feat: Include list of image layer directories in ContainerInfo

crates/bpf-common/Cargo.toml

@@ -28,6 +28,8 @@ procfs = { workspace = true }
 libc = { workspace = true }
 glob = { workspace = true }
 hex = { workspace = true }
+hyper = { workspace = true }
+hyperlocal = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 lazy_static = { workspace = true }

crates/bpf-common/src/containers/layers.rs

@@ -0,0 +1,311 @@
+use std::{
+ fmt,
+ fs::{self, File},
+ io::BufReader,
+ path::{Path, PathBuf},
+ str::FromStr,
+};
+
+use hyper::{body, Client};
+use hyperlocal::{UnixClientExt, Uri as HyperlocalUri};
+use nix::unistd::Uid;
+use serde::Deserialize;
+
+use super::ContainerError;
+
+const DOCKER_SOCKET: &str = "/var/run/docker.sock";
+
+/// Docker API response for `image inspect` request.
+#[derive(Debug, Deserialize)]
+struct ImageInspect {
+ #[serde(rename = "GraphDriver")]
+ graph_driver: GraphDriver,
+}
+
+#[derive(Debug, Deserialize)]
+struct GraphDriver {
+ #[serde(rename = "Data")]
+ data: Option<GraphDriverData>,
+ #[serde(rename = "Name")]
+ name: GraphDriverName,
+}
+
+#[derive(Debug, Deserialize)]
+struct GraphDriverData {
+ #[serde(rename = "LowerDir")]
+ lower_dir: Option<String>,
+ #[serde(rename = "MergedDir")]
+ merged_dir: Option<PathBuf>,
+ #[serde(rename = "UpperDir")]
+ upper_dir: Option<PathBuf>,
+ #[serde(rename = "WorkDir")]
+ work_dir: Option<PathBuf>,
+}
+
+#[derive(Debug, Deserialize)]
+enum GraphDriverName {
+ #[serde(rename = "btrfs")]
+ Btrfs,
+ #[serde(rename = "fuse-overlayfs")]
+ FuseOverlayfs,
+ #[serde(rename = "overlay2")]
+ Overlayfs,
+ #[serde(rename = "vfs")]
+ Vfs,
+ #[serde(rename = "zfs")]
+ Zfs,
+}
+
+#[derive(Debug, Deserialize)]
+struct LibpodLayer {
+ id: String,
+ parent: Option<String>,
+}
+
+impl fmt::Display for GraphDriverName {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ match self {
+ Self::Btrfs => write!(f, "btrfs"),
+ Self::FuseOverlayfs => write!(f, "fuse-overlayfs"),
+ Self::Overlayfs => write!(f, "overlay2"),
+ Self::Vfs => write!(f, "vfs"),
+ Self::Zfs => write!(f, "zfs"),
+ }
+ }
+}
+
+#[derive(Debug, Deserialize)]
+struct ImageDbEntry {
+ rootfs: Rootfs,
+}
+
+#[derive(Debug, Deserialize)]
+struct Rootfs {
+ diff_ids: Vec<String>,
+}
+
+/// Returns a list of layer paths for the given Docker image ID.
+pub(crate) async fn docker_layers(image_id: &str) -> Result<Vec<PathBuf>, ContainerError> {
+ let client = Client::unix();
+ let uri = HyperlocalUri::new(DOCKER_SOCKET, &format!("/images/{}/json", image_id));
+ let uri: hyper::Uri = uri.into();
+
+ let response =
+ client
+ .get(uri.clone())
+ .await
+ .map_err(|source| ContainerError::HyperRequest {
+ source,
+ uri: uri.clone(),
+ })?;
+ let body_bytes =
+ body::to_bytes(response)
+ .await
+ .map_err(|source| ContainerError::HyperResponse {
+ source,
+ uri: uri.clone(),
+ })?;
+
+ let response: ImageInspect = serde_json::from_slice(&body_bytes)
+ .map_err(|source| ContainerError::ParseResponse { source, uri })?;
+
+ match response.graph_driver.name {
+ GraphDriverName::Btrfs => docker_btrfs_layers(image_id),
+ GraphDriverName::Overlayfs => docker_overlayfs_layers(response.graph_driver.data),
+ _ => {
+ log::warn!(
+ "Docker graph driver {} is unsupported",
+ response.graph_driver.name
+ );
+ Ok(Vec::new())
+ }
+ }
+}
+
+/// Returns a list of BTRFS layer paths for the given Docker image ID.
