image_commit.go 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342
  1. package containerd
  2. import (
  3. "bytes"
  4. "context"
  5. "crypto/rand"
  6. "encoding/base64"
  7. "encoding/json"
  8. "fmt"
  9. "runtime"
  10. "strings"
  11. "time"
  12. "github.com/containerd/containerd/content"
  13. "github.com/containerd/containerd/diff"
  14. cerrdefs "github.com/containerd/containerd/errdefs"
  15. "github.com/containerd/containerd/images"
  16. "github.com/containerd/containerd/leases"
  17. "github.com/containerd/containerd/log"
  18. "github.com/containerd/containerd/rootfs"
  19. "github.com/containerd/containerd/snapshots"
  20. "github.com/docker/docker/api/types/backend"
  21. "github.com/docker/docker/image"
  22. imagespec "github.com/docker/docker/image/spec/specs-go/v1"
  23. "github.com/docker/docker/pkg/archive"
  24. "github.com/opencontainers/go-digest"
  25. "github.com/opencontainers/image-spec/identity"
  26. "github.com/opencontainers/image-spec/specs-go"
  27. ocispec "github.com/opencontainers/image-spec/specs-go/v1"
  28. )
  29. /*
  30. This code is based on `commit` support in nerdctl, under Apache License
  31. https://github.com/containerd/nerdctl/blob/master/pkg/imgutil/commit/commit.go
  32. with adaptations to match the Moby data model and services.
  33. */
  34. // CommitImage creates a new image from a commit config.
  35. func (i *ImageService) CommitImage(ctx context.Context, cc backend.CommitConfig) (image.ID, error) {
  36. container := i.containers.Get(cc.ContainerID)
  37. cs := i.client.ContentStore()
  38. var parentManifest ocispec.Manifest
  39. var parentImage imagespec.DockerOCIImage
  40. // ImageManifest can be nil when committing an image with base FROM scratch
  41. if container.ImageManifest != nil {
  42. imageManifestBytes, err := content.ReadBlob(ctx, cs, *container.ImageManifest)
  43. if err != nil {
  44. return "", err
  45. }
  46. if err := json.Unmarshal(imageManifestBytes, &parentManifest); err != nil {
  47. return "", err
  48. }
  49. imageConfigBytes, err := content.ReadBlob(ctx, cs, parentManifest.Config)
  50. if err != nil {
  51. return "", err
  52. }
  53. if err := json.Unmarshal(imageConfigBytes, &parentImage); err != nil {
  54. return "", err
  55. }
  56. }
  57. var (
  58. differ = i.client.DiffService()
  59. sn = i.client.SnapshotService(container.Driver)
  60. )
  61. // Don't gc me and clean the dirty data after 1 hour!
  62. ctx, release, err := i.client.WithLease(ctx, leases.WithRandomID(), leases.WithExpiration(1*time.Hour))
  63. if err != nil {
  64. return "", fmt.Errorf("failed to create lease for commit: %w", err)
  65. }
  66. defer func() {
  67. if err := release(ctx); err != nil {
  68. log.G(ctx).WithError(err).Warn("failed to release lease created for commit")
  69. }
  70. }()
  71. diffLayerDesc, diffID, err := createDiff(ctx, cc.ContainerID, sn, cs, differ)
  72. if err != nil {
  73. return "", fmt.Errorf("failed to export layer: %w", err)
  74. }
  75. imageConfig := generateCommitImageConfig(parentImage, diffID, cc)
  76. layers := parentManifest.Layers
  77. if diffLayerDesc != nil {
  78. rootfsID := identity.ChainID(imageConfig.RootFS.DiffIDs).String()
  79. if err := applyDiffLayer(ctx, rootfsID, parentImage, sn, differ, *diffLayerDesc); err != nil {
  80. return "", fmt.Errorf("failed to apply diff: %w", err)
  81. }
  82. layers = append(layers, *diffLayerDesc)
  83. }
  84. commitManifestDesc, err := writeContentsForImage(ctx, container.Driver, cs, imageConfig, layers)
  85. if err != nil {
  86. return "", err
  87. }
  88. // image create
  89. img := images.Image{
  90. Name: danglingImageName(commitManifestDesc.Digest),
  91. Target: commitManifestDesc,
  92. CreatedAt: time.Now(),
  93. }
  94. if _, err := i.client.ImageService().Update(ctx, img); err != nil {
  95. if !cerrdefs.IsNotFound(err) {
  96. return "", err
  97. }
  98. if _, err := i.client.ImageService().Create(ctx, img); err != nil {
  99. return "", fmt.Errorf("failed to create new image: %w", err)
  100. }
  101. }
  102. return image.ID(img.Target.Digest), nil
  103. }
  104. // generateCommitImageConfig generates an OCI Image config based on the
  105. // container's image and the CommitConfig options.
