github.com/wozhu6104/docker@v20.10.10+incompatible/daemon/graphdriver/overlay2/overlay.go (about)

     1  // +build linux
     2  
     3  package overlay2 // import "github.com/docker/docker/daemon/graphdriver/overlay2"
     4  
     5  import (
     6  	"context"
     7  	"errors"
     8  	"fmt"
     9  	"io"
    10  	"io/ioutil"
    11  	"os"
    12  	"path"
    13  	"path/filepath"
    14  	"strconv"
    15  	"strings"
    16  	"sync"
    17  
    18  	"github.com/docker/docker/daemon/graphdriver"
    19  	"github.com/docker/docker/daemon/graphdriver/overlayutils"
    20  	"github.com/docker/docker/pkg/archive"
    21  	"github.com/docker/docker/pkg/chrootarchive"
    22  	"github.com/docker/docker/pkg/containerfs"
    23  	"github.com/docker/docker/pkg/directory"
    24  	"github.com/docker/docker/pkg/fsutils"
    25  	"github.com/docker/docker/pkg/idtools"
    26  	"github.com/docker/docker/pkg/parsers"
    27  	"github.com/docker/docker/pkg/system"
    28  	"github.com/docker/docker/quota"
    29  	units "github.com/docker/go-units"
    30  	"github.com/moby/locker"
    31  	"github.com/moby/sys/mount"
    32  	"github.com/opencontainers/selinux/go-selinux/label"
    33  	"github.com/sirupsen/logrus"
    34  	"golang.org/x/sys/unix"
    35  )
    36  
    37  var (
    38  	// untar defines the untar method
    39  	untar = chrootarchive.UntarUncompressed
    40  )
    41  
    42  // This backend uses the overlay union filesystem for containers
    43  // with diff directories for each layer.
    44  
    45  // This version of the overlay driver requires at least kernel
    46  // 4.0.0 in order to support mounting multiple diff directories.
    47  
    48  // Each container/image has at least a "diff" directory and "link" file.
    49  // If there is also a "lower" file when there are diff layers
    50  // below as well as "merged" and "work" directories. The "diff" directory
    51  // has the upper layer of the overlay and is used to capture any
    52  // changes to the layer. The "lower" file contains all the lower layer
    53  // mounts separated by ":" and ordered from uppermost to lowermost
    54  // layers. The overlay itself is mounted in the "merged" directory,
    55  // and the "work" dir is needed for overlay to work.
    56  
    57  // The "link" file for each layer contains a unique string for the layer.
    58  // Under the "l" directory at the root there will be a symbolic link
    59  // with that unique string pointing the "diff" directory for the layer.
    60  // The symbolic links are used to reference lower layers in the "lower"
    61  // file and on mount. The links are used to shorten the total length
    62  // of a layer reference without requiring changes to the layer identifier
    63  // or root directory. Mounts are always done relative to root and
    64  // referencing the symbolic links in order to ensure the number of
    65  // lower directories can fit in a single page for making the mount
    66  // syscall. A hard upper limit of 128 lower layers is enforced to ensure
    67  // that mounts do not fail due to length.
    68  
    69  const (
    70  	driverName    = "overlay2"
    71  	linkDir       = "l"
    72  	diffDirName   = "diff"
    73  	workDirName   = "work"
    74  	mergedDirName = "merged"
    75  	lowerFile     = "lower"
    76  	maxDepth      = 128
    77  
    78  	// idLength represents the number of random characters
    79  	// which can be used to create the unique link identifier
    80  	// for every layer. If this value is too long then the
    81  	// page size limit for the mount command may be exceeded.
    82  	// The idLength should be selected such that following equation
    83  	// is true (512 is a buffer for label metadata).
    84  	// ((idLength + len(linkDir) + 1) * maxDepth) <= (pageSize - 512)
    85  	idLength = 26
    86  )
    87  
    88  type overlayOptions struct {
    89  	overrideKernelCheck bool
    90  	quota               quota.Quota
    91  }
    92  
    93  // Driver contains information about the home directory and the list of active
    94  // mounts that are created using this driver.
