Add SOCI CLI root flag

austinvazquez · austinvazquez · commit ca55b7fe5f35 · 2025-05-19T09:57:40.000-07:00
This change adds --root flag for the soci command and refactors common
code with the snapshotter grpc for similar logic.

Signed-off-by: Austin Vazquez &lt;macedonv@amazon.com&gt;
diff --git a/cmd/soci-snapshotter-grpc/main.go b/cmd/soci-snapshotter-grpc/main.go
@@ -55,6 +55,7 @@ import (
 	"github.com/awslabs/soci-snapshotter/service"
 	"github.com/awslabs/soci-snapshotter/service/keychain/cri/v1"
 	crialpha "github.com/awslabs/soci-snapshotter/service/keychain/cri/v1alpha"
+	"github.com/awslabs/soci-snapshotter/soci"
 
 	"github.com/awslabs/soci-snapshotter/service/keychain/dockerconfig"
 	"github.com/awslabs/soci-snapshotter/service/keychain/kubeconfig"
@@ -84,7 +85,6 @@ const (
 	defaultAddress    = "/run/soci-snapshotter-grpc/soci-snapshotter-grpc.sock"
 	defaultConfigPath = "/etc/soci-snapshotter-grpc/config.toml"
 	defaultLogLevel   = logrus.InfoLevel
-	defaultRootDir    = "/var/lib/soci-snapshotter-grpc"
 )
 
 // logLevel of Debug or Trace may emit sensitive information
@@ -93,7 +93,7 @@ var (
 	address      = flag.String("address", defaultAddress, "address for the snapshotter's GRPC server")
 	configPath   = flag.String("config", defaultConfigPath, "path to the configuration file")
 	logLevel     = flag.String("log-level", defaultLogLevel.String(), "set the logging level [trace, debug, info, warn, error, fatal, panic]")
-	rootDir      = flag.String("root", defaultRootDir, "path to the root directory for this snapshotter")
+	rootDir      = flag.String("root", config.DefaultSociSnapshotterRootPath, "path to the root directory for this snapshotter")
 	printVersion = flag.Bool("version", false, "print the version")
 )
 
@@ -361,7 +361,7 @@ func listen(ctx context.Context, address string) (net.Listener, error) {
 
 func listenUnix(addr string) (net.Listener, error) {
 	// Prepare the directory for the socket
-	if err := os.MkdirAll(filepath.Dir(addr), 0700); err != nil {
+	if err := soci.EnsureSnapshotterRootPath(filepath.Dir(addr)); err != nil {
 		return nil, fmt.Errorf("failed to create directory %q: %w", filepath.Dir(addr), err)
 	}
 
diff --git a/cmd/soci/commands/convert.go b/cmd/soci/commands/convert.go
@@ -19,11 +19,9 @@ package commands
 import (
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/awslabs/soci-snapshotter/cmd/soci/commands/internal"
-	"github.com/awslabs/soci-snapshotter/config"
 	"github.com/awslabs/soci-snapshotter/soci"
 	"github.com/awslabs/soci-snapshotter/soci/store"
 	"github.com/containerd/containerd/errdefs"
@@ -118,23 +116,13 @@ var ConvertCommand = cli.Command{
 		}
 		spanSize := cliContext.Int64(spanSizeFlag)
 		minLayerSize := cliContext.Int64(minLayerSizeFlag)
-		// Creating the snapshotter's root path first if it does not exist, since this ensures, that
-		// it has the limited permission set as drwx--x--x.
-		// The subsequent oci.New creates a root path dir with too broad permission set.
-		if _, err := os.Stat(config.SociSnapshotterRootPath); os.IsNotExist(err) {
-			if err = os.Mkdir(config.SociSnapshotterRootPath, 0711); err != nil {
-				return err
-			}
-		} else if err != nil {
-			return err
-		}
 
 		blobStore, err := store.NewContentStore(internal.ContentStoreOptions(cliContext)...)
 		if err != nil {
 			return err
 		}
 
-		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath())
+		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/create.go b/cmd/soci/commands/create.go
@@ -19,10 +19,8 @@ package commands
 import (
 	"errors"
 	"fmt"
-	"os"
 
