build multi-arch s9pks (#2601)

* build multi-arch s9pks

* remove images incrementally

* wip

* prevent rebuild

* fix sdk makefile

* fix hanging on uninstall

* fix build

* fix build

* fix build

* fix build (for real this time)

* fix git hash computation

core/startos/src/s9pk/rpc.rs

@@ -1,3 +1,4 @@
+use std::collections::BTreeSet;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
@@ -60,6 +61,10 @@ fn inspect() -> ParentHandler<S9pkPath> {
                 .with_inherited(only_parent)
                 .with_display_serializable(),
         )
+        .subcommand(
+            "cat",
+            from_fn_async(cat).with_inherited(only_parent).no_display(),
+        )
         .subcommand(
             "manifest",
             from_fn_async(inspect_manifest)
@@ -72,109 +77,116 @@ fn inspect() -> ParentHandler<S9pkPath> {
 struct AddImageParams {
     id: ImageId,
     image: String,
+    arches: Option<Vec<String>>,
 }
 async fn add_image(
     ctx: CliContext,
-    AddImageParams { id, image }: AddImageParams,
+    AddImageParams { id, image, arches }: AddImageParams,
     S9pkPath { s9pk: s9pk_path }: S9pkPath,
 ) -> Result<(), Error> {
+    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?, false)
+        .await?
+        .into_dyn();
+    let arches: BTreeSet<_> = arches
+        .unwrap_or_else(|| vec!["x86_64".to_owned(), "aarch64".to_owned()])
+        .into_iter()
+        .collect();
     let tmpdir = TmpDir::new().await?;
-    let sqfs_path = tmpdir.join("image.squashfs");
-    let arch = String::from_utf8(
-        Command::new(CONTAINER_TOOL)
-            .arg("run")
-            .arg("--rm")
-            .arg("--entrypoint")
-            .arg("uname")
-            .arg(&image)
-            .arg("-m")
-            .invoke(ErrorKind::Docker)
-            .await?,
-    )?;
-    let env = String::from_utf8(
-        Command::new(CONTAINER_TOOL)
-            .arg("run")
-            .arg("--rm")
-            .arg("--entrypoint")
-            .arg("env")
-            .arg(&image)
-            .invoke(ErrorKind::Docker)
-            .await?,
-    )?
-    .lines()
-    .filter(|l| {
-        l.trim()
-            .split_once("=")
-            .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
-    })
-    .join("\n")
-        + "\n";
-    let workdir = Path::new(
-        String::from_utf8(
+    for arch in arches {
+        let sqfs_path = tmpdir.join(format!("image.{arch}.squashfs"));
+        let docker_platform = if arch == "x86_64" {
+            "--platform=linux/amd64".to_owned()
+        } else if arch == "aarch64" {
+            "--platform=linux/arm64".to_owned()
+        } else {
+            format!("--platform=linux/{arch}")
+        };
+        let env = String::from_utf8(
             Command::new(CONTAINER_TOOL)
                 .arg("run")
                 .arg("--rm")
+                .arg(&docker_platform)
                 .arg("--entrypoint")
-                .arg("pwd")
+                .arg("env")
                 .arg(&image)
                 .invoke(ErrorKind::Docker)
                 .await?,
         )?
-        .trim(),
-    )
-    .to_owned();
-    let container_id = String::from_utf8(
-        Command::new(CONTAINER_TOOL)
-            .arg("create")
-            .arg(&image)
+        .lines()
+        .filter(|l| {
+            l.trim()
+                .split_once("=")
+                .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
+        })
+        .join("\n")
+            + "\n";
+        let workdir = Path::new(
+            String::from_utf8(
+                Command::new(CONTAINER_TOOL)
+                    .arg("run")
+                    .arg(&docker_platform)
+                    .arg("--rm")
+                    .arg("--entrypoint")
+                    .arg("pwd")
+                    .arg(&image)
+                    .invoke(ErrorKind::Docker)
+                    .await?,
+            )?
+            .trim(),
+        )
+        .to_owned();
+        let container_id = String::from_utf8(
+            Command::new(CONTAINER_TOOL)
+                .arg("create")
+                .arg(&docker_platform)
+                .arg(&image)
+                .invoke(ErrorKind::Docker)
+                .await?,
