15-OCI规范与标准化

package main

import (
    "encoding/json"
    "fmt"
    "io/ioutil"
    "os"
    "path/filepath"
    "syscall"
    "golang.org/x/sys/unix"
)

// OCIConfig OCI 配置结构
type OCIConfig struct {
    OCIVersion string `json:"ociVersion"`
    Process    struct {
        Terminal bool     `json:"terminal"`
        User     struct {
            UID int `json:"uid"`
            GID int `json:"gid"`
        } `json:"user"`
        Args []string `json:"args"`
        Env  []string `json:"env"`
        Cwd  string   `json:"cwd"`
    } `json:"process"`
    Root struct {
        Path     string `json:"path"`
        Readonly bool   `json:"readonly"`
    } `json:"root"`
    Hostname string `json:"hostname"`
    Mounts   []struct {
        Destination string   `json:"destination"`
        Type        string   `json:"type"`
        Source      string   `json:"source"`
        Options     []string `json:"options"`
    } `json:"mounts"`
    Linux struct {
        Namespaces []struct {
            Type string `json:"type"`
        } `json:"namespaces"`
        Resources struct {
            Memory struct {
                Limit int64 `json:"limit"`
            } `json:"memory"`
            CPU struct {
                Shares int64 `json:"shares"`
                Quota  int64 `json:"quota"`
                Period int64 `json:"period"`
            } `json:"cpu"`
        } `json:"resources"`
    } `json:"linux"`
}

// LoadOCIConfig 加载 OCI 配置
func LoadOCIConfig(configPath string) (*OCIConfig, error) {
    data, err := ioutil.ReadFile(configPath)
    if err != nil {
        return nil, fmt.Errorf("failed to read config file: %v", err)
    }
    
    var config OCIConfig
    if err := json.Unmarshal(data, &config); err != nil {
        return nil, fmt.Errorf("failed to parse config: %v", err)
    }
    
    return &config, nil
}

// CreateContainer 创建容器
func CreateContainer(config *OCIConfig, bundlePath string) error {
    // 创建容器目录
    containerDir := filepath.Join(bundlePath, "container")
    if err := os.MkdirAll(containerDir, 0755); err != nil {
        return fmt.Errorf("failed to create container directory: %v", err)
    }
    
    // 创建状态文件
    stateFile := filepath.Join(containerDir, "state.json")
    state := map[string]interface{}{
        "ociVersion": config.OCIVersion,
        "id":         "container-123",
        "status":     "created",
        "bundle":     bundlePath,
        "created":    "2023-01-01T00:00:00Z",
    }
    
    stateData, err := json.MarshalIndent(state, "", "  ")
    if err != nil {
        return fmt.Errorf("failed to marshal state: %v", err)
    }
    
    if err := ioutil.WriteFile(stateFile, stateData, 0644); err != nil {
        return fmt.Errorf("failed to write state file: %v", err)
    }
    
    return nil
}

// StartContainer 启动容器
func StartContainer(config *OCIConfig, bundlePath string) error {
    // 创建所有 namespace 的 flags
    flags := syscall.CLONE_NEWUTS |
             syscall.CLONE_NEWPID |
             syscall.CLONE_NEWNS |
             syscall.CLONE_NEWNET |
             syscall.CLONE_NEWIPC |
             syscall.CLONE_NEWUSER |
             syscall.CLONE_NEWCGROUP

    // 准备子进程命令
    cmd := exec.Command("/proc/self/exe", "child", bundlePath)
    
    // 设置系统调用属性
    cmd.SysProcAttr = &syscall.SysProcAttr{
        Cloneflags: flags,
    }

    // 设置标准输入输出
    cmd.Stdin = os.Stdin
    cmd.Stdout = os.Stdout
    cmd.Stderr = os.Stderr

    // 启动子进程
    if err := cmd.Start(); err != nil {
        return fmt.Errorf("failed to start child process: %v", err)
    }

    // 等待子进程完成
    return cmd.Wait()
}

// setupContainer 设置容器环境
func setupContainer(config *OCIConfig, bundlePath string) error {
    // 设置主机名
    if err := unix.Sethostname([]byte(config.Hostname)); err != nil {
        return fmt.Errorf("failed to set hostname: %v", err)
    }