    95  type Driver struct {
    96  	home          string
    97  	uidMaps       []idtools.IDMap
    98  	gidMaps       []idtools.IDMap
    99  	ctr           *graphdriver.RefCounter
   100  	quotaCtl      *quota.Control
   101  	options       overlayOptions
   102  	naiveDiff     graphdriver.DiffDriver
   103  	supportsDType bool
   104  	locker        *locker.Locker
   105  }
   106  
   107  var (
   108  	logger                = logrus.WithField("storage-driver", "overlay2")
   109  	backingFs             = "<unknown>"
   110  	projectQuotaSupported = false
   111  
   112  	useNaiveDiffLock sync.Once
   113  	useNaiveDiffOnly bool
   114  
   115  	indexOff  string
   116  	userxattr string
   117  )
   118  
   119  func init() {
   120  	graphdriver.Register(driverName, Init)
   121  }
   122  
   123  // Init returns the native diff driver for overlay filesystem.
   124  // If overlay filesystem is not supported on the host, the error
   125  // graphdriver.ErrNotSupported is returned.
   126  // If an overlay filesystem is not supported over an existing filesystem then
   127  // the error graphdriver.ErrIncompatibleFS is returned.
   128  func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (graphdriver.Driver, error) {
   129  	opts, err := parseOptions(options)
   130  	if err != nil {
   131  		return nil, err
   132  	}
   133  
   134  	// Perform feature detection on /var/lib/docker/overlay2 if it's an existing directory.
   135  	// This covers situations where /var/lib/docker/overlay2 is a mount, and on a different
   136  	// filesystem than /var/lib/docker.
   137  	// If the path does not exist, fall back to using /var/lib/docker for feature detection.
   138  	testdir := home
   139  	if _, err := os.Stat(testdir); os.IsNotExist(err) {
   140  		testdir = filepath.Dir(testdir)
   141  	}
   142  
   143  	if err := overlayutils.SupportsOverlay(testdir, true); err != nil {
   144  		logger.Error(err)
   145  		return nil, graphdriver.ErrNotSupported
   146  	}
   147  
   148  	fsMagic, err := graphdriver.GetFSMagic(testdir)
   149  	if err != nil {
   150  		return nil, err
   151  	}
   152  	if fsName, ok := graphdriver.FsNames[fsMagic]; ok {
   153  		backingFs = fsName
   154  	}
   155  
   156  	supportsDType, err := fsutils.SupportsDType(testdir)
   157  	if err != nil {
   158  		return nil, err
   159  	}
   160  	if !supportsDType {
   161  		if !graphdriver.IsInitialized(home) {
   162  			return nil, overlayutils.ErrDTypeNotSupported("overlay2", backingFs)
   163  		}
   164  		// allow running without d_type only for existing setups (#27443)
   165  		logger.Warn(overlayutils.ErrDTypeNotSupported("overlay2", backingFs))
   166  	}
   167  
   168  	_, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)
   169  	if err != nil {
   170  		return nil, err
   171  	}
   172  
   173  	cur := idtools.CurrentIdentity()
   174  	dirID := idtools.Identity{
   175  		UID: cur.UID,
   176  		GID: rootGID,
   177  	}
   178  	if err := idtools.MkdirAllAndChown(home, 0710, dirID); err != nil {
   179  		return nil, err
   180  	}
   181  	if err := idtools.MkdirAllAndChown(path.Join(home, linkDir), 0700, cur); err != nil {
   182  		return nil, err
   183  	}
   184  
   185  	d := &Driver{
   186  		home:          home,
   187  		uidMaps:       uidMaps,
   188  		gidMaps:       gidMaps,
   189  		ctr:           graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicOverlay)),
   190  		supportsDType: supportsDType,
   191  		locker:        locker.New(),
   192  		options:       *opts,
   193  	}
   194  
   195  	d.naiveDiff = graphdriver.NewNaiveDiffDriver(d, uidMaps, gidMaps)
   196  
   197  	if backingFs == "xfs" {
   198  		// Try to enable project quota support over xfs.
