merged layer handling

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "init"
-version = "2.5.3"
+version = "2.6.0"
 edition = "2024"
 
 [profile.release]
@@ -30,3 +30,4 @@ dkl = { git = "https://novit.tech/direktil/dkl", version = "1.0.0" }
 openssl = "0.10.73"
 reqwest = { version = "0.13.1", features = ["native-tls"] }
 glob = "0.3.3"
+hex = "0.4.3"

Dockerfile

@@ -1,4 +1,4 @@
-from rust:1.93.0-alpine as rust
+from rust:1.95.0-alpine as rust
 
 run apk add --no-cache git musl-dev libudev-zero-dev openssl-dev cryptsetup-dev lvm2-dev clang-libs clang-dev
 
@@ -9,8 +9,7 @@ run --mount=type=cache,id=novit-rs,target=/usr/local/cargo/registry \
     RUSTFLAGS="-C target-feature=-crt-static" cargo install --path . --root /dist
 
 # ------------------------------------------------------------------------
-from alpine:3.23.3 as initrd
+from alpine:3.23.4 as system
-run apk add zstd lz4
 
 workdir /system
 
@@ -31,9 +30,26 @@ run mkdir -p bin run var/log; cd bin && for cmd in init-version init-connect boo
 # check viability
 run chroot . init-version
 
-run find * |cpio -H newc -oF /initrd
+# ------------------------------------------------------------------------
+from alpine:3.23.4 as initrd
+
+copy --from=system /system /system
+run cd /system && find * |cpio -H newc -oF /initrd
 
 # ------------------------------------------------------------------------
-from alpine:3.23.2
+from debian:stable-backports as initramfs
-copy --from=initrd /initrd /
+run apt update && apt install -y erofs-utils
+
+copy --from=system /system /system
+run mkfs.erofs \
+  -z lzma -C131072 -Efragments,ztailpacking \
+  -T0 --all-time --ignore-mtime \
+  /initramfs /system
+
+# ------------------------------------------------------------------------
+from alpine:3.23.4
+copy --from=initrd /initrd /initrd
 entrypoint ["base64","/initrd"]
+
+#copy --from=initramfs /initramfs /
+#entrypoint ["base64","/initramfs"]

src/cmd/init.rs

@@ -54,10 +54,10 @@ pub async fn run() {
     info!("Linux version {kernel_version}");
 
     // mount basic filesystems
-    mount(None, "/proc", "proc", None).await;
+    mount(None::<&str>, "/proc", "proc", None).await;
-    mount(None, "/sys", "sysfs", None).await;
+    mount(None::<&str>, "/sys", "sysfs", None).await;
-    mount(None, "/dev", "devtmpfs", None).await;
+    mount(None::<&str>, "/dev", "devtmpfs", None).await;
-    mount(None, "/dev/pts", "devpts", Some("gid=5,mode=620")).await;
+    mount(None::<&str>, "/dev/pts", "devpts", Some("gid=5,mode=620")).await;
 
     if utils::bool_param("debug") {
         log::set_max_level(log::LevelFilter::Debug);
@@ -144,6 +144,9 @@ pub async fn run() {
         warn!("failed to copy {INIT_LOG} to system: {e}");
     }
 
+    if let Err(e) = nix::mount::umount2("/modules", nix::mount::MntFlags::MNT_DETACH) {
+        warn!("failed to umount /modules: {e}");
+    }
     retry(async || switch_root("/system").await).await;
 }
 
@@ -174,15 +177,27 @@ async fn chmod(path: impl AsRef<Path>, mode: u32) -> std::io::Result<()> {
     fs::set_permissions(path, perms).await
 }
 
-async fn mount(src: Option<&str>, dst: &str, fstype: &str, opts: Option<&str>) {
+async fn mount<S: AsRef<Path>>(
+    src: Option<S>,
+    dst: impl AsRef<Path>,
+    fstype: &str,
+    opts: Option<&str>,
+) {
+    let src = src.as_ref().map(|s| s.as_ref());
+    let src_str = src.map(|s| s.display().to_string());
+    let src_str = src_str.as_deref();
+
+    let dst = dst.as_ref();
+    let dst_str = &dst.display().to_string();
+
     if let Err(e) = fs::create_dir_all(dst).await {
-        error!("failed to create dir {dst}: {e}");
+        error!("failed to create dir {dst_str}: {e}");
     }
 
     retry_or_ignore(async || {
         let mut is_file = false;
 
