Automated cherry pick of #24012: feat(host): mount post overlay layers by shortest path order (#24018)

zexi · web-flow · commit 9fbad19989aa · 2026-01-06T20:03:41.000+08:00
* fix(host): mount and umount order for post overlay

- support host_lower_map for post overlay image

* feat(host): tar dirs of pod with include patterns
diff --git a/pkg/apis/compute/backup.go b/pkg/apis/compute/backup.go
@@ -126,6 +126,7 @@ type DiskBackupDetails struct {
 
 type DiskBackupAsTarInput struct {
 	IncludeFiles       []string `json:"include_files"`
+	IncludePatterns    []string `json:"include_patterns"`
 	ExcludeFiles       []string `json:"exclude_files"`
 	ContainerId        string   `json:"container_id"`
 	IgnoreNotExistFile bool     `json:"ignore_not_exist_file"`
diff --git a/pkg/apis/compute/container.go b/pkg/apis/compute/container.go
@@ -218,7 +218,8 @@ type ContainerSaveVolumeMountToImageInput struct {
 	Dirs              []string `json:"dirs"`
 	UsedByPostOverlay bool     `json:"used_by_post_overlay"`
 
-	DirPrefix string `json:"dir_prefix"`
+	DirPrefix    string   `json:"dir_prefix"`
+	ExcludePaths []string `json:"exclude_paths"`
 }
 
 type ContainerExecInfoOutput struct {
diff --git a/pkg/apis/container.go b/pkg/apis/container.go
@@ -262,9 +262,16 @@ func (o ContainerVolumeMountDiskOverlay) IsValid() error {
 	return nil
 }
 
+type HostLowerPath struct {
+	PrePath  string `json:"pre_path"`
+	PostPath string `json:"post_path"`
+}
+
 type ContainerVolumeMountDiskPostImageOverlay struct {
 	Id      string            `json:"id"`
 	PathMap map[string]string `json:"path_map"`
+	// 宿主机底层目录映射, key 为 PathMap 的 key，value 为 overlay lower 格式，多目录以 ":" 分隔
+	HostLowerMap map[string]*HostLowerPath `json:"host_lower_map"`
 }
 
 type ContainerVolumeMountDiskPostImageOverlayUnpacker ContainerVolumeMountDiskPostImageOverlay
@@ -277,6 +284,7 @@ func (ov *ContainerVolumeMountDiskPostImageOverlay) UnmarshalJSON(data []byte) e
 	ov.Id = nov.Id
 	// 防止 PathMap 被合并，总是用 Unarmshal data 里面的 path_map
 	ov.PathMap = nov.PathMap
+	ov.HostLowerMap = nov.HostLowerMap
 	return nil
 }
 
@@ -295,6 +303,7 @@ type ContainerVolumeMountDiskPostOverlay struct {
 	Image              *ContainerVolumeMountDiskPostImageOverlay `json:"image"`
 	FsUser             *int64                                    `json:"fs_user,omitempty"`
 	FsGroup            *int64                                    `json:"fs_group,omitempty"`
+	FlattenLayers      bool                                      `json:"flatten_layers"`
 }
 
 func (o ContainerVolumeMountDiskPostOverlay) IsEqual(input ContainerVolumeMountDiskPostOverlay) bool {
diff --git a/pkg/apis/host/container.go b/pkg/apis/host/container.go
@@ -147,7 +147,8 @@ type ContainerSaveVolumeMountToImageInput struct {
 	VolumeMount      *ContainerVolumeMount `json:"volume_mount"`
 	VolumeMountDirs  []string              `json:"volume_mount_dirs"`
 
-	VolumeMountPrefix string `json:"volume_mount_prefix"`
+	VolumeMountPrefix string   `json:"volume_mount_prefix"`
+	ExcludePaths      []string `json:"exclude_paths"`
 }
 
 type ContainerCommitInput struct {
diff --git a/pkg/compute/container_drivers/volume_mount/disk_pov_image.go b/pkg/compute/container_drivers/volume_mount/disk_pov_image.go
@@ -71,6 +71,14 @@ func (p povImage) validateData(ctx context.Context, userCred mcclient.TokenCrede
 	if len(pov.Image.PathMap) == 0 {
 		pov.Image.PathMap = pathMap
 	}
+	if len(pov.Image.HostLowerMap) != 0 {
+		for hostPath, _ := range pov.Image.HostLowerMap {
+			_, ok := pov.Image.PathMap[hostPath]
+			if !ok {
+				return httperrors.NewNotFoundError("host_path %s of host_lower_map doesn't found in path_map", hostPath)
+			}
+		}
+	}
 	return nil
 }
 