+///
+/// The procedure for BTRFS is not straigthforward, since the `image inspect`
+/// response doesn't have direct information about layer directories. It
+/// consists of the following steps:
+///
+/// 1. Using the given image ID, find an "imagedb entry". It's located in
+/// `/var/lib/docker/image/btrfs/imagedb/content/sha256/<image_id>`.
+/// 2. Get the list of layer checksums from that entry.
+/// 3. For each layer, check whether a "layerdb entry" exists. It's located
+/// in `/var/lib/docker/image/btrfs/layerdb/sha256/<layer_id>`. The
+/// layerdb directory contains a `cache-id` file.
+/// 4. That `cache-id` file contains an ID of a BTRFS subvolume. The
+/// subvolume can be found in `/var/lib/docker/btrfs/subvolumes/<cache_id>`.
+fn docker_btrfs_layers(image_id: &str) -> Result<Vec<PathBuf>, ContainerError> {
+ const DOCKER_IMAGEDB_PATH: &str = "/var/lib/docker/image/btrfs/imagedb/content/sha256/";
+ const DOCKER_LAYERDB_PATH: &str = "/var/lib/docker/image/btrfs/layerdb/sha256/";
+ const DOCKER_BTRFS_SUBVOL_PATH: &str = "/var/lib/docker/btrfs/subvolumes/";
+
+ let mut layers = Vec::new();
+
+ let path = PathBuf::from(DOCKER_IMAGEDB_PATH).join(image_id);
+ let file = File::open(&path).map_err(|source| ContainerError::ReadFile {
+ source,
+ path: path.clone(),
+ })?;
+
+ let reader = BufReader::new(file);
+ let imagedb_entry: ImageDbEntry = serde_json::from_reader(reader)
+ .map_err(|source| ContainerError::ParseConfigFile { source, path })?;
+
+ for layer_id in imagedb_entry.rootfs.diff_ids {
+ let layer_id = layer_id
+ .split(':')
+ .last()
+ .ok_or(ContainerError::InvalidLayerID(layer_id.clone()))?;
+
+ let path = PathBuf::from(DOCKER_LAYERDB_PATH).join(layer_id);
+ if path.exists() {
+ let path = path.join("cache-id");
+ let btrfs_subvol_id = fs::read_to_string(&path)
+ .map_err(|source| ContainerError::ReadFile { source, path })?;
+ let btrfs_subvol_path = PathBuf::from(DOCKER_BTRFS_SUBVOL_PATH).join(btrfs_subvol_id);
+
+ layers.push(btrfs_subvol_path);
+ }
+ }
+
+ Ok(layers)
+}
+
+fn docker_overlayfs_layers(
+ graph_driver_data: Option<GraphDriverData>,
+) -> Result<Vec<PathBuf>, ContainerError> {
+ let mut layers = Vec::new();
+
+ if let Some(graph_driver_data) = graph_driver_data {
+ if let Some(lower_dirs) = graph_driver_data.lower_dir {
+ for lower_dir in lower_dirs.split(':') {
+ // `PathBuf::from_str` is infallible.