+        )?;
+        Command::new("bash")
+            .arg("-c")
+            .arg(format!(
+                "{CONTAINER_TOOL} export {container_id} | mksquashfs - {sqfs} -tar",
+                container_id = container_id.trim(),
+                sqfs = sqfs_path.display()
+            ))
             .invoke(ErrorKind::Docker)
-            .await?,
-    )?;
-    Command::new("bash")
-        .arg("-c")
-        .arg(format!(
-            "{CONTAINER_TOOL} export {container_id} | mksquashfs - {sqfs} -tar",
-            container_id = container_id.trim(),
-            sqfs = sqfs_path.display()
-        ))
-        .invoke(ErrorKind::Docker)
-        .await?;
-    Command::new(CONTAINER_TOOL)
-        .arg("rm")
-        .arg(container_id.trim())
-        .invoke(ErrorKind::Docker)
-        .await?;
-    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?)
-        .await?
-        .into_dyn();
-    let archive = s9pk.as_archive_mut();
-    archive.set_signer(ctx.developer_key()?.clone());
-    archive.contents_mut().insert_path(
-        Path::new("images")
-            .join(arch.trim())
-            .join(&id)
-            .with_extension("squashfs"),
-        Entry::file(DynFileSource::new(sqfs_path)),
-    )?;
-    archive.contents_mut().insert_path(
-        Path::new("images")
-            .join(arch.trim())
-            .join(&id)
-            .with_extension("env"),
-        Entry::file(DynFileSource::new(Arc::from(Vec::from(env)))),
-    )?;
-    archive.contents_mut().insert_path(
-        Path::new("images")
-            .join(arch.trim())
-            .join(&id)
-            .with_extension("json"),
-        Entry::file(DynFileSource::new(Arc::from(
-            serde_json::to_vec(&serde_json::json!({
-                "workdir": workdir
-            }))
-            .with_kind(ErrorKind::Serialization)?,
-        ))),
-    )?;
+            .await?;
+        Command::new(CONTAINER_TOOL)
+            .arg("rm")
+            .arg(container_id.trim())
+            .invoke(ErrorKind::Docker)
+            .await?;
+        let archive = s9pk.as_archive_mut();
+        archive.set_signer(ctx.developer_key()?.clone());
+        archive.contents_mut().insert_path(
+            Path::new("images")
+                .join(&arch)
+                .join(&id)
+                .with_extension("squashfs"),
+            Entry::file(DynFileSource::new(sqfs_path)),
+        )?;
+        archive.contents_mut().insert_path(
+            Path::new("images")
+                .join(&arch)
+                .join(&id)
+                .with_extension("env"),
+            Entry::file(DynFileSource::new(Arc::from(Vec::from(env)))),
+        )?;
+        archive.contents_mut().insert_path(
+            Path::new("images")
+                .join(&arch)
+                .join(&id)
+                .with_extension("json"),
+            Entry::file(DynFileSource::new(Arc::from(
+                serde_json::to_vec(&serde_json::json!({
+                    "workdir": workdir
+                }))
+                .with_kind(ErrorKind::Serialization)?,
+            ))),
+        )?;
+    }
+    s9pk.as_manifest_mut().images.insert(id);
     let tmp_path = s9pk_path.with_extension("s9pk.tmp");
     let mut tmp_file = File::create(&tmp_path).await?;
     s9pk.serialize(&mut tmp_file, true).await?;
@@ -193,7 +205,7 @@ async fn edit_manifest(
     EditManifestParams { expression }: EditManifestParams,
     S9pkPath { s9pk: s9pk_path }: S9pkPath,
 ) -> Result<Manifest, Error> {
-    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?).await?;
+    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?, false).await?;
     let old = serde_json::to_value(s9pk.as_manifest()).with_kind(ErrorKind::Serialization)?;
     *s9pk.as_manifest_mut() = serde_json::from_value(apply_expr(old.into(), &expression)?.into())
         .with_kind(ErrorKind::Serialization)?;
@@ -214,15 +226,45 @@ async fn file_tree(
     _: Empty,
     S9pkPath { s9pk }: S9pkPath,
 ) -> Result<Vec<PathBuf>, Error> {
-    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?).await?;
+    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?, false).await?;
     Ok(s9pk.as_archive().contents().file_paths(""))
 }
 
