git.iko.soy/typeable/nixpkgs
on master help sign in
Merge pull request #151150 from agbrooks/oci-layer-order

dockerTools.buildImage: Fix incorrect layer unpack order before executing runAsRoot script

commit058677c41709b82e64b1c3990accc0d71dc58426 authorRobert Hensing <roberth@users.noreply.github.com> dateSat 18 Dec 2021, 11:03 (5 years ago) parentdda23ef5771890
3 files changed+30−1
compare with master
unifiedsplit
nixos/tests/docker-tools.nix+6 pkgs/build-support/docker/default.nix+1−1 pkgs/build-support/docker/examples.nix+23
nixos/tests/docker-tools.nix+6
@@ -215,6 +215,12 @@ import ./make-test-python.nix ({ pkgs, ... }: {
215215 f"docker run --rm ${examples.layersOrder.imageName} cat /tmp/layer{index}"
216216 )
217217
218+ with subtest("Ensure layers unpacked in correct order before runAsRoot runs"):
219+ assert "abc" in docker.succeed(
220+ "docker load --input='${examples.layersUnpackOrder}'",
221+ "docker run --rm ${examples.layersUnpackOrder.imageName} cat /layer-order"
222+ )
223+
218224 with subtest("Ensure environment variables are correctly inherited"):
219225 docker.succeed(
220226 "docker load --input='${examples.environmentVariables}'"
pkgs/build-support/docker/default.nix+1−1
@@ -240,7 +240,7 @@ rec {
240240 # Unpack all of the parent layers into the image.
241241 lowerdir=""
242242 extractionID=0
243− for layerTar in $(tac layer-list); do
243+ for layerTar in $(cat layer-list); do
244244 echo "Unpacking layer $layerTar"
245245 extractionID=$((extractionID + 1))
246246
pkgs/build-support/docker/examples.nix+23
@@ -405,6 +405,29 @@ rec {
405405 created = "now";
406406 };
407407
408+ # 23. Ensure that layers are unpacked in the correct order before the
409+ # runAsRoot script is executed.
410+ layersUnpackOrder =
411+ let
412+ layerOnTopOf = parent: layerName:
413+ pkgs.dockerTools.buildImage {
414+ name = "layers-unpack-order-${layerName}";
415+ tag = "latest";
416+ fromImage = parent;
417+ contents = [ pkgs.coreutils ];
418+ runAsRoot = ''
419+ #!${pkgs.runtimeShell}
420+ echo -n "${layerName}" >> /layer-order
421+ '';
422+ };
423+ # When executing the runAsRoot script when building layer C, if layer B is
424+ # not unpacked on top of layer A, the contents of /layer-order will not be
425+ # "ABC".
426+ layerA = layerOnTopOf null "a";
427+ layerB = layerOnTopOf layerA "b";
428+ layerC = layerOnTopOf layerB "c";
429+ in layerC;
430+
408431 # buildImage without explicit tag
409432 bashNoTag = pkgs.dockerTools.buildImage {
410433 name = "bash-no-tag";