    // 设置工作目录
    if err := os.Chdir(config.Process.Cwd); err != nil {
        return fmt.Errorf("failed to change working directory: %v", err)
    }

    // 挂载文件系统
    for _, mount := range config.Mounts {
        if err := mountFilesystem(mount); err != nil {
            return fmt.Errorf("failed to mount %s: %v", mount.Destination, err)
        }
    }

    // 切换根目录
    if err := pivotRoot(config.Root.Path); err != nil {
        return fmt.Errorf("failed to pivot root: %v", err)
    }

    // 执行命令
    if err := syscall.Exec(config.Process.Args[0], config.Process.Args, config.Process.Env); err != nil {
        return fmt.Errorf("failed to exec command: %v", err)
    }

    return nil
}

// mountFilesystem 挂载文件系统
func mountFilesystem(mount struct {
    Destination string   `json:"destination"`
    Type        string   `json:"type"`
    Source      string   `json:"source"`
    Options     []string `json:"options"`
}) error {
    // 创建目标目录
    if err := os.MkdirAll(mount.Destination, 0755); err != nil {
        return fmt.Errorf("failed to create mount point: %v", err)
    }

    // 解析挂载选项
    var flags uintptr
    for _, option := range mount.Options {
        switch option {
        case "ro":
            flags |= unix.MS_RDONLY
        case "noexec":
            flags |= unix.MS_NOEXEC
        case "nosuid":
            flags |= unix.MS_NOSUID
        case "nodev":
            flags |= unix.MS_NODEV
        }
    }

    // 执行挂载
    if err := unix.Mount(mount.Source, mount.Destination, mount.Type, flags, ""); err != nil {
        return fmt.Errorf("failed to mount: %v", err)
    }

    return nil
}

// pivotRoot 切换根目录
func pivotRoot(newroot string) error {
    // 绑定挂载 newroot
    if err := unix.Mount(newroot, newroot, "", unix.MS_BIND|unix.MS_REC, ""); err != nil {
        return fmt.Errorf("failed to bind mount newroot: %v", err)
    }

    // 创建 put_old 目录
    putold := "/.oldroot"
    if err := os.MkdirAll(putold, 0700); err != nil {
        return fmt.Errorf("failed to create put_old directory: %v", err)
    }

    // 执行 pivot_root
    if err := unix.PivotRoot(newroot, putold); err != nil {
        return fmt.Errorf("failed to pivot_root: %v", err)
    }

    // 切换到新根目录
    if err := os.Chdir("/"); err != nil {
        return fmt.Errorf("failed to change working directory: %v", err)
    }

    // 卸载原根目录
    if err := unix.Unmount(putold, unix.MNT_DETACH); err != nil {
        return fmt.Errorf("failed to unmount old root: %v", err)
    }

    // 删除 put_old 目录
    if err := os.RemoveAll(putold); err != nil {
        return fmt.Errorf("failed to remove put_old directory: %v", err)
    }

    return nil
}

package main

import (
    "encoding/json"
    "flag"
    "fmt"
    "io/ioutil"
    "os"
    "os/exec"
    "path/filepath"
    "syscall"
    "golang.org/x/sys/unix"
)

func main() {
    var (
        bundle = flag.String("bundle", "", "Path to OCI bundle")
        action = flag.String("action", "run", "Action to perform")
    )
    flag.Parse()

    if *bundle == "" {
        fmt.Fprintf(os.Stderr, "bundle is required\n")
        os.Exit(1)
    }

    // 加载 OCI 配置
    configPath := filepath.Join(*bundle, "config.json")
    config, err := loadOCIConfig(configPath)
    if err != nil {
        fmt.Fprintf(os.Stderr, "Failed to load config: %v\n", err)
        os.Exit(1)
    }

    // 执行操作
    switch *action {
    case "create":
        err = createContainer(config, *bundle)
    case "start":
        err = startContainer(config, *bundle)
    case "run":
        err = runContainer(config, *bundle)
    case "delete":
        err = deleteContainer(*bundle)
    default:
        fmt.Fprintf(os.Stderr, "Unknown action: %s\n", *action)
        os.Exit(1)
    }

    if err != nil {
        fmt.Fprintf(os.Stderr, "Operation failed: %v\n", err)
        os.Exit(1)
    }
}