+#[derive(Deserialize, Serialize, Parser, TS)]
+#[serde(rename_all = "camelCase")]
+#[command(rename_all = "kebab-case")]
+struct CatParams {
+    file_path: PathBuf,
+}
+async fn cat(
+    ctx: CliContext,
+    CatParams { file_path }: CatParams,
+    S9pkPath { s9pk }: S9pkPath,
+) -> Result<(), Error> {
+    use crate::s9pk::merkle_archive::source::FileSource;
+
+    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?, false).await?;
+    tokio::io::copy(
+        &mut s9pk
+            .as_archive()
+            .contents()
+            .get_path(&file_path)
+            .or_not_found(&file_path.display())?
+            .as_file()
+            .or_not_found(&file_path.display())?
+            .reader()
+            .await?,
+        &mut tokio::io::stdout(),
+    )
+    .await?;
+    Ok(())
+}
+
 async fn inspect_manifest(
     ctx: CliContext,
     _: Empty,
     S9pkPath { s9pk }: S9pkPath,
 ) -> Result<Manifest, Error> {
-    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?).await?;
+    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?, false).await?;
     Ok(s9pk.as_manifest().clone())
 }

core/startos/src/s9pk/v1/docker.rs

@@ -1,4 +1,3 @@
-use std::borrow::Cow;
 use std::collections::BTreeSet;
 use std::io::SeekFrom;
 use std::path::Path;
@@ -10,7 +9,7 @@ use tokio::io::{AsyncRead, AsyncSeek, AsyncSeekExt};
 use tokio_tar::{Archive, Entry};
 
 use crate::util::io::from_cbor_async_reader;
-use crate::{Error, ErrorKind, ARCH};
+use crate::{Error, ErrorKind};
 
 #[derive(Default, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -26,8 +25,8 @@ pub enum DockerReader<R: AsyncRead + Unpin> {
     MultiArch(#[pin] Entry<Archive<R>>),
 }
 impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> DockerReader<R> {
-    pub async fn new(mut rdr: R) -> Result<Self, Error> {
-        let arch = if let Some(multiarch) = tokio_tar::Archive::new(&mut rdr)
+    pub async fn list_arches(rdr: &mut R) -> Result<BTreeSet<String>, Error> {
+        if let Some(multiarch) = tokio_tar::Archive::new(rdr)
             .entries()?
             .try_filter_map(|e| {
                 async move {
@@ -43,41 +42,38 @@ impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> DockerReader<R> {
             .await?
         {
             let multiarch: DockerMultiArch = from_cbor_async_reader(multiarch).await?;
-            Some(if multiarch.available.contains(&**ARCH) {
-                Cow::Borrowed(&**ARCH)
-            } else {
-                Cow::Owned(multiarch.default)
-            })
+            Ok(multiarch.available)
         } else {
-            None
-        };
+            Err(Error::new(
+                eyre!("Single arch legacy s9pks not supported"),
+                ErrorKind::ParseS9pk,
+            ))
+        }
+    }
+    pub async fn new(mut rdr: R, arch: &str) -> Result<Self, Error> {
         rdr.seek(SeekFrom::Start(0)).await?;
-        if let Some(arch) = arch {
-            if let Some(image) = tokio_tar::Archive::new(rdr)
-                .entries()?
-                .try_filter_map(|e| {
-                    let arch = arch.clone();
-                    async move {
-                        Ok(if &*e.path()? == Path::new(&format!("{}.tar", arch)) {
-                            Some(e)
-                        } else {
-                            None
-                        })
-                    }
-                    .boxed()
-                })
-                .try_next()
-                .await?
-            {
-                Ok(Self::MultiArch(image))
-            } else {
-                Err(Error::new(
-                    eyre!("Docker image section does not contain tarball for architecture"),
-                    ErrorKind::ParseS9pk,
-                ))
-            }
+        if let Some(image) = tokio_tar::Archive::new(rdr)
+            .entries()?
+            .try_filter_map(|e| {
+                let arch = arch.clone();
+                async move {
+                    Ok(if &*e.path()? == Path::new(&format!("{}.tar", arch)) {
+                        Some(e)
+                    } else {
+                        None
+                    })
+                }
+                .boxed()
+            })
+            .try_next()
+            .await?
+        {
+            Ok(Self::MultiArch(image))
         } else {
-            Ok(Self::SingleArch(rdr))
+            Err(Error::new(
+                eyre!("Docker image section does not contain tarball for architecture"),
+                ErrorKind::ParseS9pk,
+            ))
         }
     }
 }

core/startos/src/s9pk/v1/reader.rs

@@ -1,3 +1,4 @@
+use std::collections::BTreeSet;
 use std::io::SeekFrom;
 use std::ops::Range;
 use std::path::Path;
@@ -158,8 +159,8 @@ impl S9pkReader {
 }
 impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> S9pkReader<R> {
     #[instrument(skip_all)]
-    pub async fn image_tags(&mut self) -> Result<Vec<ImageTag>, Error> {
-        let mut tar = tokio_tar::Archive::new(self.docker_images().await?);
+    pub async fn image_tags(&mut self, arch: &str) -> Result<Vec<ImageTag>, Error> {
+        let mut tar = tokio_tar::Archive::new(self.docker_images(arch).await?);
         let mut entries = tar.entries()?;
         while let Some(mut entry) = entries.try_next().await? {
             if &*entry.path()? != Path::new("manifest.json") {
@@ -280,8 +281,15 @@ impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> S9pkReader<R> {
         self.read_handle(self.toc.icon).await
     }
 
