mirror of
https://github.com/containerd/containerd.git
synced 2026-07-11 18:14:17 +00:00
f3b6078f90
Add fsverity support to erofs snapshotter to enable data integrity
verification for erofs layers:
- Add an config option `EnableFsverity` for erofs snapshotter
- Add fsverity verification during mount operations
- Enable fsverity on erofs layers during commit
- Add documentation for fsverity support in erofs snapshotter.
- Add TestErofsFsverity to verify fsverity enablement and data protection
The feature can be enabled via config.toml, such as:
```toml
[plugins.'io.containerd.snapshotter.v1.erofs']
root_path = ''
ovl_mount_options = []
enable_fsverity = true
```
Signed-off-by: ChengyuZhu6 <hudson@cyzhu.com>
73 lines
2.0 KiB
Go
73 lines
2.0 KiB
Go
/*
|
|
Copyright The containerd Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package plugin
|
|
|
|
import (
|
|
"errors"
|
|
|
|
"github.com/containerd/containerd/v2/plugins"
|
|
"github.com/containerd/containerd/v2/plugins/snapshots/erofs"
|
|
"github.com/containerd/platforms"
|
|
"github.com/containerd/plugin"
|
|
"github.com/containerd/plugin/registry"
|
|
)
|
|
|
|
// Config represents configuration for the native plugin.
|
|
type Config struct {
|
|
// Root directory for the plugin
|
|
RootPath string `toml:"root_path"`
|
|
|
|
// MountOptions are options used for the EROFS overlayfs mount
|
|
OvlOptions []string `toml:"ovl_mount_options"`
|
|
|
|
// EnableFsverity enables fsverity for EROFS layers
|
|
EnableFsverity bool `toml:"enable_fsverity"`
|
|
}
|
|
|
|
func init() {
|
|
registry.Register(&plugin.Registration{
|
|
Type: plugins.SnapshotPlugin,
|
|
ID: "erofs",
|
|
Config: &Config{},
|
|
InitFn: func(ic *plugin.InitContext) (interface{}, error) {
|
|
ic.Meta.Platforms = append(ic.Meta.Platforms, platforms.DefaultSpec())
|
|
|
|
config, ok := ic.Config.(*Config)
|
|
if !ok {
|
|
return nil, errors.New("invalid erofs configuration")
|
|
}
|
|
|
|
var opts []erofs.Opt
|
|
root := ic.Properties[plugins.PropertyRootDir]
|
|
if len(config.RootPath) != 0 {
|
|
root = config.RootPath
|
|
}
|
|
|
|
if len(config.OvlOptions) > 0 {
|
|
opts = append(opts, erofs.WithOvlOptions(config.OvlOptions))
|
|
}
|
|
|
|
if config.EnableFsverity {
|
|
opts = append(opts, erofs.WithFsverity())
|
|
}
|
|
|
|
ic.Meta.Exports[plugins.SnapshotterRootDir] = root
|
|
return erofs.NewSnapshotter(root, opts...)
|
|
},
|
|
})
|
|
}
|