   199  		if d.quotaCtl, err = quota.NewControl(home); err == nil {
   200  			projectQuotaSupported = true
   201  		} else if opts.quota.Size > 0 {
   202  			return nil, fmt.Errorf("Storage option overlay2.size not supported. Filesystem does not support Project Quota: %v", err)
   203  		}
   204  	} else if opts.quota.Size > 0 {
   205  		// if xfs is not the backing fs then error out if the storage-opt overlay2.size is used.
   206  		return nil, fmt.Errorf("Storage Option overlay2.size only supported for backingFS XFS. Found %v", backingFs)
   207  	}
   208  
   209  	// figure out whether "index=off" option is recognized by the kernel
   210  	_, err = os.Stat("/sys/module/overlay/parameters/index")
   211  	switch {
   212  	case err == nil:
   213  		indexOff = "index=off,"
   214  	case os.IsNotExist(err):
   215  		// old kernel, no index -- do nothing
   216  	default:
   217  		logger.Warnf("Unable to detect whether overlay kernel module supports index parameter: %s", err)
   218  	}
   219  
   220  	needsUserXattr, err := overlayutils.NeedsUserXAttr(home)
   221  	if err != nil {
   222  		logger.Warnf("Unable to detect whether overlay kernel module needs \"userxattr\" parameter: %s", err)
   223  	}
   224  	if needsUserXattr {
   225  		userxattr = "userxattr,"
   226  	}
   227  
   228  	logger.Debugf("backingFs=%s, projectQuotaSupported=%v, indexOff=%q, userxattr=%q",
   229  		backingFs, projectQuotaSupported, indexOff, userxattr)
   230  
   231  	return d, nil
   232  }
   233  
   234  func parseOptions(options []string) (*overlayOptions, error) {
   235  	o := &overlayOptions{}
   236  	for _, option := range options {
   237  		key, val, err := parsers.ParseKeyValueOpt(option)
   238  		if err != nil {
   239  			return nil, err
   240  		}
   241  		key = strings.ToLower(key)
   242  		switch key {
   243  		case "overlay2.override_kernel_check":
   244  			o.overrideKernelCheck, err = strconv.ParseBool(val)
   245  			if err != nil {
   246  				return nil, err
   247  			}
   248  		case "overlay2.size":
   249  			size, err := units.RAMInBytes(val)
   250  			if err != nil {
   251  				return nil, err
   252  			}
   253  			o.quota.Size = uint64(size)
   254  		default:
   255  			return nil, fmt.Errorf("overlay2: unknown option %s", key)
   256  		}
   257  	}
   258  	return o, nil
   259  }
   260  
   261  func useNaiveDiff(home string) bool {
   262  	useNaiveDiffLock.Do(func() {
   263  		if err := doesSupportNativeDiff(home); err != nil {
   264  			logger.Warnf("Not using native diff for overlay2, this may cause degraded performance for building images: %v", err)
   265  			useNaiveDiffOnly = true
   266  		}
   267  	})
   268  	return useNaiveDiffOnly
   269  }
   270  
   271  func (d *Driver) String() string {
   272  	return driverName
   273  }
   274  
   275  // Status returns current driver information in a two dimensional string array.
   276  // Output contains "Backing Filesystem" used in this implementation.
   277  func (d *Driver) Status() [][2]string {
   278  	return [][2]string{
   279  		{"Backing Filesystem", backingFs},
   280  		{"Supports d_type", strconv.FormatBool(d.supportsDType)},
   281  		{"Native Overlay Diff", strconv.FormatBool(!useNaiveDiff(d.home))},
   282  		{"userxattr", strconv.FormatBool(userxattr != "")},
   283  	}
   284  }
   285  
   286  // GetMetadata returns metadata about the overlay driver such as the LowerDir,
   287  // UpperDir, WorkDir, and MergeDir used to store data.