-        if let Some(src) = src {
+        if let Some(src) = src_str {
             is_file = (fs::metadata(src).await)
                 .map_err(|e| format_err!("stat {src} failed: {e}"))?
                 .is_file();
@@ -194,7 +209,7 @@ async fn mount(src: Option<&str>, dst: &str, fstype: &str, opts: Option<&str>) {
             }
         }
 
-        let mut args = vec![src.unwrap_or("none"), dst, "-t", fstype];
+        let mut args = vec![src_str.unwrap_or("none"), dst_str, "-t", fstype];
         if let Some(opts) = opts {
             args.extend(["-o", opts]);
         }
@@ -206,11 +221,17 @@ async fn mount(src: Option<&str>, dst: &str, fstype: &str, opts: Option<&str>) {
         }
 
         let (cmd_str, _) = cmd_str("mount", &args);
-        let flags = nix::mount::MsFlags::empty();
 
         info!("# {cmd_str}",);
-        nix::mount::mount(src, dst, Some(fstype), flags, opts)
+
-            .map_err(|e| format_err!("mount {dst} failed: {e}"))
+        let mount = |flags| nix::mount::mount(src, dst, Some(fstype), flags, opts);
+
+        use nix::{errno::Errno, mount::MsFlags};
+        match mount(MsFlags::empty()) {
+            Err(Errno::EACCES) => mount(MsFlags::MS_RDONLY),
+            r => r,
+        }
+        .map_err(|e| format_err!("mount {dst_str} failed: {e}"))
     })
     .await
 }
@@ -225,6 +246,25 @@ async fn start_daemon(prog: &str, args: &[&str]) {
     .await;
 }
 
+async fn try_exec_cmd(mut cmd: tokio::process::Command) -> Result<()> {
+    info!(
+        "# {} {}",
+        cmd.as_std().get_program().to_string_lossy(),
+        cmd.as_std()
+            .get_args()
+            .map(|a| a.to_string_lossy())
+            .collect::<Vec<_>>()
+            .join(" ")
+    );
+
+    let s = cmd.status().await?;
+    if s.success() {
+        Ok(())
+    } else {
+        Err(format_err!("command failed: {s}"))
+    }
+}
+
 async fn try_exec(prog: &str, args: &[&str]) -> Result<()> {
     let (cmd_str, mut cmd) = cmd_str(prog, args);
     info!("# {cmd_str}");

src/cmd/init/bootstrap.rs

@@ -1,8 +1,9 @@
 use eyre::{format_err, Result};
 use log::{info, warn};
+use std::path::{Path, PathBuf};
 use tokio::{
     fs,
-    io::{AsyncBufReadExt, AsyncWriteExt, BufReader},
+    io::{AsyncBufReadExt, AsyncReadExt, AsyncWrite, AsyncWriteExt, BufReader},
 };
 
 use dkl::{
@@ -12,12 +13,12 @@ use dkl::{
     bootstrap::Config,
 };
 
-use super::{exec, mount, retry, retry_or_ignore, try_exec};
+use super::{exec, mount, retry, retry_or_ignore, try_exec, try_exec_cmd};
 use crate::{fs::walk_dir, utils};
 
 pub async fn bootstrap(cfg: Config) {
     let verifier = retry(async || Verifier::from_config(&cfg)).await;
-    let bs = cfg.bootstrap;
+    let bs = &cfg.bootstrap;
 
     mount(Some(&bs.dev), "/bootstrap", "ext4", None).await;
 
@@ -53,7 +54,7 @@ pub async fn bootstrap(cfg: Config) {
     })
     .await;
 
-    mount_system(&sys_cfg, base_dir, &verifier).await;
+    mount_system(&sys_cfg, &cfg, base_dir, &verifier).await;
 
     retry_or_ignore(async || {
         let path = "/etc/resolv.conf";
@@ -65,7 +66,7 @@ pub async fn bootstrap(cfg: Config) {
     })
     .await;
 
-    retry_or_ignore(async || apply::files(&sys_cfg.files, "/system").await).await;
+    retry_or_ignore(async || apply::files(&sys_cfg.files, "/system", false).await).await;
 
     apply_groups(&sys_cfg.groups, "/system").await;
     apply_users(&sys_cfg.users, "/system").await;
@@ -96,17 +97,21 @@ impl Verifier {
         return Ok(Self { pubkey });
     }
 