// loadOCIConfig 加载 OCI 配置
func loadOCIConfig(configPath string) (*OCIConfig, error) {
    data, err := ioutil.ReadFile(configPath)
    if err != nil {
        return nil, fmt.Errorf("failed to read config file: %v", err)
    }

    var config OCIConfig
    if err := json.Unmarshal(data, &config); err != nil {
        return nil, fmt.Errorf("failed to parse config: %v", err)
    }

    return &config, nil
}

// createContainer 创建容器
func createContainer(config *OCIConfig, bundlePath string) error {
    // 创建容器目录
    containerDir := filepath.Join(bundlePath, "container")
    if err := os.MkdirAll(containerDir, 0755); err != nil {
        return fmt.Errorf("failed to create container directory: %v", err)
    }

    // 创建状态文件
    stateFile := filepath.Join(containerDir, "state.json")
    state := map[string]interface{}{
        "ociVersion": config.OCIVersion,
        "id":         "container-123",
        "status":     "created",
        "bundle":     bundlePath,
        "created":    "2023-01-01T00:00:00Z",
    }

    stateData, err := json.MarshalIndent(state, "", "  ")
    if err != nil {
        return fmt.Errorf("failed to marshal state: %v", err)
    }

    if err := ioutil.WriteFile(stateFile, stateData, 0644); err != nil {
        return fmt.Errorf("failed to write state file: %v", err)
    }

    fmt.Println("Container created successfully")
    return nil
}

// startContainer 启动容器
func startContainer(config *OCIConfig, bundlePath string) error {
    // 创建所有 namespace 的 flags
    flags := syscall.CLONE_NEWUTS |
             syscall.CLONE_NEWPID |
             syscall.CLONE_NEWNS |
             syscall.CLONE_NEWNET |
             syscall.CLONE_NEWIPC |
             syscall.CLONE_NEWUSER |
             syscall.CLONE_NEWCGROUP

    // 准备子进程命令
    cmd := exec.Command("/proc/self/exe", "-bundle", bundlePath, "-action", "child")
    
    // 设置系统调用属性
    cmd.SysProcAttr = &syscall.SysProcAttr{
        Cloneflags: flags,
    }

    // 设置标准输入输出
    cmd.Stdin = os.Stdin
    cmd.Stdout = os.Stdout
    cmd.Stderr = os.Stderr

    // 启动子进程
    if err := cmd.Start(); err != nil {
        return fmt.Errorf("failed to start child process: %v", err)
    }

    // 等待子进程完成
    return cmd.Wait()
}

// runContainer 运行容器
func runContainer(config *OCIConfig, bundlePath string) error {
    // 创建容器
    if err := createContainer(config, bundlePath); err != nil {
        return err
    }

    // 启动容器
    return startContainer(config, bundlePath)
}

// deleteContainer 删除容器
func deleteContainer(bundlePath string) error {
    containerDir := filepath.Join(bundlePath, "container")
    if err := os.RemoveAll(containerDir); err != nil {
        return fmt.Errorf("failed to remove container directory: %v", err)
    }

    fmt.Println("Container deleted successfully")
    return nil
}

// child 子进程入口点
func child(config *OCIConfig, bundlePath string) error {
    // 设置主机名
    if err := unix.Sethostname([]byte(config.Hostname)); err != nil {
        return fmt.Errorf("failed to set hostname: %v", err)
    }

    // 设置工作目录
    if err := os.Chdir(config.Process.Cwd); err != nil {
        return fmt.Errorf("failed to change working directory: %v", err)
    }

    // 挂载文件系统
    for _, mount := range config.Mounts {
        if err := mountFilesystem(mount); err != nil {
            return fmt.Errorf("failed to mount %s: %v", mount.Destination, err)
        }
    }

    // 切换根目录
    rootfsPath := filepath.Join(bundlePath, config.Root.Path)
    if err := pivotRoot(rootfsPath); err != nil {
        return fmt.Errorf("failed to pivot root: %v", err)
    }

