Summary
extract_files_from_image_non_privileged in iib/workers/tasks/containerized_utils.py extracts each image layer in order with tar.extractall(...) but does not process OCI whiteout entries (.wh.<name> and the opaque-directory marker .wh..wh..opq). Files/directories deleted in an upper layer are therefore resurrected in the merged rootfs.
Impact
Scope is limited: this extraction path is only used on the divergent-tag (throw-away) build path, where no git branch / ORAS artifact exists yet and content is seeded directly from the image. Normal builds (branch exists, ORAS index.db) are unaffected. On a divergent build of an image whose upper layers delete an operator/config or the hidden index.db, the extracted FBC configs (and possibly index.db) could contain stale entries that were actually removed.
Fix direction
When merging layers, honor whiteouts per the OCI image-layer spec:
.wh.<name> → remove <name> from the merged rootfs before applying the rest of the layer..wh..wh..opq in a directory → clear that directory's existing contents from lower layers.- Do not write the whiteout marker files themselves into the merged rootfs.
Add unit coverage for both a regular whiteout and an opaque-dir whiteout.
Context
Deferred from the review of #1378 (index.db namespace / divergent-tag work). Confirmed during that review; tracked separately because it is larger than the correctness fixes shipped there and only affects throw-away divergent builds.
Relevant code: iib/workers/tasks/containerized_utils.py (layer extraction loop, ~lines 109-122).
Summary
extract_files_from_image_non_privilegediniib/workers/tasks/containerized_utils.pyextracts each image layer in order withtar.extractall(...)but does not process OCI whiteout entries (.wh.<name>and the opaque-directory marker.wh..wh..opq). Files/directories deleted in an upper layer are therefore resurrected in the merged rootfs.Impact
Scope is limited: this extraction path is only used on the divergent-tag (throw-away) build path, where no git branch / ORAS artifact exists yet and content is seeded directly from the image. Normal builds (branch exists, ORAS index.db) are unaffected. On a divergent build of an image whose upper layers delete an operator/config or the hidden
index.db, the extracted FBC configs (and possiblyindex.db) could contain stale entries that were actually removed.Fix direction
When merging layers, honor whiteouts per the OCI image-layer spec:
.wh.<name>→ remove<name>from the merged rootfs before applying the rest of the layer..wh..wh..opqin a directory → clear that directory's existing contents from lower layers.Add unit coverage for both a regular whiteout and an opaque-dir whiteout.
Context
Deferred from the review of #1378 (index.db namespace / divergent-tag work). Confirmed during that review; tracked separately because it is larger than the correctness fixes shipped there and only affects throw-away divergent builds.
Relevant code:
iib/workers/tasks/containerized_utils.py(layer extraction loop, ~lines 109-122).