Skip to content

remove go-archive and bound ADD archive extraction #7034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
crazy-max wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

remove go-archive and bound ADD archive extraction #7034

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
467d8c1
replace go-archive with containerd archive apply
crazy-max Aug 12, 2026
0bad7f4
file: constrain ADD archive extraction with os.Root
crazy-max Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions frontend/dockerfile/dockerfile2llb/epoch.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@ import (
"github.com/moby/buildkit/frontend/dockerui"
gwclient "github.com/moby/buildkit/frontend/gateway/client"
"github.com/moby/buildkit/solver/pb"
"github.com/moby/buildkit/util/archiveutil"
"github.com/moby/buildkit/util/gitutil/gitobject"
archivecompression "github.com/moby/go-archive/compression"
digest "github.com/opencontainers/go-digest"
"github.com/pkg/errors"
)
Expand Down Expand Up @@ -348,7 +348,7 @@ func archiveMaxTimeFromRef(ctx context.Context, ref gwclient.Reference, filename
if err != nil {
return nil, err
}
rc, err := archivecompression.DecompressStream(bytes.NewReader(dt))
rc, err := archiveutil.DecompressStream(bytes.NewReader(dt))
if err != nil {
if allowNonArchive {
return nil, nil
Expand Down
10 changes: 4 additions & 6 deletions frontend/dockerui/context.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ import (
"github.com/moby/buildkit/frontend/gateway/client"
gwpb "github.com/moby/buildkit/frontend/gateway/pb"
"github.com/moby/buildkit/solver/pb"
"github.com/moby/buildkit/util/archiveutil"
"github.com/moby/buildkit/util/gitutil/gitobject"
archivecompression "github.com/moby/go-archive/compression"
"github.com/pkg/errors"
)

Expand Down Expand Up @@ -224,7 +224,7 @@ func archiveMaxTimeFromHTTPArchive(ctx context.Context, bctx *buildContext) (*ti
if err != nil {
return nil, err
}
rc, err := archivecompression.DecompressStream(bytes.NewReader(dt))
rc, err := archiveutil.DecompressStream(bytes.NewReader(dt))
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -339,11 +339,9 @@ func isArchive(header []byte) bool {
{0x42, 0x5A, 0x68}, // bzip2
{0x1F, 0x8B, 0x08}, // gzip
{0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00}, // xz
{0x28, 0xB5, 0x2F, 0xFD}, // zstd

@crazy-max crazy-max Aug 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added zstd to this archive sniffing list because the previous go-archive decompression path already supported zstd archives. Without this magic value, the new decompression helper can handle zstd, but HTTP context archive detection would still fail to classify zstd-compressed tar streams as archives.

} {
if len(header) < len(m) {
continue
}
if bytes.Equal(m, header[:len(m)]) {
if bytes.HasPrefix(header, m) {
return true
}
}
Expand Down
2 changes: 0 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,6 @@ require (
github.com/in-toto/in-toto-golang v0.11.0
github.com/klauspost/compress v1.19.1
github.com/moby/docker-image-spec v1.3.1
github.com/moby/go-archive v0.2.0
github.com/moby/locker v1.0.1
github.com/moby/patternmatcher v0.6.1
github.com/moby/policy-helpers v0.0.0-20260722051018-856be88baec4
Expand Down Expand Up @@ -195,7 +194,6 @@ require (
github.com/in-toto/attestation v1.2.0 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/moby/sys/capability v0.4.0 // indirect
github.com/moby/sys/mount v0.3.5 // indirect
github.com/moby/sys/sequential v0.7.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/oklog/ulid/v2 v2.1.1 // indirect
Expand Down
8 changes: 2 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,8 +418,6 @@ github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyua
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
Expand All @@ -430,8 +428,6 @@ github.com/moby/profiles/seccomp v0.2.3 h1:nrHNSiECQQvq4WjgceCUgJXIXUJBIswVQ133k
github.com/moby/profiles/seccomp v0.2.3/go.mod h1:8m3qkkWZXrRsMqlUUN2zyccnYmBf3EAdQYPMVJ3NBhk=
github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
github.com/moby/sys/mount v0.3.5 h1:eS3fsZTjHaBihwjp4/+5Z3jxqLXYsbwxqpVSfFv3M00=
github.com/moby/sys/mount v0.3.5/go.mod h1:WUQDO+/uCiCIkIztx8SrwIDVn2dtMFRBebRhpDFT71M=
github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
github.com/moby/sys/reexec v0.1.0 h1:RrBi8e0EBTLEgfruBOFcxtElzRGTEUkeIFaVXgU7wok=
Expand Down Expand Up @@ -779,8 +775,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
gotest.tools/v3 v3.5.0 h1:Ljk6PdHdOhAb5aDMWXjDLMMhph+BpztA4v1QdqEW2eY=
gotest.tools/v3 v3.5.0/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
Expand Down
2 changes: 1 addition & 1 deletion solver/llbsolver/file/backend.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,7 +255,7 @@ func docopy(ctx context.Context, src, dest string, action *pb.FileActionCopy, u

for _, s := range m {
if action.AttemptUnpackDockerCompatibility {
if ok, err := unpack(src, s, dest, destPath, ch, u, timestampToTime(action.Timestamp), idmap); err != nil {
if ok, err := unpack(ctx, src, s, dest, destPath, ch, u, timestampToTime(action.Timestamp), idmap); err != nil {
return errors.WithStack(err)
} else if ok {
continue
Expand Down
28 changes: 11 additions & 17 deletions solver/llbsolver/file/unpack.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,18 +2,17 @@ package file

import (
"archive/tar"
"context"
"os"
"time"

"github.com/containerd/continuity/fs"
"github.com/moby/go-archive"
"github.com/moby/go-archive/chrootarchive"
"github.com/moby/go-archive/compression"
"github.com/moby/buildkit/util/archiveutil"
"github.com/moby/sys/user"
copy "github.com/tonistiigi/fsutil/copy"
)

func unpack(srcRoot string, src string, destRoot string, dest string, ch copy.Chowner, u *copy.User, tm *time.Time, idmap *user.IdentityMapping) (bool, error) {
func unpack(ctx context.Context, srcRoot string, src string, destRoot string, dest string, ch copy.Chowner, u *copy.User, tm *time.Time, idmap *user.IdentityMapping) (bool, error) {
src, err := fs.RootPath(srcRoot, src)
if err != nil {
return false, err
Expand All @@ -36,19 +35,14 @@ func unpack(srcRoot string, src string, destRoot string, dest string, ch copy.Ch
}
defer file.Close()

opts := &archive.TarOptions{
BestEffortXattrs: true,
}
if idmap != nil {
opts.IDMap = *idmap
}
if u != nil {
opts.ChownOpts = &archive.ChownOpts{
UID: u.UID,
GID: u.GID,
}
rdr, err := archiveutil.DecompressStream(file)
if err != nil {
return false, err
}
return true, chrootarchive.Untar(file, dest, opts)
defer rdr.Close()

err = applyRootArchive(ctx, dest, rdr, u, idmap, unpackNoSameOwner())
return true, err
}

func isArchivePath(path string) bool {
Expand All @@ -64,7 +58,7 @@ func isArchivePath(path string) bool {
return false
}
defer file.Close()
rdr, err := compression.DecompressStream(file)
rdr, err := archiveutil.DecompressStream(file)
if err != nil {
return false
}
Expand Down
Loading