Mount an OCI image read-only into an actor - #2
Open
ronlv10 wants to merge 5 commits into
Open
Conversation
ronlv10
force-pushed
the
actortemplate-image-volume
branch
6 times, most recently
from
August 13, 2026 19:32
ad1714b to
385e8a0
Compare
A volume can name an OCI image; the reference must be digest-pinned and mounted by at least one container. ateapi projects it into the workload spec on its own volume type.
ronlv10
force-pushed
the
actortemplate-image-volume
branch
from
August 13, 2026 20:42
385e8a0 to
776ec1d
Compare
The bundle overlay spec gains ImageVolumes; ateom composes each at ateompath.ImageVolumeMountPath — a bind for one layer, an upperless overlay for several, FinalizeLayer first so whiteouts hold.
resolveImageVolumes pulls each mounted image through the layer cache and records its layers in the overlay spec; the OCI spec binds the composed volume read-only at the declared path.
The micro-VM runtime builds its own guest OCI spec, so image volumes are carried explicitly: ateompb.Container gains image_volume_mounts, staging binds each composed volume into the read-only share beside the rootfs, and the guest re-adds the binds at the declared paths.
A three-layer fixture pushed at test time: every layer visible, an upper layer shadows a lower one, a whiteout hides a file, writes are refused, and the volume survives suspend/resume.
ronlv10
force-pushed
the
actortemplate-image-volume
branch
from
August 13, 2026 21:48
776ec1d to
416ac52
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an
imagesource toActorTemplate'sVolumeSource: a container can mount the contents of an OCI image it does not run. This is how tooling gets into images built by third parties without rebuilding them — for example, an agent binary into a benchmark image.How it works
atelet pulls the image through the existing layer cache and records the volume's layers in the bundle's overlay spec, next to the rootfs layers. ateom composes the volume inside the bundle — the cached layers with no writable layer on top, so the mount is read-only — and the container binds it at the declared path. The volume is composed per container: containers of one actor may mount the same volume, and each gets its own mount point inside its own bundle, all backed by the same shared layers. On resume the volume is re-composed the same way.
References must be digest-pinned, the same rule as container images: a snapshot is only valid against the exact bytes it was taken with.
On micro-VMs the volume rides the same read-only virtio-fs share as the container rootfs: ateom stages each composed volume beside the rootfs on the host, and the guest binds it into the container at the declared path.