diff --git a/pkg/compute/guestdrivers/base.go b/pkg/compute/guestdrivers/base.go
@@ -29,6 +29,7 @@ import (
 	"yunion.io/x/pkg/util/fileutils"
 	"yunion.io/x/pkg/util/osprofile"
 	"yunion.io/x/pkg/util/regutils"
+	"yunion.io/x/pkg/utils"
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
@@ -716,3 +717,10 @@ func (base *SBaseGuestDriver) BeforeAttachIsolatedDevice(ctx context.Context, cr
 func (base *SBaseGuestDriver) RequestUploadGuestStatus(ctx context.Context, guest *models.SGuest, task taskman.ITask) error {
 	return errors.Wrapf(cloudprovider.ErrNotImplemented, "RequestUploadGuestStatus")
 }
+
+func (base *SBaseGuestDriver) CanStop(guest *models.SGuest) error {
+	if utils.IsInStringArray(guest.Status, []string{api.VM_RUNNING, api.VM_STOP_FAILED, api.POD_STATUS_CRASH_LOOP_BACK_OFF, api.POD_STATUS_CONTAINER_EXITED, api.VM_KICKSTART_INSTALLING, api.VM_KICKSTART_FAILED, api.VM_KICKSTART_COMPLETED}) {
+		return nil
+	}
+	return errors.Wrapf(errors.ErrInvalidStatus, "Cannot stop server in status %s", guest.Status)
+}
diff --git a/pkg/compute/guestdrivers/pod.go b/pkg/compute/guestdrivers/pod.go
@@ -329,6 +329,13 @@ func (p *SPodDriver) OnGuestDeployTaskDataReceived(ctx context.Context, guest *m
 	return nil
 }
 
+func (p *SPodDriver) CanStop(guest *models.SGuest) error {
+	if guest.PowerStates == api.VM_POWER_STATES_ON {
+		return nil
+	}
+	return p.SKVMGuestDriver.CanStop(guest)
+}
+
 func (p *SPodDriver) StartGuestStopTask(guest *models.SGuest, ctx context.Context, userCred mcclient.TokenCredential, params *jsonutils.JSONDict, parentTaskId string) error {
 	task, err := taskman.TaskManager.NewTask(ctx, "PodStopTask", guest, userCred, params, parentTaskId, "", nil)
 	if err != nil {
diff --git a/pkg/compute/models/containers.go b/pkg/compute/models/containers.go
@@ -482,10 +482,15 @@ func (c *SContainer) StartCreateTask(ctx context.Context, userCred mcclient.Toke
 	return task.ScheduleRun(nil)
 }
 
-func (c *SContainer) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, input *api.ContainerUpdateInput) (*api.ContainerUpdateInput, error) {
+// func (c *SContainer) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, input *api.ContainerUpdateInput) (*api.ContainerUpdateInput, error) {
+func (c *SContainer) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (*api.ContainerUpdateInput, error) {
 	if !api.ContainerExitedStatus.Has(c.GetStatus()) {
 		return nil, httperrors.NewInvalidStatusError("current status %s is not in %v", c.GetStatus(), api.ContainerExitedStatus.List())
 	}
+	input := new(api.ContainerUpdateInput)
+	if err := data.Unmarshal(input); err != nil {
+		return nil, errors.Wrap(err, "Unmarshal")
+	}
 
 	baseInput, err := c.SVirtualResourceBase.ValidateUpdateData(ctx, userCred, query, input.VirtualResourceBaseUpdateInput)
 	if err != nil {
@@ -968,6 +973,7 @@ func (c *SContainer) PerformSaveVolumeMountImage(ctx context.Context, userCred m
 
 		VolumeMountDirs:   cleanupDirPaths(input.Dirs),
 		VolumeMountPrefix: cleanupDirPath(input.DirPrefix),
+		ExcludePaths:      cleanupDirPaths(input.ExcludePaths),
 	}
 
