From 7d02d8f93252d7173190180f79715301607257e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mika=C3=ABl=20Cluseau?= <mikael.cluseau@gmail.com>
Date: Mon, 21 Jul 2025 01:41:03 +0200
Subject: [PATCH] add dynlay

---
 Cargo.lock     | 470 ++++++++++++++++++++++++++++++++++++++++++++++---
 Cargo.toml     |   5 +
 src/bin/dkl.rs |  36 ++++
 src/dynlay.rs  | 165 +++++++++++++++++
 src/fs.rs      |  60 +++++++
 src/lib.rs     |   2 +
 test-dkl       |  17 +-
 7 files changed, 731 insertions(+), 24 deletions(-)
 create mode 100644 src/dynlay.rs
 create mode 100644 src/fs.rs

diff --git a/Cargo.lock b/Cargo.lock
index 19f2072..f093aca 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -117,12 +117,41 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "bindgen"
+version = "0.66.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2b84e06fc203107bfbad243f4aba2af864eb7db3b1cf46ea0a023b0b433d2a7"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "peeking_take_while",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn 2.0.104",
+ "which",
+]
+
 [[package]]
 name = "bitflags"
 version = "2.9.1"
@@ -152,12 +181,27 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
 [[package]]
 name = "chrono"
 version = "0.4.41"
@@ -167,6 +211,17 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
 [[package]]
 name = "clap"
 version = "4.5.41"
@@ -210,7 +265,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -249,7 +304,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -263,18 +318,41 @@ dependencies = [
  "clap_complete",
  "env_logger",
  "eyre",
+ "futures",
  "futures-util",
  "glob",
+ "hex",
  "log",
+ "nix",
+ "openssl",
  "page_size",
  "reqwest",
+ "rsmount",
  "serde",
  "serde_json",
  "serde_yaml",
- "thiserror",
+ "thiserror 2.0.12",
  "tokio",
 ]
 
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "embed-doc-image"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af36f591236d9d822425cb6896595658fa558fcebf5ee8accac1d4b92c47166e"
+dependencies = [
+ "base64 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -284,6 +362,26 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "enum-iterator"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c280b9e6b3ae19e152d8e31cf47f18389781e119d4013a2a2bb0180e5facc635"
+dependencies = [
+ "enum-iterator-derive",
+]
+
+[[package]]
+name = "enum-iterator-derive"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1ab991c1362ac86c61ab6f556cff143daa22e5a15e4e189df818b2fd19fe65b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "env_filter"
 version = "0.1.3"
@@ -369,6 +467,21 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "futures"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.31"
@@ -376,6 +489,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
@@ -384,6 +498,17 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
 
