oci_image/lib.rs
1//! OCI container images on disk.
2//!
3//! - [`ImageRef`] and [`Digest`]: references with Docker's defaults, strict
4//! `sha256:` digests that are safe as file names.
5//! - [`apply_layer_file`] / [`apply_layer`]: one-pass layer unpack with OCI
6//! whiteout and opaque-directory rules, a decoder thread ahead of the tar
7//! reader and a pool of file writers. Every write is relative to a
8//! directory descriptor resolved beneath the rootfs (`openat2`
9//! `RESOLVE_BENEATH`, or an `O_NOFOLLOW` walk): nothing lands outside it,
10//! whatever the layer holds or another process changes meanwhile. Gzip layers decode on all the
11//! caller's threads with [`lgz`]'s one-pass streaming decoder (any gzip,
12//! no flush points needed; small layers on one core with zlib-rs, by lgz's
13//! own threshold); zstd layers with libzstd (feature `zstd`, on by default).
14//! - [`changes`] and [`decoder`]: the same whiteout rules as events over an
15//! in-memory blob, for scanners that keep their own view of the files.
16//! - [`LayerStore`]: verified blobs by digest and one flattened rootfs per
17//! layer chain.
18//! - [`Overlay`]: upper/work/merged directories and overlayfs mount data for
19//! a container on top of a rootfs.
20//!
21//! Registry pulls and pushes live in `oci-image-store` (its `pull`, behind a
22//! `Registry` trait), which writes into a [`LayerStore`] as well.
23
24mod beneath;
25mod decode;
26mod digest;
27mod error;
28mod layer;
29mod reference;
30mod snapshot;
31mod store;
32
33pub use decode::{decoder, Compression, Decoder, ZSTD_OFF};
34pub use digest::{Digest, Hasher};
35pub use error::{Error, Result};
36pub use layer::{
37 apply_layer, apply_layer_file, apply_layer_file_digest, changes, entry_path, Change, Devices,
38 Layout, OverlayXattr, UnpackOptions, UnpackStats, IN_FLIGHT, OPEN_FILES, SMALL_FILE,
39};
40pub use reference::ImageRef;
41pub use snapshot::Overlay;
42pub use store::{chain_id, BlobWriter, GcStats, ImageLayer, LayerStore};