oci_image/lib.rs
1//! OCI container images on disk.
2//!
3//! - [`ImageRef`] and [`Digest`]: references with Docker's defaults, strict
4//! `sha256:` digests that are safe as file names.
5//! - [`apply_layer_file`] / [`apply_layer`]: one-pass layer unpack with OCI
6//! whiteout and opaque-directory rules, a decoder thread ahead of the tar
7//! reader and a pool of file writers. Every write is relative to a
8//! directory descriptor resolved beneath the rootfs (`openat2`
9//! `RESOLVE_BENEATH`, or an `O_NOFOLLOW` walk): nothing lands outside it,
10//! whatever the layer holds or another process changes meanwhile. Gzip layers decode on all the
11//! caller's threads with [`lgz`]'s one-pass streaming decoder (any gzip,
12//! no flush points needed; small layers on one core with zlib-rs, by lgz's
13//! own threshold); zstd layers with libzstd.
14//! - [`changes`] and [`decoder`]: the same whiteout rules as events over an
15//! in-memory blob, for scanners that keep their own view of the files.
16//! - [`LayerStore`]: verified blobs by digest and one flattened rootfs per
17//! layer chain.
18//! - [`Overlay`]: upper/work/merged directories and overlayfs mount data for
19//! a container on top of a rootfs.
20//! - `pull` (feature `pull`): anonymous registry pull into the store.
21
22mod beneath;
23mod decode;
24mod digest;
25mod error;
26mod layer;
27#[cfg(feature = "pull")]
28pub mod pull;
29mod reference;
30mod snapshot;
31mod store;
32
33pub use decode::{decoder, Compression, Decoder};
34pub use digest::{Digest, Hasher};
35pub use error::{Error, Result};
36pub use layer::{
37 apply_layer, apply_layer_file, apply_layer_file_digest, changes, entry_path, Change, Devices,
38 Layout, OverlayXattr, UnpackOptions, UnpackStats, IN_FLIGHT, OPEN_FILES, SMALL_FILE,
39};
40pub use reference::ImageRef;
41pub use snapshot::Overlay;
42pub use store::{chain_id, BlobWriter, GcStats, ImageLayer, LayerStore};