+[[package]]
+name = "futures-executor"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.31"
@@ -398,7 +523,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -419,6 +544,7 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
+ "futures-channel",
  "futures-core",
  "futures-io",
  "futures-macro",
@@ -496,6 +622,21 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "home"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "http"
 version = "1.3.1"
@@ -594,7 +735,7 @@ version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f66d5bd4c6f02bf0542fad85d626775bab9258cf795a4256dcaf3161114d1df"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
@@ -806,7 +947,7 @@ checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -829,12 +970,40 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
 [[package]]
 name = "libc"
 version = "0.2.174"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 
+[[package]]
+name = "libloading"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
+dependencies = [
+ "cfg-if",
+ "windows-targets 0.53.2",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.9.4"
@@ -865,6 +1034,12 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -902,6 +1077,28 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -911,6 +1108,28 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "num_enum"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a973b4e44ce6cad84ce69d797acf9a044532e4184c4f267913d1b546a0727b7a"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77e878c846a8abae00dd069496dbe8751b16ac1c3d6bd2a7283a938e8228f90d"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "object"
 version = "0.36.7"
@@ -955,7 +1174,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -986,6 +1205,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "peeking_take_while"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@@ -1034,6 +1259,25 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "prettyplease"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "061c1221631e079b26479d25bbf2275bfe5917ae8419cd7e34f13bfc2aa7539a"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.104",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
+dependencies = [
+ "toml_edit",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.95"
@@ -1093,7 +1337,7 @@ version = "0.12.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cbc931937e6ca3a06e3b6c0aa7841849b160a90351d6ab467a8b9b9959767531"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -1144,12 +1388,89 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rsblkid"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3e6ea0445a9a0f00fc972ca5cc07fccaa56b1d9ccc5fb91a5cc801cbd8a712d"
+dependencies = [
+ "embed-doc-image",
+ "enum-iterator",
+ "libc",
+ "log",
+ "num_enum",
+ "pkg-config",
+ "rsblkid-sys",
+ "thiserror 1.0.69",
+ "typed-builder 0.20.1",
+]
+
+[[package]]
+name = "rsblkid-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b957853ba132af30e120c7cc72a5205626f3fe0b4615ff441c31b9cf753e5"
+dependencies = [
+ "bindgen",
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
+name = "rsmount"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6bcc658c4d3d1a9f71f5618e07293b48f80fffa2455bb64abcb38dac3903b7"
+dependencies = [
+ "embed-doc-image",
+ "enum-iterator",
+ "libc",
+ "log",
+ "num_enum",
+ "once_cell",
+ "pkg-config",
+ "rsblkid",
+ "rsmount-sys",
+ "thiserror 1.0.69",
+ "typed-builder 0.19.1",
+]
+
+[[package]]
+name = "rsmount-sys"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fee55bbe785bc64e472dd05637c718e418c94193c63bc7af996ad0be4a171b5"
+dependencies = [
+ "bindgen",
+ "cc",
+ "pkg-config",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
 
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "rustix"
 version = "1.0.8"
@@ -1159,7 +1480,7 @@ dependencies = [
  "bitflags",
  "errno",
  "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.9.4",
  "windows-sys 0.60.2",
 ]
 
@@ -1257,7 +1578,7 @@ checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1352,6 +1673,17 @@ version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.104"
@@ -1380,7 +1712,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1413,17 +1745,37 @@ dependencies = [
  "fastrand",
  "getrandom 0.3.3",
  "once_cell",
- "rustix",
+ "rustix 1.0.8",
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.12",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1434,7 +1786,7 @@ checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1474,7 +1826,7 @@ checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1510,6 +1862,23 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "winnow",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.2"
@@ -1580,6 +1949,46 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "typed-builder"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06fbd5b8de54c5f7c91f6fe4cebb949be2125d7758e630bb58b1d831dbce600"
+dependencies = [
+ "typed-builder-macro 0.19.1",
+]
+
+[[package]]
+name = "typed-builder"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd9d30e3a08026c78f246b173243cf07b3696d274debd26680773b6773c2afc7"
+dependencies = [
+ "typed-builder-macro 0.20.1",
+]
+
+[[package]]
+name = "typed-builder-macro"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9534daa9fd3ed0bd911d462a37f172228077e7abf18c18a5f67199d959205f8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
+[[package]]
+name = "typed-builder-macro"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c36781cc0e46a83726d9879608e4cf6c2505237e263a8eb8c24502989cfdb28"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.18"
@@ -1673,7 +2082,7 @@ dependencies = [
  "log",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
  "wasm-bindgen-shared",
 ]
 
@@ -1708,7 +2117,7 @@ checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -1745,6 +2154,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix 0.38.44",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -1957,6 +2378,15 @@ version = "0.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
 
+[[package]]
+name = "winnow"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3edebf492c8125044983378ecb5766203ad3b4c2f7a922bd7dd207f6d443e95"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "wit-bindgen-rt"
 version = "0.39.0"
@@ -1992,7 +2422,7 @@ checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
  "synstructure",
 ]
 
@@ -2013,7 +2443,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
  "synstructure",
 ]
 