    // 执行命令
    if err := syscall.Exec(config.Process.Args[0], config.Process.Args, config.Process.Env); err != nil {
        return fmt.Errorf("failed to exec command: %v", err)
    }

    return nil
}

// mountFilesystem 挂载文件系统
func mountFilesystem(mount struct {
    Destination string   `json:"destination"`
    Type        string   `json:"type"`
    Source      string   `json:"source"`
    Options     []string `json:"options"`
}) error {
    // 创建目标目录
    if err := os.MkdirAll(mount.Destination, 0755); err != nil {
        return fmt.Errorf("failed to create mount point: %v", err)
    }

    // 解析挂载选项
    var flags uintptr
    for _, option := range mount.Options {
        switch option {
        case "ro":
            flags |= unix.MS_RDONLY
        case "noexec":
            flags |= unix.MS_NOEXEC
        case "nosuid":
            flags |= unix.MS_NOSUID
        case "nodev":
            flags |= unix.MS_NODEV
        }
    }

    // 执行挂载
    if err := unix.Mount(mount.Source, mount.Destination, mount.Type, flags, ""); err != nil {
        return fmt.Errorf("failed to mount: %v", err)
    }

    return nil
}

// pivotRoot 切换根目录
func pivotRoot(newroot string) error {
    // 绑定挂载 newroot
    if err := unix.Mount(newroot, newroot, "", unix.MS_BIND|unix.MS_REC, ""); err != nil {
        return fmt.Errorf("failed to bind mount newroot: %v", err)
    }

    // 创建 put_old 目录
    putold := "/.oldroot"
    if err := os.MkdirAll(putold, 0700); err != nil {
        return fmt.Errorf("failed to create put_old directory: %v", err)
    }

    // 执行 pivot_root
    if err := unix.PivotRoot(newroot, putold); err != nil {
        return fmt.Errorf("failed to pivot_root: %v", err)
    }

    // 切换到新根目录
    if err := os.Chdir("/"); err != nil {
        return fmt.Errorf("failed to change working directory: %v", err)
    }

    // 卸载原根目录
    if err := unix.Unmount(putold, unix.MNT_DETACH); err != nil {
        return fmt.Errorf("failed to unmount old root: %v", err)
    }

    // 删除 put_old 目录
    if err := os.RemoveAll(putold); err != nil {
        return fmt.Errorf("failed to remove put_old directory: %v", err)
    }

    return nil
}

package main

import (
    "archive/tar"
    "compress/gzip"
    "crypto/sha256"
    "encoding/json"
    "fmt"
    "io"
    "os"
    "path/filepath"
    "time"
    
    "github.com/opencontainers/image-spec/specs-go/v1"
)

type OCIImageBuilder struct {
    baseDir    string
    layers     []LayerInfo
    config     *v1.Image
    manifest   *v1.Manifest
    index      *v1.Index
}

type LayerInfo struct {
    Path     string
    Digest   string
    Size     int64
    MediaType string
}

func NewOCIImageBuilder(baseDir string) *OCIImageBuilder {
    return &OCIImageBuilder{
        baseDir: baseDir,
        layers:  make([]LayerInfo, 0),
        config:  &v1.Image{},
    }
}

func (b *OCIImageBuilder) AddLayer(layerPath string) error {
    // 计算层摘要
    digest, size, err := b.calculateDigest(layerPath)
    if err != nil {
        return fmt.Errorf("failed to calculate digest: %v", err)
    }
    
    // 压缩层
    compressedPath, err := b.compressLayer(layerPath)
    if err != nil {
        return fmt.Errorf("failed to compress layer: %v", err)
    }
    
    // 更新压缩后的文件大小
    if stat, err := os.Stat(compressedPath); err == nil {
        size = stat.Size()
    }
    
    layer := LayerInfo{
        Path:       compressedPath,
        Digest:     digest,
        Size:       size,
        MediaType:  "application/vnd.oci.image.layer.v1.tar+gzip",
    }
    
    b.layers = append(b.layers, layer)
    return nil
}

func (b *OCIImageBuilder) calculateDigest(filePath string) (string, int64, error) {
    file, err := os.Open(filePath)
    if err != nil {
        return "", 0, err
    }
    defer file.Close()
    
    hasher := sha256.New()
    size, err := io.Copy(hasher, file)
    if err != nil {
        return "", 0, err
    }
    
    digest := fmt.Sprintf("sha256:%x", hasher.Sum(nil))
    return digest, size, nil
}

func (b *OCIImageBuilder) compressLayer(layerPath string) (string, error) {
    compressedPath := layerPath + ".tar.gz"
    