 	return hostInput, c.StartSaveVolumeMountImage(ctx, userCred, hostInput, "")
diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go
@@ -3857,14 +3857,20 @@ func (self *SGuest) PerformStatus(ctx context.Context, userCred mcclient.TokenCr
 // 关机
 func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
 	input api.ServerStopInput) (jsonutils.JSONObject, error) {
-	// XXX if is force, force stop guest
-	if input.IsForce || utils.IsInStringArray(self.Status, []string{api.VM_RUNNING, api.VM_STOP_FAILED, api.POD_STATUS_CRASH_LOOP_BACK_OFF, api.POD_STATUS_CONTAINER_EXITED, api.VM_KICKSTART_INSTALLING, api.VM_KICKSTART_FAILED, api.VM_KICKSTART_COMPLETED}) {
-		if err := self.ValidateEncryption(ctx, userCred); err != nil {
-			return nil, errors.Wrap(httperrors.ErrForbidden, "encryption key not accessible")
+	drv, err := self.GetDriver()
+	if err != nil {
+		return nil, errors.Wrap(err, "GetDriver")
+	}
+	if !input.IsForce {
+		err := drv.CanStop(self)
+		if err != nil {
+			return nil, errors.Wrap(err, "Cannot stop server")
 		}
-		return nil, self.StartGuestStopTask(ctx, userCred, input.TimeoutSecs, input.IsForce, input.StopCharging, "")
 	}
-	return nil, httperrors.NewInvalidStatusError("Cannot stop server in status %s", self.Status)
+	if err := self.ValidateEncryption(ctx, userCred); err != nil {
+		return nil, errors.Wrap(httperrors.ErrForbidden, "encryption key not accessible")
+	}
+	return nil, self.StartGuestStopTask(ctx, userCred, input.TimeoutSecs, input.IsForce, input.StopCharging, "")
 }
 
 // 冻结虚拟机
diff --git a/pkg/compute/models/guestdrivers.go b/pkg/compute/models/guestdrivers.go
@@ -84,6 +84,7 @@ type IGuestDriver interface {
 
 	RequestGuestCreateInsertIso(ctx context.Context, imageId string, bootIndex *int8, task taskman.ITask, guest *SGuest) error
 
+	CanStop(guest *SGuest) error
 	StartGuestStopTask(guest *SGuest, ctx context.Context, userCred mcclient.TokenCredential, params *jsonutils.JSONDict, parentTaskId string) error
 	StartGuestResetTask(guest *SGuest, ctx context.Context, userCred mcclient.TokenCredential, isHard bool, parentTaskId string) error
 	StartGuestRestartTask(guest *SGuest, ctx context.Context, userCred mcclient.TokenCredential, isForce bool, parentTaskId string) error
diff --git a/pkg/hostman/container/storage/storage.go b/pkg/hostman/container/storage/storage.go
@@ -88,7 +88,7 @@ func UnmountWithSubDirs(devPath string) error {
 		return err
 	}
 	// found mountpoints starts with devPath
-	out, err2 := procutils.NewRemoteCommandAsFarAsPossible("sh", "-c", fmt.Sprintf("mount | grep ' %s/' | awk '{print $3}'", devPath)).Output()
+	out, err2 := procutils.NewRemoteCommandAsFarAsPossible("sh", "-c", fmt.Sprintf("mount | grep ' %s/' | awk '{print $3}' | tac", devPath)).Output()
 	if err2 == nil && len(out) != 0 {
 		mntPoints := strings.Split(string(out), "\n")
 		for _, mntPoint := range mntPoints {
diff --git a/pkg/hostman/container/volume_mount/disk/disk.go b/pkg/hostman/container/volume_mount/disk/disk.go
@@ -185,6 +185,39 @@ func (d disk) mountDisk(devPath string, mntPoint string, fs string, resUid int,
 	return nil
 }
 
+func (d disk) Connect(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMount) (string, bool, error) {
+	iDisk, _, err := d.getPodDisk(pod, vm)
+	if err != nil {
+		return "", false, errors.Wrap(err, "get pod disk interface")
+	}
+	return d.connectDisk(iDisk)
+}
+
+func (d disk) Disconnect(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMount) error {
+	iDisk, _, err := d.getPodDisk(pod, vm)
+	if err != nil {
+		return errors.Wrap(err, "get pod disk interface")
+	}
+	drv, err := iDisk.GetContainerStorageDriver()
+	if err != nil {
+		return errors.Wrap(err, "get disk storage driver")
+	}
+	mntPoint := pod.GetDiskMountPoint(iDisk)
+	_, isConnected, err := drv.CheckConnect(iDisk.GetPath())
+	if err != nil {
+		return errors.Wrapf(err, "CheckConnect %s", iDisk.GetPath())
+	}
+	if isConnected {
+		if err := drv.DisconnectDisk(iDisk.GetPath(), mntPoint); err != nil {
+			return errors.Wrapf(err, "DisconnectDisk %s %s", iDisk.GetPath(), mntPoint)
+		}
+	}
+	if err := volume_mount.RemoveDir(mntPoint); err != nil {
+		return errors.Wrapf(err, "remove dir %s", mntPoint)
+	}
+	return nil
+}
+
 func (d disk) connectDiskAndMount(drv container_storage.IContainerStorage, pod volume_mount.IPodInfo, iDisk storageman.IDisk, fs string, resUid, resGid int) (string, error) {
 	devPath, isConnected, err := d.connectDisk(iDisk)
 	if err != nil {
@@ -282,15 +315,19 @@ func (d disk) createStorageSizeFile(iDisk storageman.IDisk, mntPoint string, inp
 	return nil
 }
 