@@ -2053,7 +2483,7 @@ checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.104",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 4e1693a..bb60925 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -18,11 +18,16 @@ clap = { version = "4.5.40", features = ["derive", "env"] }
 clap_complete = { version = "4.5.54", features = ["unstable-dynamic"] }
 env_logger = "0.11.8"
 eyre = "0.6.12"
+futures = "0.3.31"
 futures-util = "0.3.31"
 glob = "0.3.2"
+hex = "0.4.3"
 log = "0.4.27"
+nix = { version = "0.30.1", features = ["user"] }
+openssl = "0.10.73"
 page_size = "0.6.0"
 reqwest = { version = "0.12.20", features = ["json", "stream"] }
+rsmount = "0.2.1"
 serde = { version = "1.0.219", features = ["derive"] }
 serde_json = "1.0.140"
 serde_yaml = "0.9.34"
diff --git a/src/bin/dkl.rs b/src/bin/dkl.rs
index 5330960..6b7b212 100644
--- a/src/bin/dkl.rs
+++ b/src/bin/dkl.rs
@@ -40,10 +40,31 @@ enum Command {
         /// Path where the logs are stored
         #[arg(long, short = 'p', default_value = "/var/log", env = "DKL_LOG_PATH")]
         log_path: String,
+        /// Name of the log set to operate on.
         log_name: String,
         #[command(subcommand)]
         op: LogOp,
     },
+    Dynlay {
+        layer: String,
+        version: String,
+        #[arg(
+            long,
+            short = 'u',
+            default_value = "https://dkl.novit.io/dist/layers",
+            env = "DKL_DYNLAY_URL"
+        )]
+        url_prefix: String,
+        #[arg(
+            long,
+            short = 'd',
+            default_value = "/opt/dynlay",
+            env = "DKL_DYNLAY_DIR"
+        )]
+        layers_dir: String,
+        #[arg(long, default_value = "/")]
+        chroot: std::path::PathBuf,
+    },
 }
 
 #[tokio::main(flavor = "current_thread")]
@@ -90,6 +111,21 @@ async fn main() -> Result<()> {
             log_name,
             op,
         } => op.run(&log_path, &log_name).await,
+        C::Dynlay {
+            ref layer,
+            ref version,
+            ref url_prefix,
+            ref layers_dir,
+            chroot,
+        } => {
+            dkl::dynlay::Dynlay {
+                url_prefix,
+                layers_dir,
+                chroot,
+            }
+            .install(layer, version)
+            .await
+        }
     }
 }
 