   288  func (d *Driver) GetMetadata(id string) (map[string]string, error) {
   289  	dir := d.dir(id)
   290  	if _, err := os.Stat(dir); err != nil {
   291  		return nil, err
   292  	}
   293  
   294  	metadata := map[string]string{
   295  		"WorkDir":   path.Join(dir, workDirName),
   296  		"MergedDir": path.Join(dir, mergedDirName),
   297  		"UpperDir":  path.Join(dir, diffDirName),
   298  	}
   299  
   300  	lowerDirs, err := d.getLowerDirs(id)
   301  	if err != nil {
   302  		return nil, err
   303  	}
   304  	if len(lowerDirs) > 0 {
   305  		metadata["LowerDir"] = strings.Join(lowerDirs, ":")
   306  	}
   307  
   308  	return metadata, nil
   309  }
   310  
   311  // Cleanup any state created by overlay which should be cleaned when daemon
   312  // is being shutdown. For now, we just have to unmount the bind mounted
   313  // we had created.
   314  func (d *Driver) Cleanup() error {
   315  	return mount.RecursiveUnmount(d.home)
   316  }
   317  
   318  // CreateReadWrite creates a layer that is writable for use as a container
   319  // file system.
   320  func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
   321  	if opts == nil {
   322  		opts = &graphdriver.CreateOpts{
   323  			StorageOpt: make(map[string]string),
   324  		}
   325  	} else if opts.StorageOpt == nil {
   326  		opts.StorageOpt = make(map[string]string)
   327  	}
   328  
   329  	// Merge daemon default config.
   330  	if _, ok := opts.StorageOpt["size"]; !ok && d.options.quota.Size != 0 {
   331  		opts.StorageOpt["size"] = strconv.FormatUint(d.options.quota.Size, 10)
   332  	}
   333  
   334  	if _, ok := opts.StorageOpt["size"]; ok && !projectQuotaSupported {
   335  		return fmt.Errorf("--storage-opt is supported only for overlay over xfs with 'pquota' mount option")
   336  	}
   337  
   338  	return d.create(id, parent, opts)
   339  }
   340  
   341  // Create is used to create the upper, lower, and merge directories required for overlay fs for a given id.
   342  // The parent filesystem is used to configure these directories for the overlay.
   343  func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr error) {
   344  	if opts != nil && len(opts.StorageOpt) != 0 {
   345  		if _, ok := opts.StorageOpt["size"]; ok {
   346  			return fmt.Errorf("--storage-opt size is only supported for ReadWrite Layers")
   347  		}
   348  	}
   349  	return d.create(id, parent, opts)
   350  }
   351  
   352  func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr error) {
   353  	dir := d.dir(id)
   354  
   355  	rootUID, rootGID, err := idtools.GetRootUIDGID(d.uidMaps, d.gidMaps)
   356  	if err != nil {
   357  		return err
   358  	}
   359  	root := idtools.Identity{UID: rootUID, GID: rootGID}
   360  	dirID := idtools.Identity{
   361  		UID: idtools.CurrentIdentity().UID,
   362  		GID: rootGID,
   363  	}
   364  
   365  	if err := idtools.MkdirAllAndChown(path.Dir(dir), 0710, dirID); err != nil {
   366  		return err
   367  	}
   368  	if err := idtools.MkdirAndChown(dir, 0710, dirID); err != nil {
   369  		return err
   370  	}
   371  
   372  	defer func() {
   373  		// Clean up on failure
   374  		if retErr != nil {
   375  			os.RemoveAll(dir)
   376  		}
   377  	}()
   378  
   379  	if opts != nil && len(opts.StorageOpt) > 0 {
   380  		driver := &Driver{}
   381  		if err := d.parseStorageOpt(opts.StorageOpt, driver); err != nil {
   382  			return err
   383  		}
   384  
   385  		if driver.options.quota.Size > 0 {
   386  			// Set container disk quota limit
   387  			if err := d.quotaCtl.SetQuota(dir, driver.options.quota); err != nil {