  106. func generateCommitImageConfig(baseConfig imagespec.DockerOCIImage, diffID digest.Digest, opts backend.CommitConfig) imagespec.DockerOCIImage {
  107. if opts.Author == "" {
  108. opts.Author = baseConfig.Author
  109. }
  110. createdTime := time.Now()
  111. arch := baseConfig.Architecture
  112. if arch == "" {
  113. arch = runtime.GOARCH
  114. log.G(context.TODO()).Warnf("assuming arch=%q", arch)
  115. }
  116. os := baseConfig.OS
  117. if os == "" {
  118. os = runtime.GOOS
  119. log.G(context.TODO()).Warnf("assuming os=%q", os)
  120. }
  121. log.G(context.TODO()).Debugf("generateCommitImageConfig(): arch=%q, os=%q", arch, os)
  122. diffIds := baseConfig.RootFS.DiffIDs
  123. if diffID != "" {
  124. diffIds = append(diffIds, diffID)
  125. }
  126. return imagespec.DockerOCIImage{
  127. Image: ocispec.Image{
  128. Platform: ocispec.Platform{
  129. Architecture: arch,
  130. OS: os,
  131. },
  132. Created: &createdTime,
  133. Author: opts.Author,
  134. RootFS: ocispec.RootFS{
  135. Type: "layers",
  136. DiffIDs: diffIds,
  137. },
  138. History: append(baseConfig.History, ocispec.History{
  139. Created: &createdTime,
  140. CreatedBy: strings.Join(opts.ContainerConfig.Cmd, " "),
  141. Author: opts.Author,
  142. Comment: opts.Comment,
  143. EmptyLayer: diffID == "",
  144. }),
  145. },
  146. Config: containerConfigToDockerOCIImageConfig(opts.Config),
  147. }
  148. }
  149. // writeContentsForImage will commit oci image config and manifest into containerd's content store.
  150. func writeContentsForImage(ctx context.Context, snName string, cs content.Store, newConfig imagespec.DockerOCIImage, layers []ocispec.Descriptor) (ocispec.Descriptor, error) {
  151. newConfigJSON, err := json.Marshal(newConfig)
  152. if err != nil {
  153. return ocispec.Descriptor{}, err
  154. }
  155. configDesc := ocispec.Descriptor{
  156. MediaType: ocispec.MediaTypeImageConfig,
  157. Digest: digest.FromBytes(newConfigJSON),
  158. Size: int64(len(newConfigJSON)),
  159. }
  160. newMfst := struct {
  161. MediaType string `json:"mediaType,omitempty"`
  162. ocispec.Manifest
  163. }{
  164. MediaType: ocispec.MediaTypeImageManifest,
  165. Manifest: ocispec.Manifest{
  166. Versioned: specs.Versioned{
  167. SchemaVersion: 2,
  168. },
  169. Config: configDesc,
  170. Layers: layers,
  171. },
  172. }
  173. newMfstJSON, err := json.MarshalIndent(newMfst, "", " ")
  174. if err != nil {
  175. return ocispec.Descriptor{}, err
  176. }
  177. newMfstDesc := ocispec.Descriptor{
  178. MediaType: ocispec.MediaTypeImageManifest,
  179. Digest: digest.FromBytes(newMfstJSON),
  180. Size: int64(len(newMfstJSON)),
  181. }
  182. // new manifest should reference the layers and config content
  183. labels := map[string]string{
  184. "containerd.io/gc.ref.content.0": configDesc.Digest.String(),
  185. }
  186. for i, l := range layers {
  187. labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i+1)] = l.Digest.String()
  188. }
  189. err = content.WriteBlob(ctx, cs, newMfstDesc.Digest.String(), bytes.NewReader(newMfstJSON), newMfstDesc, content.WithLabels(labels))
  190. if err != nil {
  191. return ocispec.Descriptor{}, err
  192. }
  193. // config should reference to snapshotter
  194. labelOpt := content.WithLabels(map[string]string{
  195. fmt.Sprintf("containerd.io/gc.ref.snapshot.%s", snName): identity.ChainID(newConfig.RootFS.DiffIDs).String(),
  196. })
  197. err = content.WriteBlob(ctx, cs, configDesc.Digest.String(), bytes.NewReader(newConfigJSON), configDesc, labelOpt)
  198. if err != nil {
  199. return ocispec.Descriptor{}, err
  200. }
  201. return newMfstDesc, nil
  202. }
  203. // createDiff creates a layer diff into containerd's content store.