diff --git a/src/dynlay.rs b/src/dynlay.rs
new file mode 100644
index 0000000..ec37549
--- /dev/null
+++ b/src/dynlay.rs
@@ -0,0 +1,165 @@
+use eyre::{format_err, Result};
+use log::{debug, error, info, warn};
+use std::path::PathBuf;
+use tokio::{fs, io::AsyncWriteExt, process::Command};
+
+use crate::fs::spawn_walk_dir;
+
+pub struct Dynlay<'t> {
+    pub url_prefix: &'t str,
+    pub layers_dir: &'t str,
+    pub chroot: PathBuf,
+}
+
+impl<'t> Dynlay<'t> {
+    pub async fn install(&self, layer: &str, version: &str) -> Result<()> {
+        let lay_dir = &format!("{base}/{layer}", base = self.layers_dir);
+
+        debug!("mkdir -p {lay_dir}");
+        fs::create_dir_all(lay_dir).await?;
+
+        let lay_path = &format!("{lay_dir}/{version}");
+
+        if !fs::try_exists(lay_path).await? {
+            let part_file = &format!("{lay_dir}/{version}.tmp");
+
+            self.fetch(layer, version, part_file).await?;
+
+            (fs::rename(part_file, lay_path).await)
+                .map_err(|e| format_err!("failed mv {part_file} {lay_path}: {e}"))?;
+        }
+
+        let mount_path = PathBuf::from(lay_dir).join("mounts").join(layer);
+        let mount_path_str = mount_path.to_string_lossy().into_owned();
+
+        (fs::create_dir_all(&mount_path).await)
+            .map_err(|e| format_err!("mkdir -p {mount_path:?} failed: {e}"))?;
+
+        let mount_path = &fs::canonicalize(mount_path).await?;
+
+        let mut mount_info = rsmount::tables::MountInfo::new()?;
+        mount_info.import_mountinfo()?;
+
+        if mount_info.find_target(mount_path).is_some() {
+            info!("clearing previous mount");
+
+            let mut paths = spawn_walk_dir(mount_path.clone());
+            while let Some(result) = paths.recv().await {
+                let Ok((path, md)) = result else {
+                    continue;
+                };
+                if !md.is_dir() {
+                    let path = self.chroot.join(&path);
+
+                    debug!("rm {path:?}");
+                    if let Err(e) = fs::remove_file(&path).await {
+                        warn!("rm {path:?} failed: {e}");
+                    }
+                }
+            }
+
+            sudo("umount", &[mount_path]).await?;
+        }
+
+        // mount layer
+        info!("mounting layer");
+        sudo("mount", &["-t", "squashfs", lay_path, &mount_path_str]).await?;
+
+        let mut paths = spawn_walk_dir(mount_path.clone());
+        while let Some(result) = paths.recv().await {
+            let Ok((path, md)) = result else {
+                continue;
+            };
+
+            let target = self.chroot.join(&path);
+
+            if md.is_dir() {
+                debug!("mkdir -p {target:?}");
+                if let Err(e) = fs::create_dir_all(&target).await {
+                    error!("mkdir -p {target:?} failed: {e}");
+                }
+            } else {
+                let _ = fs::remove_file(&target).await;
+
+                let source = mount_path.join(&path);
+
+                debug!("ln -s {source:?} {target:?}");
+                if let Err(e) = fs::symlink(&source, &target).await {
+                    error!("ln -s {source:?} {target:?} failed: {e}");
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    async fn fetch(&self, layer: &str, version: &str, part_file: &str) -> Result<()> {
+        let url = &format!("{}/{layer}/{version}", self.url_prefix);
+        info!("fetching {url}");
+
+        let mut out = (fs::File::create(part_file).await)
+            .map_err(|e| format_err!("failed to open {part_file}: {e}"))?;
+
+        let resp = reqwest::get(url).await?;
+        if !resp.status().is_success() {
+            return Err(format_err!("fetch failed: {}", resp.status()));
+        }
+
+        let sha1 = (resp.headers().get("x-content-sha1"))
+            .ok_or(format_err!("no content hash in response"))?;
+        let sha1 = (sha1.to_str()).map_err(|e| format_err!("invalid sha1: {e}"))?;
+
+        debug!("content sha1: {sha1}");
+        let mut exp_sha1 = [0; 20];
+        hex::decode_to_slice(sha1, &mut exp_sha1).map_err(|e| format_err!("invalid sha1: {e}"))?;
+
+        let mut hash = openssl::sha::Sha1::new();
+
+        use futures::StreamExt;
+        let mut stream = resp.bytes_stream();
+        while let Some(bytes) = stream.next().await {
+            let bytes = bytes.map_err(|e| format_err!("remote read error: {e}"))?;
+            hash.update(&bytes);
+            (out.write_all(&bytes).await).map_err(|e| format_err!("local write error: {e}"))?;
+        }
+
+        (out.flush().await).map_err(|e| format_err!("local write error: {e}"))?;
+        drop(out);
+
+        let dl_sha1 = hash.finish();
+        if dl_sha1 != exp_sha1 {
+            if let Err(e) = fs::remove_file(part_file).await {
+                error!("failed to remove {part_file}: {e}");
+            }
+            return Err(format_err!(
+                "invalid content hash: expected {exp}, got {got}",
+                exp = hex::encode(exp_sha1),
+                got = hex::encode(dl_sha1)
+            ));
+        }
+
+        Ok(())
+    }
+}
+
+async fn sudo<I, S>(program: &str, args: I) -> Result<()>
+where
+    I: IntoIterator<Item = S>,
+    S: AsRef<std::ffi::OsStr>,
+{
+    let mut cmd = if nix::unistd::geteuid().is_root() {
+        let mut cmd = Command::new(program);
+        cmd.args(args);
+        cmd
+    } else {
+        let mut cmd = Command::new("sudo");
+        cmd.arg(program).args(args);
+        cmd
+    };
+    let status = cmd.status().await?;
+    if status.success() {
+        Ok(())
+    } else {
+        Err(format_err!("{program} failed: {status}"))
+    }
+}
diff --git a/src/fs.rs b/src/fs.rs
new file mode 100644
index 0000000..2fbb323
--- /dev/null
+++ b/src/fs.rs
@@ -0,0 +1,60 @@
+use eyre::Result;
+use std::fs::Metadata;
+use std::path::PathBuf;
+use tokio::fs::read_dir;
+use tokio::sync::mpsc;
+
+pub fn spawn_walk_dir(
+    dir: impl Into<PathBuf> + Send + 'static,
+) -> mpsc::Receiver<Result<(PathBuf, Metadata)>> {
+    let (tx, rx) = mpsc::channel(1);
+    tokio::spawn(walk_dir(dir, tx));
+    rx
+}
+
+pub async fn walk_dir(dir: impl Into<PathBuf>, tx: mpsc::Sender<Result<(PathBuf, Metadata)>>) {
+    let dir: PathBuf = dir.into();
+
+    let mut todo = std::collections::LinkedList::new();
+    if let Ok(rd) = read_dir(&dir).await {
+        todo.push_front(rd);
+    }
+
+    while let Some(rd) = todo.front_mut() {
+        let entry = match rd.next_entry().await {
+            Ok(v) => v,
+            Err(e) => {
+                if tx.send(Err(e.into())).await.is_err() {
+                    return;
+                }
+                todo.pop_front(); // skip dir on error
+                continue;
+            }
+        };
+
+        let Some(entry) = entry else {
+            todo.pop_front();
+            continue;
+        };
+
+        let Ok(md) = entry.metadata().await else {
+            continue;
+        };
+        let is_dir = md.is_dir();
+
+        let Ok(path) = entry.path().strip_prefix(&dir).map(|p| p.to_path_buf()) else {
+            continue; // sub-entry not in dir, weird but semantically, we ignore
+        };
+
+        if tx.send(Ok((path, md))).await.is_err() {
+            return;
+        }
+
+        // recurse in sub directories
+        if is_dir {
+            if let Ok(rd) = read_dir(entry.path()).await {
+                todo.push_front(rd);
+            }
+        }
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index 3e49221..75710fb 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -2,6 +2,8 @@ pub mod apply;
 pub mod bootstrap;
 pub mod dls;
 pub mod logger;
+pub mod dynlay;
+pub mod fs;
 