   388  				return err
   389  			}
   390  		}
   391  	}
   392  
   393  	if err := idtools.MkdirAndChown(path.Join(dir, diffDirName), 0755, root); err != nil {
   394  		return err
   395  	}
   396  
   397  	lid := overlayutils.GenerateID(idLength, logger)
   398  	if err := os.Symlink(path.Join("..", id, diffDirName), path.Join(d.home, linkDir, lid)); err != nil {
   399  		return err
   400  	}
   401  
   402  	// Write link id to link file
   403  	if err := ioutil.WriteFile(path.Join(dir, "link"), []byte(lid), 0644); err != nil {
   404  		return err
   405  	}
   406  
   407  	// if no parent directory, done
   408  	if parent == "" {
   409  		return nil
   410  	}
   411  
   412  	if err := idtools.MkdirAndChown(path.Join(dir, workDirName), 0700, root); err != nil {
   413  		return err
   414  	}
   415  
   416  	if err := ioutil.WriteFile(path.Join(d.dir(parent), "committed"), []byte{}, 0600); err != nil {
   417  		return err
   418  	}
   419  
   420  	lower, err := d.getLower(parent)
   421  	if err != nil {
   422  		return err
   423  	}
   424  	if lower != "" {
   425  		if err := ioutil.WriteFile(path.Join(dir, lowerFile), []byte(lower), 0666); err != nil {
   426  			return err
   427  		}
   428  	}
   429  
   430  	return nil
   431  }
   432  
   433  // Parse overlay storage options
   434  func (d *Driver) parseStorageOpt(storageOpt map[string]string, driver *Driver) error {
   435  	// Read size to set the disk project quota per container
   436  	for key, val := range storageOpt {
   437  		key := strings.ToLower(key)
   438  		switch key {
   439  		case "size":
   440  			size, err := units.RAMInBytes(val)
   441  			if err != nil {
   442  				return err
   443  			}
   444  			driver.options.quota.Size = uint64(size)
   445  		default:
   446  			return fmt.Errorf("Unknown option %s", key)
   447  		}
   448  	}
   449  
   450  	return nil
   451  }
   452  
   453  func (d *Driver) getLower(parent string) (string, error) {
   454  	parentDir := d.dir(parent)
   455  
   456  	// Ensure parent exists
   457  	if _, err := os.Lstat(parentDir); err != nil {
   458  		return "", err
   459  	}
   460  
   461  	// Read Parent link fileA
   462  	parentLink, err := ioutil.ReadFile(path.Join(parentDir, "link"))
   463  	if err != nil {
   464  		return "", err
   465  	}
   466  	lowers := []string{path.Join(linkDir, string(parentLink))}
   467  
   468  	parentLower, err := ioutil.ReadFile(path.Join(parentDir, lowerFile))
   469  	if err == nil {
   470  		parentLowers := strings.Split(string(parentLower), ":")
   471  		lowers = append(lowers, parentLowers...)
   472  	}
   473  	if len(lowers) > maxDepth {
   474  		return "", errors.New("max depth exceeded")
   475  	}
   476  	return strings.Join(lowers, ":"), nil
   477  }
   478  
   479  func (d *Driver) dir(id string) string {
   480  	return path.Join(d.home, id)
   481  }
   482  
   483  func (d *Driver) getLowerDirs(id string) ([]string, error) {
   484  	var lowersArray []string
   485  	lowers, err := ioutil.ReadFile(path.Join(d.dir(id), lowerFile))
   486  	if err == nil {
   487  		for _, s := range strings.Split(string(lowers), ":") {
   488  			lp, err := os.Readlink(path.Join(d.home, s))
   489  			if err != nil {
   490  				return nil, err
   491  			}
   492  			lowersArray = append(lowersArray, path.Clean(path.Join(d.home, linkDir, lp)))
   493  		}
   494  	} else if !os.IsNotExist(err) {
   495  		return nil, err
   496  	}
   497  	return lowersArray, nil
   498  }
   499  
   500  // Remove cleans the directories that are created for this id.