 	"github.com/awslabs/soci-snapshotter/cmd/soci/commands/internal"
-	"github.com/awslabs/soci-snapshotter/config"
 	"github.com/awslabs/soci-snapshotter/soci"
 	"github.com/awslabs/soci-snapshotter/soci/store"
 	"github.com/urfave/cli"
@@ -92,16 +90,6 @@ var CreateCommand = cli.Command{
 		}
 		spanSize := cliContext.Int64(spanSizeFlag)
 		minLayerSize := cliContext.Int64(minLayerSizeFlag)
-		// Creating the snapshotter's root path first if it does not exist, since this ensures, that
-		// it has the limited permission set as drwx--x--x.
-		// The subsequent oci.New creates a root path dir with too broad permission set.
-		if _, err := os.Stat(config.SociSnapshotterRootPath); os.IsNotExist(err) {
-			if err = os.Mkdir(config.SociSnapshotterRootPath, 0711); err != nil {
-				return err
-			}
-		} else if err != nil {
-			return err
-		}
 
 		blobStore, err := store.NewContentStore(internal.ContentStoreOptions(cliContext)...)
 		if err != nil {
@@ -113,7 +101,7 @@ var CreateCommand = cli.Command{
 			return err
 		}
 
-		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath())
+		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
@@ -127,7 +115,6 @@ var CreateCommand = cli.Command{
 		}
 
 		builder, err := soci.NewIndexBuilder(cs, blobStore, builderOpts...)
-
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/index/info.go b/cmd/soci/commands/index/info.go
@@ -44,7 +44,7 @@ var infoCommand = cli.Command{
 		if err != nil {
 			return err
 		}
-		db, err := soci.NewDB(soci.ArtifactsDbPath())
+		db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/index/list.go b/cmd/soci/commands/index/list.go
@@ -132,7 +132,7 @@ var listCommand = cli.Command{
 			f = anyMatch(filters)
 		}
 
-		db, err := soci.NewDB(soci.ArtifactsDbPath())
+		db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/index/rm.go b/cmd/soci/commands/index/rm.go
@@ -51,7 +51,7 @@ var rmCommand = cli.Command{
 			return fmt.Errorf("cannot create local content store: %w", err)
 		}
 
-		db, err := soci.NewDB(soci.ArtifactsDbPath())
+		db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/push.go b/cmd/soci/commands/push.go
@@ -99,7 +99,7 @@ if they are available in the snapshotter's local content store.
 			return err
 		}
 
-		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath())
+		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/rebuild_db.go b/cmd/soci/commands/rebuild_db.go
@@ -41,7 +41,7 @@ var RebuildDBCommand = cli.Command{
 		}
 		defer cancel()
 		containerdContentStore := client.ContentStore()
-		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath())
+		artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/ztoc/get-file.go b/cmd/soci/commands/ztoc/get-file.go
@@ -65,7 +65,12 @@ var getFileCommand = cli.Command{
 			return err
 		}
 
-		layerReader, err := getLayer(ctx, ztocDigest, client.ContentStore())
+		artifactsDB, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
+		if err != nil {
+			return err
+		}
+
+		layerReader, err := getLayer(ctx, artifactsDB, ztocDigest, client.ContentStore())
 		if err != nil {
 			return err
 		}
@@ -101,11 +106,7 @@ func getZtoc(ctx context.Context, cliContext *cli.Context, d digest.Digest) (*zt
 	return ztoc.Unmarshal(reader)
 }
 
