Repository navigation
fix: filter redundant OCI whiteouts before rootfs copy - #3751
Draft
mattteufel-e2b wants to merge 3 commits into
Draft
mattteufel-e2b wants to merge 3 commits into
mattteufel-e2b wants to merge 3 commits into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OCI layers can introduce directories containing whiteouts for paths absent from lower layers. OverlayFS lists those names while lookup hides them, so rootfs rsync exits 24 and aborts the template build. Marking the immediate parents of character-device 0:0 whiteouts with an empty
trusted.overlay.originmakes OverlayFS filter them during enumeration.The helper walks temporary extracted layers used as read-only lower directories, does not follow symlinks, preserves existing origin/opaque metadata, and propagates xattr failures. Rsync errors remain fatal. No Dockerfile parser or production mount code changes.
Validation:
f551e44fails the pinned publicastanin__python-tabulate-76image with rsync 24 and 32 vanished paths. Candidate83ba76ecompletes two full builds, boots sandboxes, and passes command/deleted-file checks. The retainedTestTemplateBuildWhiteoutImagepasses in 52.23 seconds;8c62923adds that test and7bea3bfaligns its cleanup context with the suite pattern; production code is unchanged.7.0.0-1014-gcp. Cross-compilation, vet, shard checks, pinned golangci-lint 2.15.0 (zero issues), and independent review of the new integration test pass. CI is tracked separately; run 41885127655 encountered an ARM64 runner setup failure becauselinux-modules-extra-7.0.0-1017-azurewas unavailable, before tests ran.Live results, exact hashes, failures and cleanup · Component and kernel-path evidence · Kernel mechanism
The live runs preserve an initial hugepage-capacity failure and a builder-registration 503 separately from the whiteout comparison. Resources and evidence were recovered and cleaned up. This remains a draft for infra review; no staging or production rollout has occurred, and broader image coverage remains separate work.