   501  func (d *Driver) Remove(id string) error {
   502  	if id == "" {
   503  		return fmt.Errorf("refusing to remove the directories: id is empty")
   504  	}
   505  	d.locker.Lock(id)
   506  	defer d.locker.Unlock(id)
   507  	dir := d.dir(id)
   508  	lid, err := ioutil.ReadFile(path.Join(dir, "link"))
   509  	if err == nil {
   510  		if len(lid) == 0 {
   511  			logger.Errorf("refusing to remove empty link for layer %v", id)
   512  		} else if err := os.RemoveAll(path.Join(d.home, linkDir, string(lid))); err != nil {
   513  			logger.Debugf("Failed to remove link: %v", err)
   514  		}
   515  	}
   516  
   517  	if err := system.EnsureRemoveAll(dir); err != nil && !os.IsNotExist(err) {
   518  		return err
   519  	}
   520  	return nil
   521  }
   522  
   523  // Get creates and mounts the required file system for the given id and returns the mount path.
   524  func (d *Driver) Get(id, mountLabel string) (_ containerfs.ContainerFS, retErr error) {
   525  	d.locker.Lock(id)
   526  	defer d.locker.Unlock(id)
   527  	dir := d.dir(id)
   528  	if _, err := os.Stat(dir); err != nil {
   529  		return nil, err
   530  	}
   531  
   532  	diffDir := path.Join(dir, diffDirName)
   533  	lowers, err := ioutil.ReadFile(path.Join(dir, lowerFile))
   534  	if err != nil {
   535  		// If no lower, just return diff directory
   536  		if os.IsNotExist(err) {
   537  			return containerfs.NewLocalContainerFS(diffDir), nil
   538  		}
   539  		return nil, err
   540  	}
   541  
   542  	mergedDir := path.Join(dir, mergedDirName)
   543  	if count := d.ctr.Increment(mergedDir); count > 1 {
   544  		return containerfs.NewLocalContainerFS(mergedDir), nil
   545  	}
   546  	defer func() {
   547  		if retErr != nil {
   548  			if c := d.ctr.Decrement(mergedDir); c <= 0 {
   549  				if mntErr := unix.Unmount(mergedDir, 0); mntErr != nil {
   550  					logger.Errorf("error unmounting %v: %v", mergedDir, mntErr)
   551  				}
   552  				// Cleanup the created merged directory; see the comment in Put's rmdir
   553  				if rmErr := unix.Rmdir(mergedDir); rmErr != nil && !os.IsNotExist(rmErr) {
   554  					logger.Debugf("Failed to remove %s: %v: %v", id, rmErr, err)
   555  				}
   556  			}
   557  		}
   558  	}()
   559  
   560  	workDir := path.Join(dir, workDirName)
   561  	splitLowers := strings.Split(string(lowers), ":")
   562  	absLowers := make([]string, len(splitLowers))
   563  	for i, s := range splitLowers {
   564  		absLowers[i] = path.Join(d.home, s)
   565  	}
   566  	var readonly bool
   567  	if _, err := os.Stat(path.Join(dir, "committed")); err == nil {
   568  		readonly = true
   569  	} else if !os.IsNotExist(err) {
   570  		return nil, err
   571  	}
   572  
   573  	var opts string
   574  	if readonly {
   575  		opts = indexOff + userxattr + "lowerdir=" + diffDir + ":" + strings.Join(absLowers, ":")
   576  	} else {
   577  		opts = indexOff + userxattr + "lowerdir=" + strings.Join(absLowers, ":") + ",upperdir=" + diffDir + ",workdir=" + workDir
   578  	}
   579  
   580  	mountData := label.FormatMountLabel(opts, mountLabel)
   581  	mount := unix.Mount
   582  	mountTarget := mergedDir
   583  
   584  	rootUID, rootGID, err := idtools.GetRootUIDGID(d.uidMaps, d.gidMaps)
   585  	if err != nil {
   586  		return nil, err
   587  	}
   588  	if err := idtools.MkdirAndChown(mergedDir, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {
   589  		return nil, err
   590  	}
   591  
   592  	pageSize := unix.Getpagesize()
   593  
   594  	// Use relative paths and mountFrom when the mount data has exceeded
   595  	// the page size. The mount syscall fails if the mount data cannot
   596  	// fit within a page and relative links make the mount data much
   597  	// smaller at the expense of requiring a fork exec to chroot.