    // 创建压缩文件
    outFile, err := os.Create(compressedPath)
    if err != nil {
        return "", err
    }
    defer outFile.Close()
    
    gzWriter := gzip.NewWriter(outFile)
    defer gzWriter.Close()
    
    tarWriter := tar.NewWriter(gzWriter)
    defer tarWriter.Close()
    
    // 遍历目录并添加到 tar
    return compressedPath, filepath.Walk(layerPath, func(path string, info os.FileInfo, err error) error {
        if err != nil {
            return err
        }
        
        // 创建 tar 头
        header, err := tar.FileInfoHeader(info, "")
        if err != nil {
            return err
        }
        
        // 更新路径
        relPath, err := filepath.Rel(layerPath, path)
        if err != nil {
            return err
        }
        header.Name = relPath
        
        // 写入头
        if err := tarWriter.WriteHeader(header); err != nil {
            return err
        }
        
        // 如果是文件，写入内容
        if !info.IsDir() {
            file, err := os.Open(path)
            if err != nil {
                return err
            }
            defer file.Close()
            
            _, err = io.Copy(tarWriter, file)
            return err
        }
        
        return nil
    })
}

func (b *OCIImageBuilder) BuildConfig(architecture, os string) error {
    // 设置基础配置
    b.config.Architecture = architecture
    b.config.OS = os
    b.config.Created = &v1.Time{Time: time.Now()}
    
    // 设置根文件系统
    b.config.RootFS = v1.RootFS{
        Type:    "layers",
        DiffIDs: make([]v1.Hash, len(b.layers)),
    }
    
    // 计算每层的 diff ID
    for i, layer := range b.layers {
        diffID, err := b.calculateDiffID(layer.Path)
        if err != nil {
            return fmt.Errorf("failed to calculate diff ID for layer %d: %v", i, err)
        }
        b.config.RootFS.DiffIDs[i] = diffID
    }
    
    // 设置历史记录
    b.config.History = make([]v1.History, len(b.layers))
    for i, layer := range b.layers {
        b.config.History[i] = v1.History{
            Created:    &v1.Time{Time: time.Now()},
            CreatedBy:  fmt.Sprintf("layer %d", i),
            EmptyLayer: false,
        }
    }
    
    return nil
}

func (b *OCIImageBuilder) calculateDiffID(layerPath string) (v1.Hash, error) {
    file, err := os.Open(layerPath)
    if err != nil {
        return v1.Hash{}, err
    }
    defer file.Close()
    
    // 解压缩并计算摘要
    gzReader, err := gzip.NewReader(file)
    if err != nil {
        return v1.Hash{}, err
    }
    defer gzReader.Close()
    
    hasher := sha256.New()
    _, err = io.Copy(hasher, gzReader)
    if err != nil {
        return v1.Hash{}, err
    }
    
    return v1.Hash{
        Algorithm: "sha256",
        Hex:       fmt.Sprintf("%x", hasher.Sum(nil)),
    }, nil
}

func (b *OCIImageBuilder) BuildManifest() error {
    // 生成配置摘要
    configDigest, configSize, err := b.saveConfig()
    if err != nil {
        return fmt.Errorf("failed to save config: %v", err)
    }
    
    // 创建清单
    b.manifest = &v1.Manifest{
        Versioned: v1.Versioned{
            SchemaVersion: 2,
        },
        MediaType: "application/vnd.oci.image.manifest.v1+json",
        Config: v1.Descriptor{
            MediaType: "application/vnd.oci.image.config.v1+json",
            Digest:    configDigest,
            Size:      configSize,
        },
        Layers: make([]v1.Descriptor, len(b.layers)),
    }
    
