cli: Add container inspect

Prints JSON of container metadata/attributes of interest.

For now this just renders out the kargs embedded in the container
under the kargs.d drop-in.  Future ideas for enhancements would be to
include kernel version and whether or not the image uses a UKI.

Closes: #1827
Signed-off-by: John Eckersberg <[email protected]>

Author: jeckersb

crates/lib/src/cli.rs

@@ -52,6 +52,14 @@ use crate::store::{BootedOstree, ComposefsRepository, Storage};
 use crate::store::{BootedStorage, BootedStorageKind};
 use crate::utils::sigpolicy_from_opt;
 
+/// The result of a `bootc container inspect` command.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub(crate) struct ContainerInspect {
+    /// Kernel arguments embedded in the container image.
+    pub(crate) kargs: Vec<String>,
+}
+
 /// Shared progress options
 #[derive(Debug, Parser, PartialEq, Eq)]
 pub(crate) struct ProgressOptions {
@@ -295,6 +303,12 @@ pub(crate) enum InstallOpts {
 /// Subcommands which can be executed as part of a container build.
 #[derive(Debug, clap::Subcommand, PartialEq, Eq)]
 pub(crate) enum ContainerOpts {
+    /// Output JSON to stdout containing the container image metadata.
+    Inspect {
+        /// Operate on the provided rootfs.
+        #[clap(long, default_value = "/")]
+        rootfs: Utf8PathBuf,
+    },
     /// Perform relatively inexpensive static analysis checks as part of a container
     /// build.
     ///
@@ -1345,6 +1359,14 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
             }
         }
         Opt::Container(opts) => match opts {
+            ContainerOpts::Inspect { rootfs } => {
+                let root = &Dir::open_ambient_dir(&rootfs, cap_std::ambient_authority())?;
+                let kargs = crate::bootc_kargs::get_kargs_in_root(root, std::env::consts::ARCH)?;
+                let kargs: Vec<String> = kargs.iter_str().map(|s| s.to_owned()).collect();
+                let inspect = ContainerInspect { kargs };
+                serde_json::to_writer_pretty(std::io::stdout().lock(), &inspect)?;
+                Ok(())
+            }
             ContainerOpts::Lint {
                 rootfs,
                 fatal_warnings,

tmt/tests/booted/readonly/003-test-container-inspect.nu

@@ -0,0 +1,15 @@
+use std assert
+use tap.nu
+
+tap begin "verify bootc container inspect"
+
+# Run container inspect and parse the JSON output
+let inspect = bootc container inspect | from json
+
+# Verify we get the expected kargs from the test image
+# These are defined in hack/test-kargs/*.toml
+assert ($inspect.kargs | any { |k| $k == "kargsd-test=1" }) "expected kargsd-test=1"
+assert ($inspect.kargs | any { |k| $k == "kargsd-othertest=2" }) "expected kargsd-othertest=2"
+assert ($inspect.kargs | any { |k| $k == "testing-kargsd=3" }) "expected testing-kargsd=3"
+
+tap ok