Repository navigation
Conversation
cvas22
changed the title
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused fix has relevant regression coverage and no identified blocking issues; tests were not executed.
No open issues 🎉
What changed in this PR
Fixes staged-layer detection so child mounts do not cause the unpacker to skip layers above nix-snapshotter images, addressing #14367.
Changes:
- Inspect the last root mount, ignoring child mounts.
- Add regression cases for child mounts, explicit root targets, and missing root mounts.
| File | Description |
|---|---|
| core/unpack/unpacker.go | Restricts staged-layer detection to root mounts and updates documentation. |
| core/unpack/unpacker_test.go | Adds regression coverage for mount-target handling. |
Review effort: Balanced
cvas22
force-pushed
the
fix/14367-unpack-staged-child-mounts
branch
from
October 17, 2026 15:42
0bb97f9 to
df3d89a
Compare
isStaged decides whether Prepare already staged a layer by checking whether the last mount returned by the snapshotter is read-only. Some snapshotters append child mounts after the rootfs mount, using mount.Target to place them on a subdirectory of the root. For example, nix-snapshotter appends a read-only bind mount for every Nix store path after the writable overlay mount. With such snapshotters the last mount is a read-only child mount, so the unpacker wrongly treated every layer as already staged and skipped fetching and applying it. Any layer stacked on top of a nix-snapshotter layer silently disappeared from the unpacked rootfs. Only the last mount without a Target (or with "/" as Target) describes the root, so inspect that one and skip child mounts. Fixes containerd#14367 Signed-off-by: Srinivas Chippagiri <cvas22@gmail.com>
cvas22
force-pushed
the
fix/14367-unpack-staged-child-mounts
branch
from
October 17, 2026 15:44
df3d89a to
b7d5c09
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
isStageddecides whetherPreparealready staged a layer by checking whether the last mount returned by the snapshotter is read-only. Some snapshotters append child mounts after the rootfs mount, usingmount.Targetto place them on a subdirectory of the root. For example, nix-snapshotter appends a read-only bind mount for every Nix store path after the writable overlay mount.With such snapshotters the last mount is a read-only child mount, so the unpacker wrongly treated every layer as already staged and skipped fetching and applying it. Any layer stacked on top of a nix-snapshotter layer silently disappeared from the unpacked rootfs.
Only the last mount without a
Target(or with"/"asTarget) describes the root, so inspect that one and skip child mounts.Fixes #14367
This change was prepared with the help of an AI coding assistant; I have reviewed and tested it.