bt-layer: layer tarballs drop sparseness and POSIX ACLs #19

New issue

Open

opened 2026-10-07 22:53:39 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-07 22:53:39 -03:00

(Migrated from github.com)

layer_tar_flags packs layers without --sparse and without --acls, and its --xattrs-include keeps only trusted.overlay.* and security.capability. As a result:

a sparse file in a layer is stored at its full size, and unpacks as a dense file;
POSIX ACLs (system.posix_acl_access, system.posix_acl_default) and every other xattr are dropped, so a file that relies on an ACL loses it in the image.

Both predate the delta-layer fix in #18; the review of that PR found them. Nothing shipped today is known to depend on either, but there is no check for it. Fixing this means choosing the flags, keeping the tarball byte-reproducible, and adding a test with a sparse file and an ACL'd file in a layer.

`layer_tar_flags` packs layers without `--sparse` and without `--acls`, and its `--xattrs-include` keeps only `trusted.overlay.*` and `security.capability`. As a result: - a sparse file in a layer is stored at its full size, and unpacks as a dense file; - POSIX ACLs (`system.posix_acl_access`, `system.posix_acl_default`) and every other xattr are dropped, so a file that relies on an ACL loses it in the image. Both predate the delta-layer fix in #18; the review of that PR found them. Nothing shipped today is known to depend on either, but there is no check for it. Fixing this means choosing the flags, keeping the tarball byte-reproducible, and adding a test with a sparse file and an ACL'd file in a layer.