
bbdebug 1 "UMOCI image settings:"
bbdebug 1 " author: ${OCI_IMAGE_AUTHOR}"
bbdebug 1 " author email: ${OCI_IMAGE_AUTHOR_EMAIL}"
bbdebug 1 " tag: ${OCI_IMAGE_TAG}"
bbdebug 1 " arch: ${OCI_IMAGE_ARCH}"
bbdebug 1 " subarch: ${OCI_IMAGE_SUBARCH}"
bbdebug 1 " entrypoint: ${OCI_IMAGE_ENTRYPOINT}"
bbdebug 1 " entrypoint args: ${OCI_IMAGE_ENTRYPOINT_ARGS}"
bbdebug 1 " labels: ${OCI_IMAGE_LABELS}"
bbdebug 1 " uid: ${OCI_IMAGE_RUNTIME_UID}"
bbdebug 1 " working dir: ${OCI_IMAGE_WORKINGDIR}"
bbdebug 1 " env vars: ${OCI_IMAGE_ENV_VARS}"
bbdebug 1 " ports: ${OCI_IMAGE_PORTS}"
OCI_REUSE_IMAGE=""
# Change into the image deploy dir to avoid having any output operations capture
# long directories or the location.
cd ${IMGDEPLOYDIR}
new_image=t
image_name="${IMAGE_NAME}${IMAGE_NAME_SUFFIX}-oci"
image_bundle_name="${IMAGE_NAME}${IMAGE_NAME_SUFFIX}-oci-bundle"
if [ -n "$OCI_REUSE_IMAGE" ]; then
if [ -d $image_name ]; then
bbdebug 1 "OCI: reusing image directory"
new_image=""
fi
else
bbdebug 1 "OCI: removing existing container image directory"
rm -rf $image_name $image_bundle_name
fi
if [ -z "${OCI_IMAGE_TAG}" ]; then
OCI_IMAGE_TAG="initial-tag"
fi
if [ -n "$new_image" ]; then
bbdebug 1 "OCI: umoci init --layout $image_name"
umoci init --layout $image_name
umoci new --image $image_name:${OCI_IMAGE_TAG}
umoci unpack --rootless --image $image_name:${OCI_IMAGE_TAG} $image_bundle_name
else
# todo: create a different tag, after checking if the passed one exists
true
fi
bbdebug 1 "OCI: populating rootfs"
bbdebug 1 "OCI: cp -r ${IMAGE_ROOTFS}/* $image_bundle_name/rootfs/"
cp -r -a --no-preserve=ownership ${IMAGE_ROOTFS}/* $image_bundle_name/rootfs
bbdebug 1 "OCI: umoci repack --image $image_name:${OCI_IMAGE_TAG} $image_bundle_name"
umoci repack --image $image_name:${OCI_IMAGE_TAG} $image_bundle_name
bbdebug 1 "OCI: configuring image"
if [ -n "${OCI_IMAGE_LABELS}" ]; then
for l in ${OCI_IMAGE_LABELS}; do
bbdebug 1 "OCI: umoci config --image $image_name:${OCI_IMAGE_TAG} --config.label \"$l\""
umoci config --image $image_name:${OCI_IMAGE_TAG} --config.label "$l"
done
fi
if [ -n "${OCI_IMAGE_ENV_VARS}" ]; then
for l in ${OCI_IMAGE_ENV_VARS}; do
bbdebug 1 "umoci config --image $image_name:${OCI_IMAGE_TAG} --config.env \"$l\""
umoci config --image $image_name:${OCI_IMAGE_TAG} --config.env "$l"
done
fi
if [ -n "${OCI_IMAGE_PORTS}" ]; then
for l in ${OCI_IMAGE_PORTS}; do
bbdebug 1 "umoci config --image $image_name:${OCI_IMAGE_TAG} --config.exposedports $l"
umoci config --image $image_name:${OCI_IMAGE_TAG} --config.exposedports $l
done
fi
if [ -n "${OCI_IMAGE_RUNTIME_UID}" ]; then
bbdebug 1 "umoci config --image $image_name:${OCI_IMAGE_TAG} --config.user ${OCI_IMAGE_RUNTIME_UID}"