+ layers.push(PathBuf::from_str(lower_dir).unwrap());
+ }
+ }
+ if let Some(merged_dir) = graph_driver_data.merged_dir {
+ layers.push(merged_dir);
+ }
+ if let Some(upper_dir) = graph_driver_data.upper_dir {
+ layers.push(upper_dir);
+ }
+ if let Some(work_dir) = graph_driver_data.work_dir {
+ layers.push(work_dir);
+ }
+ }
+
+ Ok(layers)
+}
+
+/// For the given `top_layer`, return a vector which contains that layer and
+/// all parents of it. In other words, return a vector of all layers associated
+/// with an image.
+pub(crate) fn podman_layers<P: AsRef<Path>>(
+ top_layer_id: &str,
+ uid: Uid,
+ user_home: P,
+) -> Result<Vec<PathBuf>, ContainerError> {
+ let layer_store_path =
+ find_layer_store(uid, &user_home).ok_or(ContainerError::LayerStoreNotFound)?;
+ let layer_store_file =
+ File::open(&layer_store_path).map_err(|source| ContainerError::ReadFile {
+ source,
+ path: layer_store_path.clone(),
+ })?;
+ let reader = BufReader::new(layer_store_file);
+
+ let overlay_dir =
+ find_overlay_dir(uid, &user_home).ok_or(ContainerError::OverlayDirNotFound)?;
+
+ let mut layers = find_subdirs(overlay_dir.join(top_layer_id));
+ let config_layers: Vec<LibpodLayer> =
+ serde_json::from_reader(reader).map_err(|source| ContainerError::ParseConfigFile {
+ source,
+ path: layer_store_path.clone(),
+ })?;
+ let mut layer_id = top_layer_id;
+ let mut limit = config_layers.len();
+ loop {
+ let pos = config_layers[..limit]
+ .iter()
+ .rev()
+ .position(|layer| layer.id == layer_id)
+ .ok_or(ContainerError::LayerNotFound(layer_id.to_string()))?;
+ let layer = &config_layers[pos];
+ layers.extend(find_subdirs(overlay_dir.join(&layer.id)));
+ match layer.parent {
+ Some(ref parent) => {
+ layer_id = parent;
+ limit = pos;
+ }
+ None => break,
+ }
+ }
+
+ Ok(layers)
+}
+
+fn find_layer_store<P: AsRef<Path>>(uid: Uid, user_home: P) -> Option<PathBuf> {
+ const LIBPOD_LAYER_STORE_PATH: &str = "/var/lib/containers/storage/overlay-layers/layers.json";
+
+ let layer_store_path = if uid.is_root() {
+ PathBuf::from(LIBPOD_LAYER_STORE_PATH)
+ } else {
+ user_home
+ .as_ref()
+ .join(".local")
+ .join("share")
+ .join("containers")
+ .join("storage")
+ .join("overlay-layers")
+ .join("layers.json")
+ };
+
+ if !layer_store_path.exists() {
+ return None;
+ }
+
+ Some(layer_store_path)
+}
+
+fn find_overlay_dir<P: AsRef<Path>>(uid: Uid, user_home: P) -> Option<PathBuf> {
+ const OVERLAY_PATH: &str = "/var/lib/containers/storage/overlay";
+
+ let overlay_dir = if uid.is_root() {
+ PathBuf::from(OVERLAY_PATH)
+ } else {
+ user_home
+ .as_ref()
+ .join(".local")
+ .join("share")
+ .join("containers")
+ .join("storage")
+ .join("overlay")
+ };
+
+ if !overlay_dir.exists() {
+ return None;
+ }
+
+ Some(overlay_dir)
+}
+
+/// Returns all subdirectories of the given `parent_path`.
+fn find_subdirs<P: AsRef<Path>>(parent_path: P) -> Vec<PathBuf> {
+ let mut subdirectories = Vec::new();
+
+ if parent_path.as_ref().is_dir() {
+ if let Ok(entries) = fs::read_dir(parent_path) {
+ for entry in entries.flatten() {
+ let path = entry.path();
+ if path.is_dir() {
+ subdirectories.push(path);
+ }
+ }
+ }
+ }
+
+ subdirectories
+}