Static linked executable as a runnable container (#182)

termoshtt · web-flow · commit cad17203c542 · 2025-03-15T17:04:14.000+09:00
diff --git a/.github/workflows/ocipkg.yml b/.github/workflows/ocipkg.yml
@@ -48,6 +48,32 @@ jobs:
       - name: Show alpine version
         run: cat $HOME/.local/share/ocipkg/docker.io/library/alpine/__latest/etc/alpine-release
 
+  runnable:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: --path=ocipkg-cli/ -f
+      - name: Add path
+        run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+
+      - name: Build examples/static-exe
+        run: |
+          rustup target add x86_64-unknown-linux-musl
+          cargo build --release
+        working-directory: examples/static-exe
+
+      - name: pack
+        run: |
+          ocipkg runnable examples/static-exe/target/x86_64-unknown-linux-musl/release/static-exe -o test.tar --tag static-exe
+
+      - name: Test podman can run the
+        run: |
+          podman load < test.tar
+          podman run --rm static-exe
+
   get:
     runs-on: ubuntu-22.04
     steps:
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace]
 members = ["ocipkg", "ocipkg-cli"]
-exclude = ["examples/rust/lib", "examples/rust/exe"]
+exclude = ["examples/static-exe", "examples/rust/lib", "examples/rust/exe"]
 resolver = "2"
 
 [workspace.dependencies]
@@ -15,6 +15,7 @@ directories = "5.0.1"
 env_logger = "0.11.7"
 flate2 = "1.1.0"
 git2 = "0.19.0"
+goblin = "0.9.3"
 lazy_static = "1.5.0"
 log = "0.4.26"
 maplit = "1.0.2"
diff --git a/examples/static-exe/.cargo/config.toml b/examples/static-exe/.cargo/config.toml
@@ -0,0 +1,2 @@
+[build]
+target = "x86_64-unknown-linux-musl"
diff --git a/examples/static-exe/Cargo.lock b/examples/static-exe/Cargo.lock
diff --git a/examples/static-exe/Cargo.toml b/examples/static-exe/Cargo.toml
@@ -0,0 +1,6 @@
+[package]
+name = "static-exe"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
diff --git a/examples/static-exe/src/main.rs b/examples/static-exe/src/main.rs
@@ -0,0 +1,7 @@
+use std::env;
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+    let name = if args.len() > 1 { &args[1] } else { "World" };
+    println!("Hello, {}!", name);
+}
diff --git a/ocipkg-cli/src/bin/ocipkg.rs b/ocipkg-cli/src/bin/ocipkg.rs
@@ -33,6 +33,24 @@ enum Opt {
         tag: Option<String>,
     },
 
+    /// Compose a static-linked executable file into an oci-archive tar file
+    Runnable {
+        /// Path of static-linked exetuable file
+        input: PathBuf,
+
+        /// Path of output tar archive in oci-archive format. Default is input file name with .tar extension
+        #[arg(short = 'o', long = "output")]
+        output: Option<PathBuf>,
+
+        /// Overwrite the output file if it exists
+        #[arg(short = 'f', long = "overwrite")]
+        overwrite: bool,
+
+        /// Name of container, use UUID v4 hyphenated if not set.
+        #[arg(short = 't', long = "tag")]
+        tag: Option<String>,
+    },
+
     /// Load and expand container local cache
     Load {
         /// Input oci-archive
@@ -121,6 +139,33 @@ fn main() -> Result<()> {
             let _artifact = b.build()?;
         }
 
+        Opt::Runnable {
+            input,
+            output,
+            overwrite,
+            tag,
+        } => {
+            let output = output.unwrap_or_else(|| {
+                let mut output = input.clone();
+                output.set_extension("tar");
+                output
+            });
+            let image_name = if let Some(name) = tag {
+                ocipkg::ImageName::parse(&name)?
+            } else {
+                ocipkg::ImageName::default()
+            };
+
+            if overwrite && output.exists() {
+                log::warn!("Overwriting existing file: {}", output.display());
+                std::fs::remove_file(&output)?;
+            }
+
+            log::info!("Creating runnable image at {}", output.display());
+            let _out =
+                ocipkg::image::RunnableBuilder::new_archive(output, image_name)?.build(&input)?;
+        }
+
         Opt::Load { input, overwrite } => {
             ocipkg::image::load(&input, overwrite)?;
         }
diff --git a/ocipkg/Cargo.toml b/ocipkg/Cargo.toml
@@ -16,6 +16,7 @@ base64.workspace = true
 chrono.workspace = true
 directories.workspace = true
 flate2.workspace = true
+goblin.workspace = true
 lazy_static.workspace = true
 log.workspace = true
 maplit.workspace = true
diff --git a/ocipkg/src/image/mod.rs b/ocipkg/src/image/mod.rs
@@ -11,6 +11,7 @@ mod oci_archive;
 mod oci_artifact;
 mod oci_dir;
 mod remote;
+mod runnable;
 