umoci config --image $image_name:${OCI_IMAGE_TAG} --config.user ${OCI_IMAGE_RUNTIME_UID}
fi
if [ -n "${OCI_IMAGE_WORKINGDIR}" ]; then
bbdebug 1 "umoci config --image $image_name:${OCI_IMAGE_TAG} --config.workingdir ${OCI_IMAGE_WORKINGDIR}"
umoci config --image $image_name:${OCI_IMAGE_TAG} --config.workingdir ${OCI_IMAGE_WORKINGDIR}
fi
if [ -n "${OCI_IMAGE_STOPSIGNAL}" ]; then
bbdebug 1 "umoci config --image $image_name:${OCI_IMAGE_TAG} --config.stopsignal ${OCI_IMAGE_STOPSIGNAL}"
umoci config --image $image_name:${OCI_IMAGE_TAG} --config.stopsignal ${OCI_IMAGE_STOPSIGNAL}
fi
if [ -n "${OCI_IMAGE_OS}" ]; then
bbdebug 1 "umoci config --image $image_name:${OCI_IMAGE_TAG} --os ${OCI_IMAGE_OS}"
umoci config --image $image_name:${OCI_IMAGE_TAG} --os ${OCI_IMAGE_OS}
fi
bbdebug 1 "umoci config --image $image_name:${OCI_IMAGE_TAG} --architecture ${OCI_IMAGE_ARCH}"
umoci config --image $image_name:${OCI_IMAGE_TAG} --architecture ${OCI_IMAGE_ARCH}
# NOTE: umoci doesn't currently expose setting the architecture variant,
# so if you need it use sloci instead
if [ -n "${OCI_IMAGE_SUBARCH}" ]; then
bbnote "OCI: image subarch is set to: ${OCI_IMAGE_SUBARCH}, but umoci does not"
bbnote " expose variants. use sloci instead if this is important"
fi
umoci config --image $image_name:${OCI_IMAGE_TAG} \
${@" ".join("--config.entrypoint %s" % s for s in d.getVar("OCI_IMAGE_ENTRYPOINT").split())}
if [ -n "${OCI_IMAGE_ENTRYPOINT_ARGS}" ]; then
umoci config --image $image_name:${OCI_IMAGE_TAG} ${@" ".join("--config.cmd %s" % s for s in d.getVar("OCI_IMAGE_ENTRYPOINT_ARGS").split())}
fi
umoci config --image $image_name:${OCI_IMAGE_TAG} --author ${OCI_IMAGE_AUTHOR_EMAIL}
# OCI_IMAGE_TAG may contain ":", but these are not allowed in OCI file
# names so replace them
image_tag="${@d.getVar("OCI_IMAGE_TAG").replace(":", "_")}"
# make a tar version of the image direcotry
# 1) image_name.tar: compatible with oci tar format, blobs and rootfs
# are at the top level. Can load directly from something like podman
# 2) image_name-dir.tar: original format from meta-virt, is just a tar'd
# up oci image directory (compatible with skopeo :dir format)
if [ -n "${OCI_IMAGE_TAR_OUTPUT}" ]; then
(
cd "$image_name"
tar -cf ../"$image_name.tar" "."
)
tar -cf "$image_name-dir.tar" "$image_name"
# create a convenience symlink
ln -sf "$image_name.tar" "${IMAGE_BASENAME}-$image_tag-oci.tar"
ln -sf "$image_name-dir.tar" "${IMAGE_BASENAME}-$image_tag-oci-dir.tar"
fi
# We could make this optional, since the bundle is directly runnable via runc
rm -rf $image_bundle_name
# This is the OCI image directory, which is technically the "image" as specified
ln -sf $image_name ${IMAGE_BASENAME}-$image_tag-oci
}