Move leftover os.WriteFile and os.ReadFile to filesystem

apostasie · apostasie · commit 5827adbe6c94 · 2025-06-21T15:32:30.000-07:00
Signed-off-by: apostasie &lt;spam_blackhole@farcloser.world&gt;
diff --git a/.golangci.yml b/.golangci.yml
@@ -48,6 +48,9 @@ linters:
         - pattern: ^os\.WriteFile.*$
           pkg: github.com/containerd/nerdctl/v2/pkg
           msg: os.WriteFile is neither atomic nor durable - use nerdctl filesystem.WriteFile instead
+        - pattern: ^os\.ReadFile.*$
+          pkg: github.com/containerd/nerdctl/v2/pkg
+          msg: use filesystem.ReadFile instead of os.ReadFile
     staticcheck:
       checks:
         # Below is the default set
diff --git a/pkg/apparmorutil/apparmorutil_linux.go b/pkg/apparmorutil/apparmorutil_linux.go
@@ -26,6 +26,8 @@ import (
 	"github.com/moby/sys/userns"
 
 	"github.com/containerd/log"
+
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 )
 
 var (
@@ -55,7 +57,7 @@ func hostSupports() bool {
 			return
 		}
 		var buf []byte
-		buf, err = os.ReadFile("/sys/module/apparmor/parameters/enabled")
+		buf, err = filesystem.ReadFile("/sys/module/apparmor/parameters/enabled")
 		appArmorSupported = err == nil && len(buf) == 2 && string(buf) == "Y\n"
 	})
 	return appArmorSupported
@@ -88,7 +90,7 @@ var (
 // Related: https://gitlab.com/apparmor/apparmor/-/blob/v3.0.3/libraries/libapparmor/src/kernel.c#L311
 func CanApplyExistingProfile() bool {
 	paramEnabledOnce.Do(func() {
-		buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled")
+		buf, err := filesystem.ReadFile("/sys/module/apparmor/parameters/enabled")
 		paramEnabled = err == nil && len(buf) == 2 && string(buf) == "Y\n"
 	})
 	return paramEnabled
@@ -132,7 +134,7 @@ func Profiles() ([]Profile, error) {
 	res := make([]Profile, len(ents))
 	for i, ent := range ents {
 		namePath := filepath.Join(profilesPath, ent.Name(), "name")
-		b, err := os.ReadFile(namePath)
+		b, err := filesystem.ReadFile(namePath)
 		if err != nil {
 			log.L.WithError(err).Warnf("failed to read %q", namePath)
 			continue
diff --git a/pkg/buildkitutil/buildkitutil.go b/pkg/buildkitutil/buildkitutil.go
@@ -39,6 +39,7 @@ import (
 
 	"github.com/containerd/log"
 
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 )
 
@@ -196,11 +197,11 @@ func BuildKitFile(dir, inputfile string) (absDir string, file string, err error)
 		_, cErr := os.Lstat(filepath.Join(absDir, ContainerfileName))
 		if dErr == nil && cErr == nil {
 			// both files exist, prefer Dockerfile.
-			dockerfile, err := os.ReadFile(filepath.Join(absDir, DefaultDockerfileName))
+			dockerfile, err := filesystem.ReadFile(filepath.Join(absDir, DefaultDockerfileName))
 			if err != nil {
 				return "", "", err
 			}
-			containerfile, err := os.ReadFile(filepath.Join(absDir, ContainerfileName))
+			containerfile, err := filesystem.ReadFile(filepath.Join(absDir, ContainerfileName))
 			if err != nil {
 				return "", "", err
 			}
diff --git a/pkg/cmd/builder/build.go b/pkg/cmd/builder/build.go
@@ -467,7 +467,7 @@ func generateBuildctlArgs(ctx context.Context, client *containerd.Client, option
 }
 
 func getDigestFromMetaFile(path string) (string, error) {
-	data, err := os.ReadFile(path)
+	data, err := filesystem.ReadFile(path)
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/composer/create.go b/pkg/composer/create.go
@@ -29,6 +29,7 @@ import (
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/composer/serviceparser"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
 )
 
@@ -208,7 +209,7 @@ func (c *Composer) createServiceContainer(ctx context.Context, service *servicep
 		return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)
 	}
 