-    async fn verify_path(&self, path: &str) -> Result<Vec<u8>> {
+    async fn verify_path(&self, path: impl AsRef<Path>) -> Result<Vec<u8>> {
-        let data = (fs::read(path).await).map_err(|e| format_err!("failed to read {path}: {e}"))?;
+        let path = path.as_ref();
+        let p = path.display();
+
+        let data = (fs::read(path).await).map_err(|e| format_err!("failed to read {p}: {e}"))?;
 
         let Some(ref pubkey) = self.pubkey else {
             return Ok(data);
         };
 
-        info!("verifying {path}");
+        info!("verifying {p}");
 
-        let sig = &format!("{path}.sig");
+        let sig = path.with_added_extension("sig");
-        let sig = (fs::read(sig).await).map_err(|e| format_err!("failed to read {sig}: {e}"))?;
+        let sig = (fs::read(&sig).await)
+            .map_err(|e| format_err!("failed to read {}: {e}", sig.display()))?;
 
         use openssl::{hash::MessageDigest, pkey::PKey, sign::Verifier};
         let pubkey = PKey::public_key_from_der(pubkey)?;
@@ -118,7 +123,7 @@ impl Verifier {
         if sig_ok {
             Ok(data)
         } else {
-            Err(format_err!("signature verification failed for {path}"))
+            Err(format_err!("signature verification failed for {p}"))
         }
     }
 }
@@ -187,47 +192,136 @@ fn default_root_tmpfs_opts() -> Option<String> {
     Some(format!("size={fs_size}m"))
 }
 
-async fn mount_system(cfg: &dkl::Config, bs_dir: &str, verifier: &Verifier) {
+struct LayerMounter<'t> {
+    bs_dir: &'t str,
+    layers_dir: &'t str,
+    verifier: &'t Verifier,
+    lower_dir: String,
+}
+
+impl LayerMounter<'_> {
+    fn src_path(&self, name: &str) -> PathBuf {
+        let mut p = PathBuf::from(self.bs_dir);
+        p.push(name);
+        if name != "merged" {
+            p.add_extension("fs");
+        }
+        p
+    }
+
+    async fn exists(&self, name: &str) -> bool {
+        retry(async || Ok(fs::try_exists(self.src_path(name)).await?)).await
+    }
+
+    async fn mount(&mut self, name: &str) {
+        self.mount_path(self.src_path(name), name, true).await
+    }
+
+    async fn mount_path(&mut self, src: impl AsRef<Path>, name: &str, verify: bool) {
+        let src = src.as_ref();
+        let tgt_dir = PathBuf::from(self.layers_dir).join(name);
+        let tgt = tgt_dir.with_added_extension("fs");
+
+        if let Err(e) = fs::create_dir_all(&tgt_dir).await {
+            warn!("mkdir -p {}: {e}", tgt_dir.display());
+        }
+
+        let mount_src = if name == "merged" {
+            retry(async || {
+                let data = self.verifier.verify_path(src).await?;
+                let data = MergedLayer::from_bytes(&data)
+                    .ok_or(format_err!("{}: invalid data", src.display()))?;
+
+                data.create(&tgt)
+                    .await
+                    .map_err(|e| format_err!("write {}: {e}", tgt.display()))?;
+
+                let dm_name = &format!("system");
+
+                let mut cmd = tokio::process::Command::new("veritysetup");
+                cmd.arg("open")
+                    .arg(format!("--hash-offset={}", data.hash_offset()))
+                    .arg(&tgt)
+                    .arg(dm_name)
+                    .arg(&tgt)
+                    .arg(data.root_hash_hex());
+
+                try_exec_cmd(cmd).await?;
+
+                Ok(PathBuf::from("/dev/mapper").join(dm_name))
+            })
+            .await
+        } else {
+            retry(async || {
+                let src = if verify {
+                    self.verifier.verify_path(src).await?
+                } else {
+                    fs::read(src).await?
+                };
+                fs::write(&tgt, &src).await?;
+
+                Ok(tgt.clone())
+            })
+            .await
+        };
+
+        retry(async || {
+            let mut buf = [0u8; 1028];
+            fs::File::open(&mount_src)
+                .await
+                .map_err(|e| format_err!("open {}: {e}", mount_src.display()))?
+                .read_exact(&mut buf)
+                .await
+                .map_err(|e| format_err!("read {}: {e}", mount_src.display()))?;
+
+            let fstype = if buf[1024..1028] == 0xE0F5E1E2u32.to_le_bytes() {
+                "erofs"
+            } else {
+                "squashfs"
+            };
+
+            mount(Some(&mount_src), &tgt_dir, fstype, None).await;
+            Ok(())
+        })
+        .await;
+
+        if !self.lower_dir.is_empty() {
+            self.lower_dir.push(':');
+        }
+        self.lower_dir.push_str(&tgt_dir.to_string_lossy());
+    }
+}
+
+async fn mount_system(cfg: &dkl::Config, bs_cfg: &Config, bs_dir: &str, verifier: &Verifier) {
     let opts = match utils::param("root-opts") {
         Some(s) => Some(s.to_string()),
         None => default_root_tmpfs_opts(),
     };
 
     let mem_dir = "/mem";
-    mount(None, mem_dir, "tmpfs", opts.as_deref()).await;
+    mount(None::<&str>, mem_dir, "tmpfs", opts.as_deref()).await;
 
