test: containerd+erofs+stacker support

.github/workflows/build.yaml

@@ -99,7 +99,7 @@ jobs:
         env:
           REGISTRY_SERVICE: ${{ inputs.registry-service }}
           REGISTRY_URL: localhost:5000
-          ZOT_HOST: localhost
+          ZOT_HOST: 127.0.0.1
           ZOT_PORT: 8080
       - name: Show disk usage before running the tests
         if: always()
@@ -110,7 +110,7 @@ jobs:
         env:
           REGISTRY_SERVICE: ${{ inputs.registry-service }}
           REGISTRY_URL: localhost:5000
-          ZOT_HOST: localhost
+          ZOT_HOST: 127.0.0.1
           ZOT_PORT: 8080
       - name: Show disk usage after running the tests
         if: always()

.github/workflows/coverage.yaml

@@ -99,7 +99,7 @@ jobs:
         env:
           REGISTRY_SERVICE: ${{ inputs.registry-service }}
           REGISTRY_URL: localhost:5000
-          ZOT_HOST: localhost
+          ZOT_HOST: 127.0.0.1
           ZOT_PORT: 8080
       - name: Show disk usage after running the tests
         if: always()

Makefile

@@ -44,9 +44,12 @@ TOOLS_D := $(HACK_D)/tools
 REGCLIENT := $(TOOLS_D)/bin/regctl
 REGCLIENT_VERSION := v0.5.1
 SKOPEO = $(TOOLS_D)/bin/skopeo
+CONTAINERD = $(TOOLS_D)/bin/containerd
+CTR = $(TOOLS_D)/bin/ctr
 export SKOPEO_VERSION = 1.13.0
 BATS = $(TOOLS_D)/bin/bats
 BATS_VERSION := v1.10.0
+CONTAINERD_VERSION := v2.3.3
 # OCI registry
 ZOT := $(TOOLS_D)/bin/zot
 ZOT_VERSION := v2.1.8
@@ -136,7 +139,7 @@ go-test:
 	go tool cover -html coverage.txt  -o $(HACK_D)/coverage.html
 
 .PHONY: download-tools
-download-tools: $(GOLANGCI_LINT) $(REGCLIENT) $(ZOT) $(BATS) $(UMOCI) $(SKOPEO)
+download-tools: $(GOLANGCI_LINT) $(REGCLIENT) $(ZOT) $(BATS) $(UMOCI) $(SKOPEO) $(CONTAINERD)
 
 $(GOLANGCI_LINT):
 	@[ -x $(GOLANGCI_LINT) ] || \
@@ -170,6 +173,15 @@ $(SKOPEO):
 	cd $(TOP_LEVEL); \
 	rm -rf $$tmpdir;
 
+$(CONTAINERD):
+	@set -e; mkdir -p "$(TOOLS_D)/bin"; \
+	tmpdir=$$(mktemp -d); \
+	$(call dlbin,$$tmpdir/containerd.tar.gz,https://github.com/containerd/containerd/releases/download/$(CONTAINERD_VERSION)/containerd-$(CONTAINERD_VERSION:v%=%)-linux-$(GOARCH).tar.gz); \
+	tar -xzf $$tmpdir/containerd.tar.gz -C $$tmpdir; \
+	cp $$tmpdir/bin/containerd $(CONTAINERD); \
+	cp $$tmpdir/bin/ctr $(CTR); \
+	rm -rf $$tmpdir;
+
 $(BATS):
 	mkdir -p $(TOOLS_D)/bin
 	rm -rf bats-core