  204. // If the diff is empty it returns nil empty digest and no error.
  205. func createDiff(ctx context.Context, name string, sn snapshots.Snapshotter, cs content.Store, comparer diff.Comparer) (*ocispec.Descriptor, digest.Digest, error) {
  206. newDesc, err := rootfs.CreateDiff(ctx, name, sn, comparer)
  207. if err != nil {
  208. return nil, "", err
  209. }
  210. ra, err := cs.ReaderAt(ctx, newDesc)
  211. if err != nil {
  212. return nil, "", fmt.Errorf("failed to read diff archive: %w", err)
  213. }
  214. defer ra.Close()
  215. empty, err := archive.IsEmpty(content.NewReader(ra))
  216. if err != nil {
  217. return nil, "", fmt.Errorf("failed to check if archive is empty: %w", err)
  218. }
  219. if empty {
  220. return nil, "", nil
  221. }
  222. info, err := cs.Info(ctx, newDesc.Digest)
  223. if err != nil {
  224. return nil, "", fmt.Errorf("failed to get content info: %w", err)
  225. }
  226. diffIDStr, ok := info.Labels["containerd.io/uncompressed"]
  227. if !ok {
  228. return nil, "", fmt.Errorf("invalid differ response with no diffID")
  229. }
  230. diffID, err := digest.Parse(diffIDStr)
  231. if err != nil {
  232. return nil, "", err
  233. }
  234. return &ocispec.Descriptor{
  235. MediaType: ocispec.MediaTypeImageLayerGzip,
  236. Digest: newDesc.Digest,
  237. Size: info.Size,
  238. }, diffID, nil
  239. }
  240. // applyDiffLayer will apply diff layer content created by createDiff into the snapshotter.
  241. func applyDiffLayer(ctx context.Context, name string, baseImg imagespec.DockerOCIImage, sn snapshots.Snapshotter, differ diff.Applier, diffDesc ocispec.Descriptor) (retErr error) {
  242. var (
  243. key = uniquePart() + "-" + name
  244. parent = identity.ChainID(baseImg.RootFS.DiffIDs).String()
  245. )
  246. mount, err := sn.Prepare(ctx, key, parent)
  247. if err != nil {
  248. return fmt.Errorf("failed to prepare snapshot: %w", err)
  249. }
  250. defer func() {
  251. if retErr != nil {
  252. // NOTE: the snapshotter should be hold by lease. Even
  253. // if the cleanup fails, the containerd gc can delete it.
  254. if err := sn.Remove(ctx, key); err != nil {
  255. log.G(ctx).Warnf("failed to cleanup aborted apply %s: %s", key, err)
  256. }
  257. }
  258. }()
  259. if _, err = differ.Apply(ctx, diffDesc, mount); err != nil {
  260. return err
  261. }
  262. if err = sn.Commit(ctx, name, key); err != nil {
  263. if cerrdefs.IsAlreadyExists(err) {
  264. return nil
  265. }
  266. return err
  267. }
  268. return nil
  269. }
  270. // copied from github.com/containerd/containerd/rootfs/apply.go
  271. func uniquePart() string {
  272. t := time.Now()
  273. var b [3]byte
  274. // Ignore read failures, just decreases uniqueness
  275. rand.Read(b[:])
  276. return fmt.Sprintf("%d-%s", t.Nanosecond(), base64.URLEncoding.EncodeToString(b[:]))
  277. }
  278. // CommitBuildStep is used by the builder to create an image for each step in
  279. // the build.
  280. //
  281. // This method is different from CreateImageFromContainer:
  282. // - it doesn't attempt to validate container state
  283. // - it doesn't send a commit action to metrics
  284. // - it doesn't log a container commit event
  285. //
  286. // This is a temporary shim. Should be removed when builder stops using commit.
  287. func (i *ImageService) CommitBuildStep(ctx context.Context, c backend.CommitConfig) (image.ID, error) {
  288. ctr := i.containers.Get(c.ContainerID)
  289. if ctr == nil {
  290. // TODO: use typed error
  291. return "", fmt.Errorf("container not found: %s", c.ContainerID)
  292. }
  293. c.ContainerMountLabel = ctr.MountLabel
  294. c.ContainerOS = ctr.OS
  295. c.ParentImageID = string(ctr.ImageID)
  296. return i.CommitImage(ctx, c)
  297. }