 pub use artifact::*;
 pub use config::*;
@@ -19,3 +20,4 @@ pub use oci_archive::*;
 pub use oci_artifact::*;
 pub use oci_dir::*;
 pub use remote::*;
+pub use runnable::*;
diff --git a/ocipkg/src/image/runnable.rs b/ocipkg/src/image/runnable.rs
@@ -0,0 +1,153 @@
+//! Executable container
+
+use super::OciArchiveBuilder;
+use crate::{image::ImageBuilder, ImageName};
+use anyhow::{bail, Context, Result};
+use goblin::elf::Elf;
+use oci_spec::image::{
+    Arch, ConfigBuilder, Descriptor, DescriptorBuilder, ImageConfigurationBuilder,
+    ImageManifestBuilder, Os,
+};
+use std::{
+    fs,
+    path::{Path, PathBuf},
+};
+
+/// Build [`Runnable`], executable container
+pub struct RunnableBuilder<LayoutBuilder: ImageBuilder> {
+    manifest: ImageManifestBuilder,
+    layout: LayoutBuilder,
+}
+
+impl<LayoutBuilder: ImageBuilder> RunnableBuilder<LayoutBuilder> {
+    pub fn new(builder: LayoutBuilder) -> Result<Self> {
+        Ok(Self {
+            layout: builder,
+            manifest: ImageManifestBuilder::default().schema_version(2_u32),
+        })
+    }
+
+    fn add_layer(&mut self, path: &Path) -> Result<Descriptor> {
+        let filename = path
+            .file_name()
+            .unwrap() // Checked above
+            .to_str()
+            .expect("Non-UTF8 filename");
+
+        let mut buf = Vec::new();
+        {
+            let mut tar_builder = tar::Builder::new(&mut buf);
+            let mut file = std::fs::File::open(path)?;
+            tar_builder.append_file(filename, &mut file)?;
+        }
+
+        let (digest, size) = self.layout.add_blob(&buf)?;
+
+        let layer_desc = DescriptorBuilder::default()
+            .media_type(oci_spec::image::MediaType::ImageLayer)
+            .size(size)
+            .digest(digest)
+            .build()?;
+
+        Ok(layer_desc)
+    }
+
+    fn add_cfg(&mut self, path: &Path) -> Result<Descriptor> {
+        let filename = path
+            .file_name()
+            .unwrap() // Checked above
+            .to_str()
+            .expect("Non-UTF8 filename");
+        let (arch, os) = parse_elf_header(path)?;
+
+        let cfg = ImageConfigurationBuilder::default()
+            .architecture(arch)
+            .os(os)
+            .config(
+                ConfigBuilder::default()
+                    .entrypoint(vec![format!("/{filename}")])
+                    .working_dir("/")
+                    .build()?,
+            )
+            .build()?;
+        let (digest, size) = self
+            .layout
+            .add_blob(serde_json::to_string(&cfg)?.as_bytes())?;
+        let cfg_desc = DescriptorBuilder::default()
+            .media_type(oci_spec::image::MediaType::ImageConfig)
+            .size(size)
+            .digest(digest)
+            .build()?;
+
+        Ok(cfg_desc)
+    }
+
+    pub fn build(mut self, path: &Path) -> Result<Runnable<LayoutBuilder::Image>> {
+        if !path.is_file() {
+            anyhow::bail!("File does not exist: {:?}", path);
+        }
+        let layer_desc = self.add_layer(path)?;
+        let cfg_desc = self.add_cfg(path)?;
+        let manifest = self
+            .manifest
+            .config(cfg_desc)
+            .layers(vec![layer_desc])
+            .build()?;
+        Ok(Runnable(self.layout.build(manifest)?))
+    }
+}
+
+impl RunnableBuilder<OciArchiveBuilder> {
+    pub fn new_archive_unnamed(path: PathBuf) -> Result<Self> {
+        let layout = OciArchiveBuilder::new_unnamed(path)?;
+        Self::new(layout)
+    }
+
+    pub fn new_archive(path: PathBuf, image_name: ImageName) -> Result<Self> {
+        let layout = OciArchiveBuilder::new(path, image_name)?;
+        Self::new(layout)
+    }
+}
+
+/// Runnable container containing single, statically linked executable
+pub struct Runnable<Layout>(Layout);
+
+fn parse_elf_header(path: &Path) -> Result<(Arch, Os)> {
+    let buffer = fs::read(path)?;
+    let elf = Elf::parse(&buffer).context("Cannot parse as an ELF file")?;
+
+    // Statically linked executable does not have interpreter (`PT_INTERP`).
+    // https://refspecs.linuxbase.org/elf/gabi4+/ch5.dynamic.html#interpreter
+    if elf.interpreter.is_some() {
+        bail!(
+            "Dynamically linked ELF executables are not supported: {}",
+            path.display()
+        );
+    }
+
+    let header = elf.header;
+    let arch = match header.e_machine {
+        goblin::elf::header::EM_X86_64 => Arch::Amd64,
+        goblin::elf::header::EM_AARCH64 => Arch::ARM64,
+        _ => bail!(
+            "Unsupported ELF architecture: {} (Expected x86_64({}) or aarch64({})",
+            header.e_machine,
+            goblin::elf::header::EM_X86_64,
+            goblin::elf::header::EM_AARCH64
+        ),
+    };
+    let osabi = header.e_ident[goblin::elf::header::EI_OSABI];
+    let os = match osabi {
+        // XXX: OCI spec says `os` field in `application/vnd.oci.image.config.v1+json` should be GOOS value,
+        //      https://github.com/opencontainers/image-spec/blob/main/config.md
+        //      but it is unclear how `ELFOSABI_NONE=0` should be mapped to GOOS since it does not contains `None` variant.
+        //      For now, we simply map to `Linux` because the most common use case is Linux.
+        goblin::elf::header::ELFOSABI_NONE | goblin::elf::header::ELFOSABI_LINUX => Os::Linux,
+        _ => bail!(
+            "Unsupported ELF OS ABI: {osabi} (Expected None({}) or Linux({})",
+            goblin::elf::header::ELFOSABI_NONE,
+            goblin::elf::header::ELFOSABI_LINUX
+        ),
+    };
+    Ok((arch, os))
+}

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+[build]`
	`2`	`+target = "x86_64-unknown-linux-musl"`