-    let layers_dir = &format!("{mem_dir}/layers");
+    let mut mounter = LayerMounter {
-    let mut lower_dir = String::new();
+        bs_dir,
+        layers_dir: &format!("{mem_dir}/layers"),
+        verifier,
+        lower_dir: String::new(),
+    };
 
-    for layer in &cfg.layers {
+    if mounter.exists("merged").await {
-        let src = retry(async || {
+        mounter.mount("merged").await;
-            if layer == "modules" {
+    } else {
-                let src = "/modules.sqfs";
+        for layer in &cfg.layers {
-                (fs::read(src).await).map_err(|e| format_err!("read {src} failed: {e}"))
+            if layer == "modules" && bs_cfg.modules.is_some() {
-            } else {
+                continue; // take modules from initrd
-                verifier.verify_path(&format!("{bs_dir}/{layer}.fs")).await
             }
-        })
-        .await;
 
-        let tgt = &format!("{mem_dir}/{layer}.fs");
+            mounter.mount(layer).await;
-        retry(async || {
-            info!("copying layer {layer}");
-
-            let mut out = (fs::File::create(tgt).await)
-                .map_err(|e| format_err!("create {tgt} failed: {e}"))?;
-            (out.write_all(&src).await).map_err(|e| format_err!("write failed: {e}"))?;
-            (out.flush().await).map_err(|e| format_err!("write failed: {e}"))
-        })
-        .await;
-
-        let layer_dir = &format!("{layers_dir}/{layer}");
-        mount(Some(tgt), layer_dir, "squashfs", None).await;
-
-        if !lower_dir.is_empty() {
-            lower_dir.push(':');
         }
-        lower_dir.push_str(&layer_dir);
+    }
+
+    if let Some(ref modules) = bs_cfg.modules {
+        mounter.mount_path(modules, "modules", false).await;
     }
 
     let upper_dir = &format!("{mem_dir}/upper");
@@ -240,8 +334,9 @@ async fn mount_system(cfg: &dkl::Config, bs_dir: &str, verifier: &Verifier) {
     })
     .await;
 
+    let lower_dir = &mounter.lower_dir;
     let opts = format!("lowerdir={lower_dir},upperdir={upper_dir},workdir={work_dir}");
-    mount(None, "/system", "overlay", Some(&opts)).await;
+    mount(None::<&str>, "/system", "overlay", Some(&opts)).await;
 
     // make root rshared (default in systemd, required by Kubernetes 1.10+)
     // equivalent to "mount --make-rshared /"
@@ -255,6 +350,53 @@ async fn mount_system(cfg: &dkl::Config, bs_dir: &str, verifier: &Verifier) {
     .await;
 }
 
+struct MergedLayer<'t> {
+    #[allow(unused)]
+    root_hash_sig: &'t [u8],
+    root_hash: &'t [u8],
+    data: &'t [u8],
+    hash: &'t [u8],
+}
+
+impl<'t> MergedLayer<'t> {
+    fn from_bytes(mut src: &'t [u8]) -> Option<Self> {
+        let mut next = || {
+            let (len, rem) = src.split_at_checked(8)?;
+            let len = u64::from_be_bytes(len.try_into().ok()?);
+            let (data, rem) = rem.split_at_checked(len as usize)?;
+            src = rem;
+            Some(data)
+        };
+
+        Some(Self {
+            root_hash_sig: next()?,
+            root_hash: next()?,
+            data: next()?,
+            hash: next()?,
+        })
+    }
+
+    async fn create(&self, path: impl AsRef<Path>) -> std::io::Result<()> {
+        let mut out = fs::File::create(path).await?;
+        self.write_to(&mut out).await?;
+        out.shutdown().await
+    }
+
+    async fn write_to(&self, mut out: impl AsyncWrite + Unpin) -> std::io::Result<()> {
+        out.write_all(self.data).await?;
+        out.write_all(self.hash).await?;
+        Ok(())
+    }
+
+    fn hash_offset(&self) -> usize {
+        self.data.len()
+    }
+
+    fn root_hash_hex(&self) -> String {
+        hex::encode(self.root_hash)
+    }
+}
+
 async fn apply_groups(groups: &[dkl::Group], root: &str) {
     for group in groups {
         let mut args = vec![root, "groupadd", "-r"];