   598  	if len(mountData) > pageSize-1 {
   599  		if readonly {
   600  			opts = indexOff + userxattr + "lowerdir=" + path.Join(id, diffDirName) + ":" + string(lowers)
   601  		} else {
   602  			opts = indexOff + userxattr + "lowerdir=" + string(lowers) + ",upperdir=" + path.Join(id, diffDirName) + ",workdir=" + path.Join(id, workDirName)
   603  		}
   604  		mountData = label.FormatMountLabel(opts, mountLabel)
   605  		if len(mountData) > pageSize-1 {
   606  			return nil, fmt.Errorf("cannot mount layer, mount label too large %d", len(mountData))
   607  		}
   608  
   609  		mount = func(source string, target string, mType string, flags uintptr, label string) error {
   610  			return mountFrom(d.home, source, target, mType, flags, label)
   611  		}
   612  		mountTarget = path.Join(id, mergedDirName)
   613  	}
   614  
   615  	if err := mount("overlay", mountTarget, "overlay", 0, mountData); err != nil {
   616  		return nil, fmt.Errorf("error creating overlay mount to %s: %v", mergedDir, err)
   617  	}
   618  
   619  	if !readonly {
   620  		// chown "workdir/work" to the remapped root UID/GID. Overlay fs inside a
   621  		// user namespace requires this to move a directory from lower to upper.
   622  		if err := os.Chown(path.Join(workDir, workDirName), rootUID, rootGID); err != nil {
   623  			return nil, err
   624  		}
   625  	}
   626  
   627  	return containerfs.NewLocalContainerFS(mergedDir), nil
   628  }
   629  
   630  // Put unmounts the mount path created for the give id.
   631  // It also removes the 'merged' directory to force the kernel to unmount the
   632  // overlay mount in other namespaces.
   633  func (d *Driver) Put(id string) error {
   634  	d.locker.Lock(id)
   635  	defer d.locker.Unlock(id)
   636  	dir := d.dir(id)
   637  	_, err := ioutil.ReadFile(path.Join(dir, lowerFile))
   638  	if err != nil {
   639  		// If no lower, no mount happened and just return directly
   640  		if os.IsNotExist(err) {
   641  			return nil
   642  		}
   643  		return err
   644  	}
   645  
   646  	mountpoint := path.Join(dir, mergedDirName)
   647  	if count := d.ctr.Decrement(mountpoint); count > 0 {
   648  		return nil
   649  	}
   650  	if err := unix.Unmount(mountpoint, unix.MNT_DETACH); err != nil {
   651  		logger.Debugf("Failed to unmount %s overlay: %s - %v", id, mountpoint, err)
   652  	}
   653  	// Remove the mountpoint here. Removing the mountpoint (in newer kernels)
   654  	// will cause all other instances of this mount in other mount namespaces
   655  	// to be unmounted. This is necessary to avoid cases where an overlay mount
   656  	// that is present in another namespace will cause subsequent mounts
   657  	// operations to fail with ebusy.  We ignore any errors here because this may
   658  	// fail on older kernels which don't have
   659  	// torvalds/linux@8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe applied.