-	cid, err := os.ReadFile(cidFilename)
+	cid, err := filesystem.ReadFile(cidFilename)
 	if err != nil {
 		return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)
 	}
diff --git a/pkg/composer/up_service.go b/pkg/composer/up_service.go
@@ -31,6 +31,7 @@ import (
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/composer/serviceparser"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
 )
 
@@ -198,7 +199,7 @@ func (c *Composer) upServiceContainer(ctx context.Context, service *serviceparse
 		return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)
 	}
 
-	cid, err := os.ReadFile(cidFilename)
+	cid, err := filesystem.ReadFile(cidFilename)
 	if err != nil {
 		return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)
 	}
diff --git a/pkg/containerutil/container_network_manager.go b/pkg/containerutil/container_network_manager.go
@@ -686,7 +686,7 @@ func (m *hostNetworkManager) ContainerNetworkingOpts(_ context.Context, containe
 		return nil, nil, err
 	}
 
-	content, err := os.ReadFile("/etc/hosts")
+	content, err := filesystem.ReadFile("/etc/hosts")
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/pkg/dnsutil/hostsstore/hostsstore.go b/pkg/dnsutil/hostsstore/hostsstore.go
@@ -352,14 +352,7 @@ func (x *hostsStore) updateAllHosts() (err error) {
 			return err
 		}
 
-		// Because the file is mounted, we cannot do atomic writes here as that would change inode.
-		// The practical implications of this are that a partial / interrupted write would leave the hosts file with
-		// an invalid entry and/or missing entries. At worse, this would lead to a container losing localhost network
-		// capabilities.
-		// Proper consistency requires that we would have a rollback mechanism in case of recoverable failure,
-		// and a disaster management / cleanup mechanism, presumably at the top-level of the operation.
-		// nolint:forbidigo
-		err = os.WriteFile(loc, buf.Bytes(), 0o644)
+		err = filesystem.WriteFile(loc, buf.Bytes(), 0o644)
 		if err != nil {
 			log.L.WithError(err).Errorf("failed to write hosts file for %q", entry)
 		}
diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
@@ -142,7 +142,7 @@ func LoadLogConfig(dataStore, ns, id string) (LogConfig, error) {
 	logConfig := LogConfig{}
 
 	logConfigFilePath := LogConfigFilePath(dataStore, ns, id)
-	logConfigData, err := os.ReadFile(logConfigFilePath)
+	logConfigData, err := filesystem.ReadFile(logConfigFilePath)
 	if err != nil {
 		return logConfig, fmt.Errorf("failed to read log config file %q: %w", logConfigFilePath, err)
 	}
diff --git a/pkg/netutil/netutil.go b/pkg/netutil/netutil.go
@@ -37,6 +37,7 @@ import (
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
 	"github.com/containerd/nerdctl/v2/pkg/netutil/nettype"
 	subnetutil "github.com/containerd/nerdctl/v2/pkg/netutil/subnet"
@@ -481,7 +482,7 @@ func cniLoad(fileNames []string) (configList []*NetworkConfig, err error) {
 
 	for _, fileName = range fileNames {
 		var bytes []byte
-		bytes, err = os.ReadFile(fileName)
+		bytes, err = filesystem.ReadFile(fileName)
 		if err != nil {
 			return nil, fmt.Errorf("error reading %s: %w", fileName, err)
 		}
diff --git a/pkg/resolvconf/resolvconf.go b/pkg/resolvconf/resolvconf.go
@@ -72,7 +72,7 @@ var (
 // More information at https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html#/etc/resolv.conf
 func Path() string {
 	detectSystemdResolvConfOnce.Do(func() {
-		candidateResolvConf, err := os.ReadFile(defaultPath)
+		candidateResolvConf, err := filesystem.ReadFile(defaultPath)
 		if err != nil {
 			// silencing error as it will resurface at next calls trying to read defaultPath
 			return
@@ -133,7 +133,7 @@ func Get() (*File, error) {
 
 // GetSpecific returns the contents of the user specified resolv.conf file and its hash
 func GetSpecific(path string) (*File, error) {
-	resolv, err := os.ReadFile(path)
+	resolv, err := filesystem.ReadFile(path)
 	if err != nil {
 		return nil, err
 	}
@@ -151,7 +151,7 @@ func GetIfChanged() (*File, error) {
 	lastModified.Lock()
 	defer lastModified.Unlock()
 
