Implement mount from image

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
moby · LaurentGoderre · Oct 28, 2024 · Nov 25, 2024 · 06155dade8a5b300ab8574adcf13d9a643fd7aea
commit 06155dade8a5b300ab8574adcf13d9a643fd7aea
diff --git a/api/types/mount/mount.go b/api/types/mount/mount.go
@@ -19,6 +19,8 @@ const (
 	TypeNamedPipe Type = "npipe"
 	// TypeCluster is the type for Swarm Cluster Volumes.
 	TypeCluster Type = "cluster"
+	// TypeImage is the type for mounting another image's filesystem
+	TypeImage Type = "image"
 )
 
 // Mount represents a mount (volume).

diff --git a/daemon/containerd/service.go b/daemon/containerd/service.go
@@ -20,6 +20,7 @@ import (
 	dimages "github.com/docker/docker/daemon/images"
 	"github.com/docker/docker/daemon/snapshotter"
 	"github.com/docker/docker/errdefs"
+	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/registry"
@@ -115,6 +116,10 @@ func (i *ImageService) CreateLayer(container *container.Container, initFunc laye
 	return nil, errdefs.NotImplemented(errdefs.NotImplemented(errors.New("not implemented")))
 }
 
+func (i *ImageService) CreateLayerFromImage(img *image.Image, layerName string, rwLayerOpts *layer.CreateRWLayerOpts) (layer.RWLayer, error) {
+	return nil, errdefs.NotImplemented(errdefs.NotImplemented(errors.New("not implemented")))
+}
+
 // LayerStoreStatus returns the status for each layer store
 // called from info.go
 func (i *ImageService) LayerStoreStatus() [][2]string {

diff --git a/daemon/image_service.go b/daemon/image_service.go
@@ -54,6 +54,7 @@ type ImageService interface {
 
 	GetImageAndReleasableLayer(ctx context.Context, refOrID string, opts backend.GetImageAndLayerOptions) (builder.Image, builder.ROLayer, error)
 	CreateLayer(container *container.Container, initFunc layer.MountInit) (layer.RWLayer, error)
+	CreateLayerFromImage(img *image.Image, layerName string, rwLayerOpts *layer.CreateRWLayerOpts) (layer.RWLayer, error)
 	LayerStoreStatus() [][2]string
 	GetLayerMountID(cid string) (string, error)
 	ReleaseLayer(rwlayer layer.RWLayer) error

diff --git a/daemon/images/image_delete.go b/daemon/images/image_delete.go
@@ -74,7 +74,19 @@ func (i *ImageService) ImageDelete(ctx context.Context, imageRef string, force,
 	repoRefs := i.referenceStore.References(imgID.Digest())
 
 	using := func(c *container.Container) bool {
-		return c.ImageID == imgID
+		if c.ImageID == imgID {
+			return true
+		}
+
+		for _, mp := range c.MountPoints {
+			if mp.Type == "image" {
+				if mp.Spec.Source == string(imgID) {
+					return true
+				}
+			}
+		}
+
+		return false
 	}
 
 	var removedRepositoryRef bool

diff --git a/daemon/images/service.go b/daemon/images/service.go
@@ -118,13 +118,13 @@ func (i *ImageService) Children(_ context.Context, id image.ID) ([]image.ID, err
 // called from create.go
 // TODO: accept an opt struct instead of container?
 func (i *ImageService) CreateLayer(container *container.Container, initFunc layer.MountInit) (layer.RWLayer, error) {
-	var layerID layer.ChainID
+	var img *image.Image
 	if container.ImageID != "" {
-		img, err := i.imageStore.Get(container.ImageID)
+		containerImg, err := i.imageStore.Get(container.ImageID)
 		if err != nil {
 			return nil, err
 		}
-		layerID = img.RootFS.ChainID()
+		img = containerImg
 	}
 
 	rwLayerOpts := &layer.CreateRWLayerOpts{
@@ -133,7 +133,18 @@ func (i *ImageService) CreateLayer(container *container.Container, initFunc laye
 		StorageOpt: container.HostConfig.StorageOpt,
 	}
 
-	return i.layerStore.CreateRWLayer(container.ID, layerID, rwLayerOpts)
+	return i.CreateLayerFromImage(img, container.ID, rwLayerOpts)
+}
+
+// CreateLayerFromImage creates a file system from an arbitrary image
+// Used to mount an image inside another
+func (i *ImageService) CreateLayerFromImage(img *image.Image, layerName string, rwLayerOpts *layer.CreateRWLayerOpts) (layer.RWLayer, error) {
+	var layerID layer.ChainID
+	if img != nil {
+		layerID = img.RootFS.ChainID()
+	}
+
+	return i.layerStore.CreateRWLayer(layerName, layerID, rwLayerOpts)
 }
 
