From: Mikhail Malyshev <[email protected]>
On Sun, Aug 02, 2026 at 09:00:56PM +0800, Gao Xiang wrote:
> Thanks for the patch and sorry for late reply.
No worries at all -- and sorry for _my_ slow reply, I was on vacation
and only just got back to this.
> Yes, I assume containerd will resolve the directories like this, but as
> a quick reference, could you give some pointer how `tar` utility works
> and `posix` documents this behavior?
Good question, I dug into it a bit.
On the tar side, I tried the exact case (a "lib64 -> usr/lib64" symlink
followed by a "lib64/foo" entry). GNU tar (1.35) and busybox tar (1.37)
both follow the symlink and write the file to usr/lib64/foo, leaving
lib64 as a symlink -- the same result as this patch. bsdtar/libarchive
is the odd one out: it refuses with "Cannot extract through symlink,"
but that is its ARCHIVE_EXTRACT_SECURE_SYMLINKS anti-symlink-attack
default, not a different idea of what the path means.
POSIX-wise it is really just pathname resolution (IEEE Std 1003.1-2017
Base Definitions, 4.13): a symlink in a non-final path component is
followed. GNU/busybox tar create the entry with a plain open(2), so the
kernel resolves lib64/foo to usr/lib64/foo for them; the patch just does
that same resolution by hand, since the tar tree builder has no kernel
to do it.
What really pushed me to fix it, though, is matching the runtime that
actually consumes these images. containerd's walking differ does exactly
this -- it resolves each entry's parent with fs.RootPath ("evaluating and
bounding any symlink to the root directory") and writes to the resolved
target. So today mkfs.erofs --tar and containerd disagree: containerd
converts these layers fine, while mkfs.erofs bails out with -ENOTDIR and
produces the ~2 TiB image, which makes RHEL/UBI/Fedora usr-merge base
layers unconvertible. And since the builder works on an in-memory tree
(with absolute links re-rooted), following them cannot escape the image.
> I plan to release erofs-utils 1.9.3 without this patch soon, and it can
> be addressed in erofs-utils 1.9.4 version.
1.9.4 is totally fine by me. Would you like me to fold these references
(the tar behavior, the POSIX section, and the containerd fs.RootPath
pointer) into the commit message? I am happy to send a v2 with them if
that is easier for you to pick up.
Thanks!
Mikhail
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.