   660  	if err := unix.Rmdir(mountpoint); err != nil && !os.IsNotExist(err) {
   661  		logger.Debugf("Failed to remove %s overlay: %v", id, err)
   662  	}
   663  	return nil
   664  }
   665  
   666  // Exists checks to see if the id is already mounted.
   667  func (d *Driver) Exists(id string) bool {
   668  	_, err := os.Stat(d.dir(id))
   669  	return err == nil
   670  }
   671  
   672  // isParent determines whether the given parent is the direct parent of the
   673  // given layer id
   674  func (d *Driver) isParent(id, parent string) bool {
   675  	lowers, err := d.getLowerDirs(id)
   676  	if err != nil {
   677  		return false
   678  	}
   679  	if parent == "" && len(lowers) > 0 {
   680  		return false
   681  	}
   682  
   683  	parentDir := d.dir(parent)
   684  	var ld string
   685  	if len(lowers) > 0 {
   686  		ld = filepath.Dir(lowers[0])
   687  	}
   688  	if ld == "" && parent == "" {
   689  		return true
   690  	}
   691  	return ld == parentDir
   692  }
   693  
   694  // ApplyDiff applies the new layer into a root
   695  func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64, err error) {
   696  	if useNaiveDiff(d.home) || !d.isParent(id, parent) {
   697  		return d.naiveDiff.ApplyDiff(id, parent, diff)
   698  	}
   699  
   700  	// never reach here if we are running in UserNS
   701  	applyDir := d.getDiffPath(id)
   702  
   703  	logger.Debugf("Applying tar in %s", applyDir)
   704  	// Overlay doesn't need the parent id to apply the diff
   705  	if err := untar(diff, applyDir, &archive.TarOptions{
   706  		UIDMaps:        d.uidMaps,
   707  		GIDMaps:        d.gidMaps,
   708  		WhiteoutFormat: archive.OverlayWhiteoutFormat,
   709  	}); err != nil {
   710  		return 0, err
   711  	}
   712  
   713  	return directory.Size(context.TODO(), applyDir)
   714  }
   715  
   716  func (d *Driver) getDiffPath(id string) string {
   717  	dir := d.dir(id)
   718  
   719  	return path.Join(dir, diffDirName)
   720  }
   721  
   722  // DiffSize calculates the changes between the specified id
   723  // and its parent and returns the size in bytes of the changes
   724  // relative to its base filesystem directory.
   725  func (d *Driver) DiffSize(id, parent string) (size int64, err error) {
   726  	if useNaiveDiff(d.home) || !d.isParent(id, parent) {
   727  		return d.naiveDiff.DiffSize(id, parent)
   728  	}
   729  	return directory.Size(context.TODO(), d.getDiffPath(id))
   730  }
   731  
   732  // Diff produces an archive of the changes between the specified
   733  // layer and its parent layer which may be "".
   734  func (d *Driver) Diff(id, parent string) (io.ReadCloser, error) {
   735  	if useNaiveDiff(d.home) || !d.isParent(id, parent) {
   736  		return d.naiveDiff.Diff(id, parent)
   737  	}
   738  
   739  	// never reach here if we are running in UserNS
   740  	diffPath := d.getDiffPath(id)
   741  	logger.Debugf("Tar with options on %s", diffPath)
   742  	return archive.TarWithOptions(diffPath, &archive.TarOptions{
   743  		Compression:    archive.Uncompressed,
   744  		UIDMaps:        d.uidMaps,
   745  		GIDMaps:        d.gidMaps,
   746  		WhiteoutFormat: archive.OverlayWhiteoutFormat,
   747  	})
   748  }
   749  
   750  // Changes produces a list of changes between the specified layer and its
   751  // parent layer. If parent is "", then all changes will be ADD changes.
   752  func (d *Driver) Changes(id, parent string) ([]archive.Change, error) {
   753  	return d.naiveDiff.Changes(id, parent)
   754  }