-    pub async fn docker_images(&mut self) -> Result<DockerReader<ReadHandle<'_, R>>, Error> {
-        DockerReader::new(self.read_handle(self.toc.docker_images).await?).await
+    pub async fn docker_arches(&mut self) -> Result<BTreeSet<String>, Error> {
+        DockerReader::list_arches(&mut self.read_handle(self.toc.docker_images).await?).await
+    }
+
+    pub async fn docker_images(
+        &mut self,
+        arch: &str,
+    ) -> Result<DockerReader<ReadHandle<'_, R>>, Error> {
+        DockerReader::new(self.read_handle(self.toc.docker_images).await?, arch).await
     }
 
     pub async fn assets(&mut self) -> Result<ReadHandle<'_, R>, Error> {

core/startos/src/s9pk/v2/compat.rs

@@ -21,7 +21,6 @@ use crate::s9pk::v1::reader::S9pkReader;
 use crate::s9pk::v2::S9pk;
 use crate::util::io::TmpDir;
 use crate::util::Invoke;
-use crate::ARCH;
 
 pub const MAGIC_AND_VERSION: &[u8] = &[0x3b, 0x3b, 0x01];
 
@@ -96,155 +95,166 @@ impl S9pk<Section<MultiCursorFile>> {
         )?;
 