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Config {
diff --git a/test-dkl b/test-dkl
index 2bd2705..e6f103c 100755
--- a/test-dkl
+++ b/test-dkl
@@ -3,9 +3,9 @@ set -ex
 
 dkl=target/debug/dkl
 
-test=${1:-log-clean}
+test=${1:-dynlay}
 
-export RUST_LOG=debug
+export RUST_LOG=debug,rsmount=info
 
 case $test in
   apply-config)
@@ -19,13 +19,22 @@ case $test in
     cat tmp/log/bash.log
     ;;
 
-  log-ls)    $dkl log --log-path tmp/log bash ls ;;
-  log-cat)   $dkl log --log-path tmp/log bash cat 20250720_12 20301231_23 ;;
+  log-ls)
+    $dkl log --log-path tmp/log bash ls
+    ;;
+  log-cat)
+    $dkl log --log-path tmp/log bash cat 20250720_12 20301231_23
+    ;;
   log-clean)
     $dkl log --log-path tmp/log bash ls -l
     $dkl log --log-path tmp/log bash cleanup 0
     ;;
 
+  dynlay)
+    mkdir -p tmp/system
+    $dkl dynlay --layers-dir tmp/dynlay --chroot tmp/system kubernetes v1.33.3_containerd.2.0.5
+    ;;
+
   *) echo 1>&2 "unknown test: $test"; exit 1 ;;
 esac