yesBad/pve-storage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

api: oci image pull: pull OCI image to temporary file

Browse Source 
Pull the OCI image to a temporary file first. Once it has finished,
rename it, which is an atomic operation. This prevents accidental usage
of an incomplete OCI image file for container creation.

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
Link: https://lore.proxmox.com/20251117171528.262443-2-f.schauer@proxmox.com
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Filip Schauer
2025-11-17 18:13:14 +01:00
committed by Thomas Lamprecht
parent 60a80163e0
commit fe3b2915f2
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/PVE/API2/Storage/Status.pm
View File

@ -959,14 +959,26 @@ __PACKAGE__->register_method({
die "storage '$storage' is not configured for content-type 'vztmpl'\n" die "storage '$storage' is not configured for content-type 'vztmpl'\n"
if !$scfg->{content}->{vztmpl}; if !$scfg->{content}->{vztmpl};
my $filename = PVE::Storage::normalize_content_filename($reference); my $filename = PVE::Storage::normalize_content_filename($reference) . ".tar";
my $tmp_filename = "$filename.tmp.$$";
my $path = PVE::Storage::get_vztmpl_dir($cfg, $storage); my $path = PVE::Storage::get_vztmpl_dir($cfg, $storage);
PVE::Storage::activate_storage($cfg, $storage); PVE::Storage::activate_storage($cfg, $storage);
local $SIG{INT} = sub {
unlink "$path/$tmp_filename"
or warn "could not cleanup temporary file: $!"
if -e "$path/$tmp_filename";
die "got interrupted by signal\n";
};
my $worker = sub { my $worker = sub {
PVE::Tools::run_command( PVE::Tools::run_command(
["skopeo", "copy", "docker://$reference", "oci-archive:$path/$filename.tar"], [
"skopeo", "copy", "docker://$reference", "oci-archive:$path/$tmp_filename",
],
); );
rename("$path/$tmp_filename", "$path/$filename")
or die "unable to rename temporary file: $!\n";
}; };
my $worker_id = PVE::Tools::encode_text($filename); # must not pass : or the like as w-ID my $worker_id = PVE::Tools::encode_text($filename); # must not pass : or the like as w-ID