-func getLayer(ctx context.Context, ztocDigest digest.Digest, cs content.Store) (content.ReaderAt, error) {
-	metadata, err := soci.NewDB(soci.ArtifactsDbPath())
-	if err != nil {
-		return nil, err
-	}
+func getLayer(ctx context.Context, metadata *soci.ArtifactsDb, ztocDigest digest.Digest, cs content.Store) (content.ReaderAt, error) {
 	artifact, err := metadata.GetArtifactEntry(ztocDigest.String())
 	if err != nil {
 		return nil, err
diff --git a/cmd/soci/commands/ztoc/info.go b/cmd/soci/commands/ztoc/info.go
@@ -59,7 +59,7 @@ var infoCommand = cli.Command{
 		if err != nil {
 			return err
 		}
-		db, err := soci.NewDB(soci.ArtifactsDbPath())
+		db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/commands/ztoc/list.go b/cmd/soci/commands/ztoc/list.go
@@ -52,7 +52,7 @@ var listCommand = cli.Command{
 		},
 	},
 	Action: func(cliContext *cli.Context) error {
-		db, err := soci.NewDB(soci.ArtifactsDbPath())
+		db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/soci/main.go b/cmd/soci/main.go
@@ -40,6 +40,7 @@ import (
 	"github.com/awslabs/soci-snapshotter/cmd/soci/commands/index"
 	"github.com/awslabs/soci-snapshotter/cmd/soci/commands/ztoc"
 	"github.com/awslabs/soci-snapshotter/config"
+	"github.com/awslabs/soci-snapshotter/soci"
 	"github.com/awslabs/soci-snapshotter/version"
 	"github.com/containerd/containerd/defaults"
 	"github.com/containerd/containerd/namespaces"
@@ -83,6 +84,11 @@ func main() {
 			Usage: "use a specific content store (soci or containerd)",
 			Value: string(config.DefaultContentStoreType),
 		},
+		cli.StringFlag{
+			Name:  "root",
+			Usage: "path to the root directory for this snapshotter",
+			Value: config.DefaultSociSnapshotterRootPath,
+		},
 	}
 
 	app.Version = fmt.Sprintf("%s %s", version.Version, version.Revision)
@@ -96,6 +102,10 @@ func main() {
 		commands.RebuildDBCommand,
 	}
 
+	app.Before = func(context *cli.Context) error {
+		return soci.EnsureSnapshotterRootPath(context.GlobalString("root"))
+	}
+
 	if err := app.Run(os.Args); err != nil {
 		fmt.Fprintf(os.Stderr, "soci: %v\n", err)
 		os.Exit(1)
diff --git a/config/config.go b/config/config.go
@@ -46,8 +46,8 @@ import (
 )
 
 const (
-	// Default path to snapshotter root dir
-	SociSnapshotterRootPath = "/var/lib/soci-snapshotter-grpc/"
+	// DefaultSociSnapshotterRootPath is the default filesystem path for the snapshotter root directory.
+	DefaultSociSnapshotterRootPath = "/var/lib/soci-snapshotter-grpc/"
 
 	defaultConfigPath = "/etc/soci-snapshotter-grpc/config.toml"
 )
diff --git a/soci/artifacts.go b/soci/artifacts.go
@@ -88,8 +88,11 @@ var (
 )
 
 // Get the default artifacts db path
-func ArtifactsDbPath() string {
-	return path.Join(config.SociSnapshotterRootPath, artifactsDbName)
+func ArtifactsDbPath(root string) string {
+	if root == "" {
+		root = config.DefaultSociSnapshotterRootPath
+	}
+	return path.Join(root, artifactsDbName)
 }
 
 // ArtifactEntry is a metadata object for a SOCI artifact.
@@ -121,20 +124,20 @@ func NewDB(path string) (*ArtifactsDb, error) {
 	once.Do(func() {
 		f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
 		if err != nil {
-			log.G(context.Background()).Errorf("can't create or open the file %s", path)
+			log.G(context.Background()).WithError(err).WithField("path", path).Error("Cannot create or open file")
 			return
 		}
 		defer f.Close()
 		database, err := bolt.Open(f.Name(), 0600, nil)
 		if err != nil {
-			log.G(context.Background()).Errorf("can't open the db")
+			log.G(context.Background()).WithError(err).Error("Cannot open the db")
 			return
 		}
 		db = &ArtifactsDb{db: database}
 	})
 
 	if db == nil {
-		return nil, fmt.Errorf("artifacts.db is not available")
+		return nil, errors.New("artifacts.db is not available")
 	}
 
 	return db, nil
diff --git a/soci/artifacts_test.go b/soci/artifacts_test.go
@@ -98,14 +98,41 @@ func TestGetIndexArtifactEntries(t *testing.T) {
 	}
 }
 