+func (d disk) UnmountWithoutDisconnect(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMount) error {
+	return d.unmount(pod, ctrId, vm, false)
+}
+
 func (d disk) Unmount(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMount) error {
+	return d.unmount(pod, ctrId, vm, true)
+}
+
+func (d disk) unmount(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMount, disconnect bool) error {
 	iDisk, _, err := d.getPodDisk(pod, vm)
 	if err != nil {
 		return errors.Wrap(err, "get pod disk interface")
 	}
-	drv, err := iDisk.GetContainerStorageDriver()
-	if err != nil {
-		return errors.Wrap(err, "get disk storage driver")
-	}
 	if len(vm.Disk.PostOverlay) != 0 {
 		if err := d.UnmountPostOverlays(pod, ctrId, vm, vm.Disk.PostOverlay, false, false); err != nil {
 			return errors.Wrap(err, "umount post overlay dirs")
@@ -303,20 +340,13 @@ func (d disk) Unmount(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.Conta
 	}
 	mntPoint := pod.GetDiskMountPoint(iDisk)
 	if err := container_storage.UnmountWithSubDirs(mntPoint); err != nil {
-		return errors.Wrapf(err, "unmount %s", mntPoint)
-	}
-	_, isConnected, err := drv.CheckConnect(iDisk.GetPath())
-	if err != nil {
-		return errors.Wrapf(err, "CheckConnect %s", iDisk.GetPath())
+		return errors.Wrapf(err, "UnmountWithSubDirs %s", mntPoint)
 	}
-	if isConnected {
-		if err := drv.DisconnectDisk(iDisk.GetPath(), mntPoint); err != nil {
-			return errors.Wrapf(err, "DisconnectDisk %s %s", iDisk.GetPath(), mntPoint)
+	if disconnect {
+		if err := d.Disconnect(pod, ctrId, vm); err != nil {
+			return errors.Wrapf(err, "disconnect disk")
 		}
 	}
-	if err := volume_mount.RemoveDir(mntPoint); err != nil {
-		return errors.Wrapf(err, "remove dir %s", mntPoint)
-	}
 	return nil
 }
 
diff --git a/pkg/hostman/container/volume_mount/disk/post_overlay.go b/pkg/hostman/container/volume_mount/disk/post_overlay.go
@@ -15,9 +15,13 @@
 package disk
 
 import (
+	"math"
 	"path/filepath"
+	"sort"
 	"strings"
 
+	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 
 	"yunion.io/x/onecloud/pkg/apis"
@@ -97,8 +101,34 @@ func (d diskPostOverlay) getDriver(ov *apis.ContainerVolumeMountDiskPostOverlay)
 	return getPostOverlayDriver(ov.GetType())
 }
 
+// getMinPathMapKeyLength 获取 PathMap 中最短 key 的长度
+// 如果 Image 为 nil 或 PathMap 为空，返回一个很大的值，确保排在后面
+func getMinPathMapKeyLength(ov *apis.ContainerVolumeMountDiskPostOverlay) int {
+	if ov.Image == nil || len(ov.Image.PathMap) == 0 {
+		return math.MaxInt // 返回一个很大的值，确保没有 PathMap 的排在后面
+	}
+	minLen := math.MaxInt
+	for key := range ov.Image.PathMap {
+		if len(key) < minLen {
+			minLen = len(key)
+		}
+	}
+	return minLen
+}
+
+func sortPostOverlayByPathMapLength(ovs []*apis.ContainerVolumeMountDiskPostOverlay) {
+	sort.Slice(ovs, func(i, j int) bool {
+		lenI := getMinPathMapKeyLength(ovs[i])
+		lenJ := getMinPathMapKeyLength(ovs[j])
+		return lenI < lenJ
+	})
+}
+
 func (d diskPostOverlay) mountPostOverlays(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMount, ovs []*apis.ContainerVolumeMountDiskPostOverlay) error {
+	// 根据 PathMap 中最短路径长度排序，路径短的排在前面
+	sortPostOverlayByPathMapLength(ovs)
 	for _, ov := range ovs {
+		log.Debugf("mount container %s post overlay dir: %s", ctrId, jsonutils.Marshal(ov).PrettyString())
 		if err := d.getDriver(ov).Mount(d, pod, ctrId, vm, ov); err != nil {
 			return errors.Wrapf(err, "mount container %s post overlay dir: %#v", ctrId, ov)
 		}
@@ -107,7 +137,11 @@ func (d diskPostOverlay) mountPostOverlays(pod volume_mount.IPodInfo, ctrId stri
 }
 