 // GetLayerByID returns a layer by ID

diff --git a/daemon/mounts.go b/daemon/mounts.go
@@ -38,28 +38,51 @@ func (daemon *Daemon) removeMountPoints(container *container.Container, rm bool)
 	var rmErrors []string
 	ctx := context.TODO()
 	for _, m := range container.MountPoints {
-		if m.Type != mounttypes.TypeVolume || m.Volume == nil {
-			continue
-		}
-		daemon.volumes.Release(ctx, m.Volume.Name(), container.ID)
-		if !rm {
-			continue
-		}
+		if m.Type == mounttypes.TypeVolume {
+			if m.Volume == nil {
+				continue
+			}
+			daemon.volumes.Release(ctx, m.Volume.Name(), container.ID)
+			if !rm {
+				continue
+			}
 
-		// Do not remove named mountpoints
-		// these are mountpoints specified like `docker run -v <name>:/foo`
-		if m.Spec.Source != "" {
-			continue
+			// Do not remove named mountpoints
+			// these are mountpoints specified like `docker run -v <name>:/foo`
+			if m.Spec.Source != "" {
+				continue
+			}
+
+			err := daemon.volumes.Remove(ctx, m.Volume.Name())
+			// Ignore volume in use errors because having this
+			// volume being referenced by other container is
+			// not an error, but an implementation detail.
+			// This prevents docker from logging "ERROR: Volume in use"
+			// where there is another container using the volume.
+			if err != nil && !volumesservice.IsInUse(err) {
+				rmErrors = append(rmErrors, err.Error())
+			}
 		}
 
-		err := daemon.volumes.Remove(ctx, m.Volume.Name())
-		// Ignore volume in use errors because having this
-		// volume being referenced by other container is
-		// not an error, but an implementation detail.
-		// This prevents docker from logging "ERROR: Volume in use"
-		// where there is another container using the volume.
-		if err != nil && !volumesservice.IsInUse(err) {
-			rmErrors = append(rmErrors, err.Error())
+		if m.Type == mounttypes.TypeImage {
+			layerName := fmt.Sprintf("%s-%s", container.ID, m.Spec.Source)
+			if accessor, ok := daemon.imageService.(layerAccessor); ok {
+				layer, err := accessor.GetLayerByID(layerName)
+				if err != nil {
+					rmErrors = append(rmErrors, err.Error())
+					continue
+				}
+				err = daemon.imageService.ReleaseLayer(layer)
+				if err != nil {
+					rmErrors = append(rmErrors, err.Error())
+					continue
+				}
+				err = layer.Unmount()
+				if err != nil {
+					rmErrors = append(rmErrors, err.Error())
+					continue
+				}
+			}
 		}
 	}
 

diff --git a/daemon/volumes.go b/daemon/volumes.go
@@ -2,19 +2,22 @@ package daemon // import "github.com/docker/docker/daemon"
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
 	"strings"
 	"time"
 
 	"github.com/containerd/log"
+	"github.com/docker/docker/api/types/backend"
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
 	mounttypes "github.com/docker/docker/api/types/mount"
 	volumetypes "github.com/docker/docker/api/types/volume"
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/errdefs"
+	"github.com/docker/docker/layer"
 	"github.com/docker/docker/volume"
 	volumemounts "github.com/docker/docker/volume/mounts"
 	"github.com/docker/docker/volume/service"
@@ -245,6 +248,34 @@ func (daemon *Daemon) registerMountPoints(container *container.Container, hostCo
 			}
 		}
 
+		if mp.Type == mounttypes.TypeImage {
+			if !daemon.Config().CommonConfig.Features["image-mount"] {
+				return fmt.Errorf("Feature 'image-mount' is not enabled")
+			}
+			img, err := daemon.imageService.GetImage(ctx, mp.Source, backend.GetImageOpts{})
+			if err != nil {
+				return err
+			}
+
+			rwLayerOpts := &layer.CreateRWLayerOpts{
+				StorageOpt: container.HostConfig.StorageOpt,
+			}
+
+			layerName := fmt.Sprintf("%s-%s", container.ID, mp.Source)
+			layer, err := daemon.imageService.CreateLayerFromImage(img, layerName, rwLayerOpts)
+			if err != nil {
+				return err
+			}
+			path, err := layer.Mount("")
+			if err != nil {
+				return err
+			}
+
+			mp.Name = mp.Spec.Source
+			mp.Spec.Source = img.ID().String()
+			mp.Source = path
+		}
+
 		binds[mp.Destination] = true
 		dereferenceIfExists(mp.Destination)
 		mountPoints[mp.Destination] = mp

@@ -5,6 +5,7 @@
 		}
 	},
 	"features": {
-		"containerd-snapshotter": false
+		"containerd-snapshotter": false,
+		"image-mount": true
 	}
 }
@@ -91,6 +91,8 @@ if [ -n "$DOCKER_ROOTLESS" ]; then
 	chown "$user" "/tmp/docker-${uid}"
 	chmod -R o+w "$DEST"
 	dockerd="sudo -u $user -E -E XDG_RUNTIME_DIR=/tmp/docker-${uid} -E HOME=/home/${user} -E PATH=$PATH -- dockerd-rootless.sh"
+
+	extra_params="$extra_params --feature=image-mount"
 fi
 
 if [ -z "$DOCKER_TEST_HOST" ]; then