+func TestArtifactDbPath(t *testing.T) {
+	tests := []struct {
+		name     string
+		root     string
+		expected string
+	}{
+		{
+			name:     "default",
+			root:     "",
+			expected: "/var/lib/soci-snapshotter-grpc/artifacts.db",
+		},
+		{
+			name:     "custom",
+			root:     "/tmp",
+			expected: "/tmp/artifacts.db",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := ArtifactsDbPath(test.root); got != test.expected {
+				t.Errorf("ArtifactsDbPath() = %v, want %v", got, test.expected)
+			}
+		})
+	}
+}
+
 func TestArtifactDB_DoesNotExist(t *testing.T) {
 	resetArtifactDBInit()
 	t.Cleanup(resetArtifactDBInit)
 	once.Do(func() {
 		// Fail db initialization.
 		db = nil
 	})
-	_, err := NewDB(ArtifactsDbPath())
+	_, err := NewDB(ArtifactsDbPath(t.TempDir()))
 	if err == nil {
 		t.Fatalf("getArtifactEntry should fail since artifacts.db doesn't exist")
 	}
diff --git a/soci/fs.go b/soci/fs.go
@@ -0,0 +1,43 @@
+/*
+   Copyright The Soci Snapshotter Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package soci
+
+import (
+	"os"
+
+	"github.com/awslabs/soci-snapshotter/config"
+)
+
+// EnsureSnapshotterRootPath ensures that the snapshotter root path exists.
+// It creates the directory with restricted permissions (0711) if it doesn't exist.
+func EnsureSnapshotterRootPath(root string) error {
+	if root == "" {
+		root = config.DefaultSociSnapshotterRootPath
+	}
+
+	// Creating the snapshotter's root path first if it does not exist, since this ensures, that
+	// it has the limited permission set as drwx--x--x.
+	// The subsequent oci.New creates a root path dir with too broad permission set.
+	if _, err := os.Stat(root); os.IsNotExist(err) {
+		if err = os.Mkdir(root, 0700); err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/soci/fs_test.go b/soci/fs_test.go
diff --git a/soci/soci_index.go b/soci/soci_index.go

Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ var infoCommand = cli.Command{`
`44`	`44`	`if err != nil {`
`45`	`45`	`return err`
`46`	`46`	`}`
`47`		`- db, err := soci.NewDB(soci.ArtifactsDbPath())`
	`47`	`+ db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))`
`48`	`48`	`if err != nil {`
`49`	`49`	`return err`
`50`	`50`	`}`
Original file line number	Diff line number	Diff line change
`@@ -132,7 +132,7 @@ var listCommand = cli.Command{`
`132`	`132`	`f = anyMatch(filters)`
`133`	`133`	`}`
`134`	`134`
`135`		`- db, err := soci.NewDB(soci.ArtifactsDbPath())`
	`135`	`+ db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))`
`136`	`136`	`if err != nil {`
`137`	`137`	`return err`
`138`	`138`	`}`
Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,7 @@ var rmCommand = cli.Command{`
`51`	`51`	`return fmt.Errorf("cannot create local content store: %w", err)`
`52`	`52`	`}`
`53`	`53`
`54`		`- db, err := soci.NewDB(soci.ArtifactsDbPath())`
	`54`	`+ db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))`
`55`	`55`	`if err != nil {`
`56`	`56`	`return err`
`57`	`57`	`}`
Original file line number	Diff line number	Diff line change
`@@ -99,7 +99,7 @@ if they are available in the snapshotter's local content store.`
`99`	`99`	`return err`
`100`	`100`	`}`
`101`	`101`
`102`		`- artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath())`
	`102`	`+ artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))`
`103`	`103`	`if err != nil {`
`104`	`104`	`return err`
`105`	`105`	`}`
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ var RebuildDBCommand = cli.Command{`
`41`	`41`	`}`
`42`	`42`	`defer cancel()`
`43`	`43`	`containerdContentStore := client.ContentStore()`
`44`		`- artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath())`
	`44`	`+ artifactsDb, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))`
`45`	`45`	`if err != nil {`
`46`	`46`	`return err`
`47`	`47`	`}`
Original file line number	Diff line number	Diff line change
`@@ -59,7 +59,7 @@ var infoCommand = cli.Command{`
`59`	`59`	`if err != nil {`
`60`	`60`	`return err`
`61`	`61`	`}`
`62`		`- db, err := soci.NewDB(soci.ArtifactsDbPath())`
	`62`	`+ db, err := soci.NewDB(soci.ArtifactsDbPath(cliContext.GlobalString("root")))`
`63`	`63`	`if err != nil {`
`64`	`64`	`return err`
`65`	`65`	`}`