 func (d diskPostOverlay) unmountPostOverlays(pod volume_mount.IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMount, ovs []*apis.ContainerVolumeMountDiskPostOverlay, useLazy bool, clearLayers bool) error {
-	for _, ov := range ovs {
+	//（与 mount 顺序相反）
+	sortPostOverlayByPathMapLength(ovs)
+	for i := len(ovs) - 1; i >= 0; i-- {
+		ov := ovs[i]
+		log.Debugf("-- unmount container %s post overlay dir: %s", ctrId, jsonutils.Marshal(ov).PrettyString())
 		if err := d.getDriver(ov).Unmount(d, pod, ctrId, vm, ov, useLazy, clearLayers); err != nil {
 			return errors.Wrapf(err, "unmount container %s post overlay dir: %#v", ctrId, ov)
 		}
@@ -128,6 +162,9 @@ func (d diskPostOverlay) getPostOverlayDirWithPrefix(
 	}
 
 	workDir := filepath.Join(rootPath, ov.ContainerTargetDir)
+	if ov.FlattenLayers {
+		workDir = filepath.Join(rootPath, strings.ReplaceAll(ov.ContainerTargetDir, "/", "_"))
+	}
 	if ensure {
 		if err := volume_mount.EnsureDir(workDir); err != nil {
 			return "", errors.Wrapf(err, "makeDir %s", workDir)
diff --git a/pkg/hostman/container/volume_mount/disk/post_overlay_image.go b/pkg/hostman/container/volume_mount/disk/post_overlay_image.go
diff --git a/pkg/hostman/container/volume_mount/interface.go b/pkg/hostman/container/volume_mount/interface.go
diff --git a/pkg/hostman/guestman/pod.go b/pkg/hostman/guestman/pod.go
diff --git a/pkg/mcclient/options/compute/backup.go b/pkg/mcclient/options/compute/backup.go

Original file line number	Diff line number	Diff line change
`@@ -218,7 +218,8 @@ type ContainerSaveVolumeMountToImageInput struct {`
`218`	`218`	Dirs []string `json:"dirs"`
`219`	`219`	UsedByPostOverlay bool `json:"used_by_post_overlay"`
`220`	`220`
`221`		- DirPrefix string `json:"dir_prefix"`
	`221`	+ DirPrefix string `json:"dir_prefix"`
	`222`	+ ExcludePaths []string `json:"exclude_paths"`
`222`	`223`	`}`
`223`	`224`
`224`	`225`	`type ContainerExecInfoOutput struct {`
Original file line number	Diff line number	Diff line change
`@@ -147,7 +147,8 @@ type ContainerSaveVolumeMountToImageInput struct {`
`147`	`147`	VolumeMount *ContainerVolumeMount `json:"volume_mount"`
`148`	`148`	VolumeMountDirs []string `json:"volume_mount_dirs"`
`149`	`149`
`150`		- VolumeMountPrefix string `json:"volume_mount_prefix"`
	`150`	+ VolumeMountPrefix string `json:"volume_mount_prefix"`
	`151`	+ ExcludePaths []string `json:"exclude_paths"`
`151`	`152`	`}`
`152`	`153`
`153`	`154`	`type ContainerCommitInput struct {`
Original file line number	Diff line number	Diff line change
`@@ -71,6 +71,14 @@ func (p povImage) validateData(ctx context.Context, userCred mcclient.TokenCrede`
`71`	`71`	`if len(pov.Image.PathMap) == 0 {`
`72`	`72`	`pov.Image.PathMap = pathMap`
`73`	`73`	`}`
	`74`	`+ if len(pov.Image.HostLowerMap) != 0 {`
	`75`	`+ for hostPath, _ := range pov.Image.HostLowerMap {`
	`76`	`+ _, ok := pov.Image.PathMap[hostPath]`
	`77`	`+ if !ok {`
	`78`	`+ return httperrors.NewNotFoundError("host_path %s of host_lower_map doesn't found in path_map", hostPath)`
	`79`	`+ }`
	`80`	`+ }`
	`81`	`+ }`
`74`	`82`	`return nil`
`75`	`83`	`}`
`76`	`84`