Currently, fs-verity support detection fails on fresh containerd
installations because the content store root directory
(io.containerd.content.v1.content) doesn't exist yet. This directory
is only created when pulling images, causing checker to
always be false on new hosts.
The IsSupported() function attempts to create a temporary directory
within rootPath to test fs-verity support, but fails when rootPath
doesn't exist, returning an error that is silently ignored.
Fix this by ensuring the root directory exists before performing
the fs-verity support check in NewLabeledStore().
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
A contentstore can be created on top of readonly path and
should not fail unless there is an attempt to write into it.
Currently this fails because new ingest directory is created
always, meaning for example that you can't create a store to
read blobs from OCI layout without it contaminating the OCI
layout files.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Update the local content plugin to register itself in a consistent way
as other plugins. This also allows the separate package to define its
own configuration more cleanly.
Signed-off-by: Derek McGowan <derek@mcg.dev>
This functionality is not directly related to containerd and could move
to external package at some point.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Implement calls to the fsverity kernel module, allowing containerd to
enable fsverity on blob data in the content store. This causes fsverity
to veirfy the integrity of blob data when the blob is read.
Signed-off-by: James Jenkins <James.Jenkins@ibm.com>