test-initrd/config.yaml

@@ -21,8 +21,6 @@ auths:
     sshKey:   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkpbU6sf4t0f6XAv9DuW3XH5iLM0AI5rc8PT2jwea1N
     password: bXlzZWVk:HMSxrg1cYphaPuUYUbtbl/htep/tVYYIQAuvkNMVpw0 # mypass
 
-signer_public_key: MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA29glSqk7MqoUIjD+UQG+b4v59pTFkn8rYtNhOftTe7uiLUvGFsjNdzP3tW64t/c6YD2p6dtI3oQXGOVQO1vIWPEBc6Sq++BRpQ0FVna+dgNQx8/kLXN9Na0ZYbK7q0haCI7/EHWOX79JFFxJE9HJ67AOMmXwGJ2jrfa1CUnWvfCmT+E=
-
 ssh:
   listen: "[::]:22"
   user_ca: /user_ca.pub
@@ -41,22 +39,24 @@ networks:
     udev: !has ID_NET_NAME_MAC
   script: |
     ip li set $iface up
-    udhcpc -i $iface -b -t1 -T1 -A5 ||
+    ip a add 192.168.12.42/24 dev $iface
-    ip a add 2001:41d0:306:168f::1337:2eed/64 dev $iface
+    ip a add fd12:6e76:7474::1337:2eed/64 dev $iface
+    ip route add default via 192.168.12.254
+    ip route add default via fd12:6e76:7474::1 dev $iface
 
-pre_lvm_crypt:
+#pre_lvm_crypt:
-- name: sys-${name}
+#- name: sys-${name}
-  udev: !glob [ DEVNAME, /dev/vd* ]
+#  udev: !glob [ DEVNAME, /dev/vd* ]
 
 lvm:
 - vg: storage
   pvs:
     n: 2
     regexps:
-    - ^/dev/mapper/sys-
+    #- ^/dev/mapper/sys-
     # to match full disks
     #- /dev/nvme[0-9]+n[0-9]+
-    #- /dev/vd[a-z]+
+    - /dev/vd[a-z]+
     #- /dev/sd[a-z]+
     #- /dev/hd[a-z]+
     # to match partitions:
@@ -72,11 +72,16 @@ lvm:
 
   lvs:
   - name: bootstrap
-    size: 2g
+    size: 1g
 
   - name: varlog
-    extents: 10%FREE
+    size: 256m
-    # size: 10g
+  - name: kubelet
+    size: 256m
+  - name: containerd
+    size: 1g
+  - name: etcd
+    size: 256m
 
   - name: podman
     extents: 10%FREE
@@ -90,11 +95,8 @@ lvm:
 #- dev: /dev/storage/bootstrap
 #- dev: /dev/storage/dls
 
+signer_public_key: 'MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBe6Y3zGQUIHvVXoS5GI8irY8yoB0ozFpzn/cUykA46TkHdJ8xCEaaM1MpqMrfWgDtP/rA2KeE9HjVerLnEFD01uUAUh4/OYgCBDYJPhridVDoC78KOJpkWBj7Shl0Rp0AtETvatNPa1RRe15V7nDF/Nm75Y6O3IL29lYPQ6jqEGhR810='
 bootstrap:
-  #dev: /dev/mapper/bootstrap
   dev: /dev/storage/bootstrap
-  # TODO seed: https://direktil.novit.io/bootstraps/dls-crypt
+  seed: http://192.168.12.254:7606/public/download-set/host/m1/bootstrap.tar?set=ICIXKJJWA6U4RQESD3KQMWO3IBW6THG4FJUM2HUNFPTIODVSXGDPXTCHSFT6IOUZO6LBAG65QIGYUMIZA3TEHTPB6BXKUFONNUWKUWAJAQRE2GDEOC4RWAAAQA3DSZJXMNSDGN34NA5G2MJ2MJXW65DTORZGC4BOORQXEAAAAAACMICVFM
-  seed: http://192.168.10.254:7606/hosts/m1/bootstrap.tar
-  # TODO seed_sign_key: "..."
-  # TODO load_and_close: true