install-build-deps.sh

@@ -4,10 +4,12 @@ set -o errexit
 
 installdeps_fedora() {
   sudo dnf install \
+    kubernetes-cni \
     jq \
     lxc-devel \
     libcap-devel \
-    libacl-devel
+    libacl-devel \
+    runc
   # skopeo deps
   sudo dnf install \
     gpgme-devel \
@@ -24,6 +26,7 @@ installdeps_fedora() {
 COMMON_DEBS=(
 	apache2-utils
 	build-essential
+    containernetworking-plugins
 	cryptsetup-bin
 	curl
 	erofsfuse
@@ -48,6 +51,7 @@ COMMON_DEBS=(
 	parallel
 	pkg-config
 	psmisc
+    runc
 	shellcheck
 	squashfs-tools
 	squashfuse

pkg/overlay/pack.go

@@ -284,6 +284,11 @@ func generateBlob(layerType types.LayerType, contents string, ociDir string, sou
 		if err != nil {
 			return nil, "", "", err
 		}
+		// LZ4/Zstd selected by mkfs.erofs is filesystem-internal compression;
+		// containerd suffixes describe an additional wrapper around the blob.
+		if layerType.Type == "erofs" {
+			mediaType = types.ContainerdErofsLayerMediaType
+		}
 	}
 	return blob, mediaType, rootHash, nil
 }
@@ -684,6 +689,16 @@ func unpackOne(l ispec.Descriptor, ociDir string, extractDir string) error {
 		return nil
 	}
 
+	if l.MediaType == types.ContainerdErofsLayerMediaType {
+		fsi := stackerfs.New(fstypes.FilesystemType("erofs"))
+		if fsi == nil {
+			return errors.Errorf("failed to initialize erofs filesystem handler")
+		}
+
+		return fsi.ExtractSingle(
+			path.Join(ociDir, "blobs", "sha256", l.Digest.Encoded()), extractDir)
+	}
+
 	if fsi := stackerfs.NewFromMediaType(l.MediaType); fsi != nil {
 		return fsi.ExtractSingle(
 			path.Join(ociDir, "blobs", "sha256", l.Digest.Encoded()), extractDir)

pkg/types/layer_type.go

@@ -14,6 +14,9 @@ import (
 
 var ErrEmptyLayers = errors.New("empty layers")
 
+// ContainerdErofsLayerMediaType identifies an unwrapped native EROFS blob.
+const ContainerdErofsLayerMediaType = "application/vnd.erofs.layer.v1"
+
 type LayerType struct {
 	Type   string
 	Verity verity.VerityMetadata
@@ -85,6 +88,8 @@ func NewLayerTypeManifest(manifest ispec.Manifest) (LayerType, error) {
 	case erofs.GenerateErofsMediaType(erofs.LZ4Compression):
 		fallthrough
 	case erofs.GenerateErofsMediaType(erofs.ZstdCompression):
+		fallthrough
+	case ContainerdErofsLayerMediaType:
 		return NewLayerType("erofs", verity.VerityMetadata(verityMetadataPresent))
 	case ispec.MediaTypeImageLayerGzip:
 		fallthrough

pkg/types/types_test.go

@@ -4,6 +4,8 @@ import (
 	"os"
 	"reflect"
 	"testing"
+
+	ispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 func parse(t *testing.T, content string) *Stackerfile {
@@ -51,6 +53,20 @@ func TestDockerFrom(t *testing.T) {
 	}
 }
 
+func TestNewLayerTypeManifestContainerdErofs(t *testing.T) {
+	manifest := ispec.Manifest{
+		Layers: []ispec.Descriptor{{MediaType: ContainerdErofsLayerMediaType}},
+	}
+
+	layerType, err := NewLayerTypeManifest(manifest)
+	if err != nil {
+		t.Fatalf("failed to parse containerd EROFS layer type: %s", err)
+	}
+	if layerType.Type != "erofs" {
+		t.Fatalf("expected erofs layer type, got %s", layerType.Type)
+	}
+}
+
 func TestDependencyOrder(t *testing.T) {
 	content := `first:
     from:

stacker.yaml

@@ -0,0 +1,6 @@
+test:
+    from:
+        type: oci
+        url: ${{BUSYBOX_OCI}}
+    run: |
+        echo hello > /hello