    // 添加层描述符
    for i, layer := range b.layers {
        b.manifest.Layers[i] = v1.Descriptor{
            MediaType: layer.MediaType,
            Digest:    v1.Hash{Algorithm: "sha256", Hex: layer.Digest[7:]}, // 去掉 "sha256:" 前缀
            Size:      layer.Size,
        }
    }
    
    return nil
}

func (b *OCIImageBuilder) saveConfig() (v1.Hash, int64, error) {
    configPath := filepath.Join(b.baseDir, "config.json")
    
    // 序列化配置
    configData, err := json.MarshalIndent(b.config, "", "  ")
    if err != nil {
        return v1.Hash{}, 0, err
    }
    
    // 保存配置
    if err := os.WriteFile(configPath, configData, 0644); err != nil {
        return v1.Hash{}, 0, err
    }
    
    // 计算摘要
    hasher := sha256.New()
    hasher.Write(configData)
    digest := v1.Hash{
        Algorithm: "sha256",
        Hex:       fmt.Sprintf("%x", hasher.Sum(nil)),
    }
    
    return digest, int64(len(configData)), nil
}

func (b *OCIImageBuilder) BuildIndex() error {
    // 生成清单摘要
    manifestDigest, manifestSize, err := b.saveManifest()
    if err != nil {
        return fmt.Errorf("failed to save manifest: %v", err)
    }
    
    // 创建索引
    b.index = &v1.Index{
        Versioned: v1.Versioned{
            SchemaVersion: 2,
        },
        MediaType: "application/vnd.oci.image.index.v1+json",
        Manifests: []v1.Descriptor{
            {
                MediaType: "application/vnd.oci.image.manifest.v1+json",
                Digest:    manifestDigest,
                Size:      manifestSize,
                Platform: &v1.Platform{
                    Architecture: b.config.Architecture,
                    OS:           b.config.OS,
                },
            },
        },
    }
    
    return nil
}

func (b *OCIImageBuilder) saveManifest() (v1.Hash, int64, error) {
    manifestPath := filepath.Join(b.baseDir, "manifest.json")
    
    // 序列化清单
    manifestData, err := json.MarshalIndent(b.manifest, "", "  ")
    if err != nil {
        return v1.Hash{}, 0, err
    }
    
    // 保存清单
    if err := os.WriteFile(manifestPath, manifestData, 0644); err != nil {
        return v1.Hash{}, 0, err
    }
    
    // 计算摘要
    hasher := sha256.New()
    hasher.Write(manifestData)
    digest := v1.Hash{
        Algorithm: "sha256",
        Hex:       fmt.Sprintf("%x", hasher.Sum(nil)),
    }
    
    return digest, int64(len(manifestData)), nil
}

func (b *OCIImageBuilder) Save() error {
    // 保存索引
    indexPath := filepath.Join(b.baseDir, "index.json")
    indexData, err := json.MarshalIndent(b.index, "", "  ")
    if err != nil {
        return fmt.Errorf("failed to marshal index: %v", err)
    }
    
    if err := os.WriteFile(indexPath, indexData, 0644); err != nil {
        return fmt.Errorf("failed to save index: %v", err)
    }
    
    // 移动层文件到 blobs 目录
    blobsDir := filepath.Join(b.baseDir, "blobs", "sha256")
    if err := os.MkdirAll(blobsDir, 0755); err != nil {
        return fmt.Errorf("failed to create blobs directory: %v", err)
    }
    
    for _, layer := range b.layers {
        destPath := filepath.Join(blobsDir, layer.Digest[7:]) // 去掉 "sha256:" 前缀
        if err := os.Rename(layer.Path, destPath); err != nil {
            return fmt.Errorf("failed to move layer %s: %v", layer.Digest, err)
        }
    }
    
    return nil
}

type OCIRuntime struct {
    rootDir    string
    stateDir   string
    configFile string
}

type ContainerState struct {
    ID          string    `json:"id"`
    Status      string    `json:"status"`
    Pid         int       `json:"pid"`
    Bundle      string    `json:"bundle"`
    CreatedAt   time.Time `json:"createdAt"`
    StartedAt   time.Time `json:"startedAt"`
    FinishedAt  time.Time `json:"finishedAt"`
}

func NewOCIRuntime(rootDir, stateDir string) *OCIRuntime {
    return &OCIRuntime{
        rootDir:    rootDir,
        stateDir:   stateDir,
        configFile: "config.json",
    }
}