-	resolv, err := os.ReadFile(Path())
+	resolv, err := filesystem.ReadFile(Path())
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/resolvconf/resolvconf_linux_test.go b/pkg/resolvconf/resolvconf_linux_test.go
@@ -21,14 +21,16 @@ import (
 	"bytes"
 	"os"
 	"testing"
+
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 )
 
 func TestGet(t *testing.T) {
 	resolvConfUtils, err := Get()
 	if err != nil {
 		t.Fatal(err)
 	}
-	resolvConfSystem, err := os.ReadFile("/run/systemd/resolve/resolv.conf")
+	resolvConfSystem, err := filesystem.ReadFile("/run/systemd/resolve/resolv.conf")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -171,7 +173,7 @@ func TestBuild(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	content, err := os.ReadFile(file.Name())
+	content, err := filesystem.ReadFile(file.Name())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -193,7 +195,7 @@ func TestBuildWithZeroLengthDomainSearch(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	content, err := os.ReadFile(file.Name())
+	content, err := filesystem.ReadFile(file.Name())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -218,7 +220,7 @@ func TestBuildWithNoOptions(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	content, err := os.ReadFile(file.Name())
+	content, err := filesystem.ReadFile(file.Name())
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/rootlessutil/parent_linux.go b/pkg/rootlessutil/parent_linux.go
@@ -27,6 +27,8 @@ import (
 	"syscall"
 
 	"github.com/containerd/log"
+
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 )
 
 func IsRootlessParent() bool {
@@ -55,7 +57,7 @@ func RootlessKitChildPid(stateDir string) (int, error) {
 		return 0, err
 	}
 
-	pidFileBytes, err := os.ReadFile(pidFilePath)
+	pidFileBytes, err := filesystem.ReadFile(pidFilePath)
 	if err != nil {
 		return 0, err
 	}
diff --git a/pkg/store/filestore.go b/pkg/store/filestore.go
@@ -138,7 +138,7 @@ func (vs *fileStore) Get(key ...string) ([]byte, error) {
 		return nil, errors.Join(ErrFaultyImplementation, fmt.Errorf("%q is a directory and cannot be read as a file", path))
 	}
 
-	content, err := os.ReadFile(filepath.Join(append([]string{vs.dir}, key...)...))
+	content, err := filesystem.ReadFile(filepath.Join(append([]string{vs.dir}, key...)...))
 	if err != nil {
 		return nil, errors.Join(ErrSystemFailure, err)
 	}
diff --git a/pkg/testutil/compose.go b/pkg/testutil/compose.go
@@ -75,7 +75,7 @@ func LoadProject(fileName, projectName string, envMap map[string]string) (*compo
 	if envMap == nil {
 		envMap = make(map[string]string)
 	}
-	b, err := os.ReadFile(fileName)
+	b, err := filesystem.ReadFile(fileName)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/testutil/testutil.go b/pkg/testutil/testutil.go
@@ -292,7 +292,7 @@ func (b *Base) ContainerdAddress() string {
 		xdr = fmt.Sprintf("/run/user/%d", os.Geteuid())
 	}
 	pidFile := filepath.Join(xdr, "containerd-rootless", "child_pid")
-	pidB, err := os.ReadFile(pidFile)
+	pidB, err := filesystem.ReadFile(pidFile)
 	if err != nil {
 		b.T.Fatal(err)
 	}

Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,7 @@ import (`
`39`	`39`
`40`	`40`	`"github.com/containerd/log"`
`41`	`41`
	`42`	`+ "github.com/containerd/nerdctl/v2/pkg/internal/filesystem"`
`42`	`43`	`"github.com/containerd/nerdctl/v2/pkg/rootlessutil"`
`43`	`44`	`)`
`44`	`45`
`@@ -196,11 +197,11 @@ func BuildKitFile(dir, inputfile string) (absDir string, file string, err error)`
`196`	`197`	`_, cErr := os.Lstat(filepath.Join(absDir, ContainerfileName))`
`197`	`198`	`if dErr == nil && cErr == nil {`
`198`	`199`	`// both files exist, prefer Dockerfile.`
`199`		`- dockerfile, err := os.ReadFile(filepath.Join(absDir, DefaultDockerfileName))`
	`200`	`+ dockerfile, err := filesystem.ReadFile(filepath.Join(absDir, DefaultDockerfileName))`
`200`	`201`	`if err != nil {`
`201`	`202`	`return "", "", err`
`202`	`203`	`}`
`203`		`- containerfile, err := os.ReadFile(filepath.Join(absDir, ContainerfileName))`
	`204`	`+ containerfile, err := filesystem.ReadFile(filepath.Join(absDir, ContainerfileName))`
`204`	`205`	`if err != nil {`
`205`	`206`	`return "", "", err`
`206`	`207`	`}`
Original file line number	Diff line number	Diff line change
`@@ -467,7 +467,7 @@ func generateBuildctlArgs(ctx context.Context, client *containerd.Client, option`
`467`	`467`	`}`
`468`	`468`
`469`	`469`	`func getDigestFromMetaFile(path string) (string, error) {`
`470`		`- data, err := os.ReadFile(path)`
	`470`	`+ data, err := filesystem.ReadFile(path)`
`471`	`471`	`if err != nil {`
`472`	`472`	`return "", err`
`473`	`473`	`}`
Original file line number	Diff line number	Diff line change
`@@ -29,6 +29,7 @@ import (`
`29`	`29`	`"github.com/containerd/log"`
`30`	`30`
`31`	`31`	`"github.com/containerd/nerdctl/v2/pkg/composer/serviceparser"`
	`32`	`+ "github.com/containerd/nerdctl/v2/pkg/internal/filesystem"`
`32`	`33`	`"github.com/containerd/nerdctl/v2/pkg/labels"`
`33`	`34`	`)`
`34`	`35`
`@@ -208,7 +209,7 @@ func (c Composer) createServiceContainer(ctx context.Context, service servicep`
`208`	`209`	`return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)`
`209`	`210`	`}`
`210`	`211`
`211`		`- cid, err := os.ReadFile(cidFilename)`
	`212`	`+ cid, err := filesystem.ReadFile(cidFilename)`
`212`	`213`	`if err != nil {`
`213`	`214`	`return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)`
`214`	`215`	`}`
Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,7 @@ import (`
`31`	`31`	`"github.com/containerd/log"`
`32`	`32`
`33`	`33`	`"github.com/containerd/nerdctl/v2/pkg/composer/serviceparser"`
	`34`	`+ "github.com/containerd/nerdctl/v2/pkg/internal/filesystem"`
`34`	`35`	`"github.com/containerd/nerdctl/v2/pkg/labels"`
`35`	`36`	`)`
`36`	`37`
`@@ -198,7 +199,7 @@ func (c Composer) upServiceContainer(ctx context.Context, service serviceparse`
`198`	`199`	`return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)`
`199`	`200`	`}`
`200`	`201`
`201`		`- cid, err := os.ReadFile(cidFilename)`
	`202`	`+ cid, err := filesystem.ReadFile(cidFilename)`
`202`	`203`	`if err != nil {`
`203`	`204`	`return "", fmt.Errorf("error while creating container %s: %w", container.Name, err)`
`204`	`205`	`}`
Original file line number	Diff line number	Diff line change
`@@ -686,7 +686,7 @@ func (m *hostNetworkManager) ContainerNetworkingOpts(_ context.Context, containe`
`686`	`686`	`return nil, nil, err`
`687`	`687`	`}`
`688`	`688`
`689`		`- content, err := os.ReadFile("/etc/hosts")`
	`689`	`+ content, err := filesystem.ReadFile("/etc/hosts")`
`690`	`690`	`if err != nil {`
`691`	`691`	`return nil, nil, err`
`692`	`692`	`}`
Original file line number	Diff line number	Diff line change
`@@ -142,7 +142,7 @@ func LoadLogConfig(dataStore, ns, id string) (LogConfig, error) {`
`142`	`142`	`logConfig := LogConfig{}`
`143`	`143`
`144`	`144`	`logConfigFilePath := LogConfigFilePath(dataStore, ns, id)`
`145`		`- logConfigData, err := os.ReadFile(logConfigFilePath)`
	`145`	`+ logConfigData, err := filesystem.ReadFile(logConfigFilePath)`
`146`	`146`	`if err != nil {`
`147`	`147`	`return logConfig, fmt.Errorf("failed to read log config file %q: %w", logConfigFilePath, err)`
`148`	`148`	`}`