         // images
-        let images_dir = scratch_dir.join("images");
-        tokio::fs::create_dir_all(&images_dir).await?;
-        Command::new(CONTAINER_TOOL)
-            .arg("load")
-            .input(Some(&mut reader.docker_images().await?))
-            .invoke(ErrorKind::Docker)
-            .await?;
-        #[derive(serde::Deserialize)]
-        #[serde(rename_all = "PascalCase")]
-        struct DockerImagesOut {
-            repository: Option<String>,
-            tag: Option<String>,
-            #[serde(default)]
-            names: Vec<String>,
-        }
-        for image in {
-            #[cfg(feature = "docker")]
-            let images = std::str::from_utf8(
-                &Command::new(CONTAINER_TOOL)
-                    .arg("images")
-                    .arg("--format=json")
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )?
-            .lines()
-            .map(|l| serde_json::from_str::<DockerImagesOut>(l))
-            .collect::<Result<Vec<_>, _>>()
-            .with_kind(ErrorKind::Deserialization)?
-            .into_iter();
-            #[cfg(not(feature = "docker"))]
-            let images = serde_json::from_slice::<Vec<DockerImagesOut>>(
-                &Command::new(CONTAINER_TOOL)
-                    .arg("images")
-                    .arg("--format=json")
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )
-            .with_kind(ErrorKind::Deserialization)?
-            .into_iter();
-            images
-        }
-        .flat_map(|i| {
-            if let (Some(repository), Some(tag)) = (i.repository, i.tag) {
-                vec![format!("{repository}:{tag}")]
+        for arch in reader.docker_arches().await? {
+            let images_dir = scratch_dir.join("images").join(&arch);
+            let docker_platform = if arch == "x86_64" {
+                "--platform=linux/amd64".to_owned()
+            } else if arch == "aarch64" {
+                "--platform=linux/arm64".to_owned()
             } else {
-                i.names
-                    .into_iter()
-                    .filter_map(|i| i.strip_prefix("docker.io/").map(|s| s.to_owned()))
-                    .collect()
+                format!("--platform=linux/{arch}")
+            };
+            tokio::fs::create_dir_all(&images_dir).await?;
+            Command::new(CONTAINER_TOOL)
+                .arg("load")
+                .input(Some(&mut reader.docker_images(&arch).await?))
+                .invoke(ErrorKind::Docker)
+                .await?;
+            #[derive(serde::Deserialize)]
+            #[serde(rename_all = "PascalCase")]
+            struct DockerImagesOut {
+                repository: Option<String>,
+                tag: Option<String>,
+                #[serde(default)]
+                names: Vec<String>,
             }
-        })
-        .filter_map(|i| {
-            i.strip_suffix(&format!(":{}", manifest.version))
-                .map(|s| s.to_owned())
-        })
-        .filter_map(|i| {
-            i.strip_prefix(&format!("start9/{}/", manifest.id))
-                .map(|s| s.to_owned())
-        }) {
-            new_manifest.images.insert(image.parse()?);
-            let sqfs_path = images_dir.join(&image).with_extension("squashfs");
-            let image_name = format!("start9/{}/{}:{}", manifest.id, image, manifest.version);
-            let id = String::from_utf8(
-                Command::new(CONTAINER_TOOL)
-                    .arg("create")
-                    .arg(&image_name)
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )?;
-            let env = String::from_utf8(
-                Command::new(CONTAINER_TOOL)
-                    .arg("run")
-                    .arg("--rm")
-                    .arg("--entrypoint")
-                    .arg("env")
-                    .arg(&image_name)
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )?
-            .lines()
-            .filter(|l| {
-                l.trim()
-                    .split_once("=")
-                    .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
+            for image in {
+                #[cfg(feature = "docker")]
+                let images = std::str::from_utf8(
+                    &Command::new(CONTAINER_TOOL)
+                        .arg("images")
+                        .arg("--format=json")
+                        .invoke(ErrorKind::Docker)
+                        .await?,
+                )?
+                .lines()
+                .map(|l| serde_json::from_str::<DockerImagesOut>(l))
+                .collect::<Result<Vec<_>, _>>()
+                .with_kind(ErrorKind::Deserialization)?
+                .into_iter();
+                #[cfg(not(feature = "docker"))]
+                let images = serde_json::from_slice::<Vec<DockerImagesOut>>(
+                    &Command::new(CONTAINER_TOOL)
+                        .arg("images")
+                        .arg("--format=json")
+                        .invoke(ErrorKind::Docker)
+                        .await?,
+                )
+                .with_kind(ErrorKind::Deserialization)?
+                .into_iter();
+                images
+            }
+            .flat_map(|i| {
+                if let (Some(repository), Some(tag)) = (i.repository, i.tag) {
+                    vec![format!("{repository}:{tag}")]
+                } else {
+                    i.names
+                        .into_iter()
+                        .filter_map(|i| i.strip_prefix("docker.io/").map(|s| s.to_owned()))
+                        .collect()
+                }
             })
-            .join("\n")
-                + "\n";
-            let workdir = Path::new(
-                String::from_utf8(
+            .filter_map(|i| {
+                i.strip_suffix(&format!(":{}", manifest.version))
+                    .map(|s| s.to_owned())
+            })
+            .filter_map(|i| {
+                i.strip_prefix(&format!("start9/{}/", manifest.id))
+                    .map(|s| s.to_owned())
+            }) {
+                new_manifest.images.insert(image.parse()?);
+                let sqfs_path = images_dir.join(&image).with_extension("squashfs");
+                let image_name = format!("start9/{}/{}:{}", manifest.id, image, manifest.version);
+                let id = String::from_utf8(
+                    Command::new(CONTAINER_TOOL)
+                        .arg("create")
+                        .arg(&docker_platform)
+                        .arg(&image_name)
+                        .invoke(ErrorKind::Docker)
+                        .await?,
+                )?;
+                let env = String::from_utf8(
                     Command::new(CONTAINER_TOOL)
                         .arg("run")
                         .arg("--rm")
+                        .arg(&docker_platform)
                         .arg("--entrypoint")
-                        .arg("pwd")
+                        .arg("env")
                         .arg(&image_name)
                         .invoke(ErrorKind::Docker)
                         .await?,
                 )?
-                .trim(),
-            )
-            .to_owned();
-            Command::new("bash")
-                .arg("-c")
-                .arg(format!(
-                    "{CONTAINER_TOOL} export {id} | mksquashfs - {sqfs} -tar",
-                    id = id.trim(),
-                    sqfs = sqfs_path.display()
-                ))
-                .invoke(ErrorKind::Docker)
-                .await?;
-            Command::new(CONTAINER_TOOL)
-                .arg("rm")
-                .arg(id.trim())
-                .invoke(ErrorKind::Docker)
-                .await?;
-            archive.insert_path(
-                Path::new("images")
-                    .join(&*ARCH)
-                    .join(&image)
-                    .with_extension("squashfs"),
-                Entry::file(CompatSource::File(sqfs_path)),
-            )?;
-            archive.insert_path(
-                Path::new("images")
-                    .join(&*ARCH)
-                    .join(&image)
-                    .with_extension("env"),
-                Entry::file(CompatSource::Buffered(Vec::from(env).into())),
-            )?;
-            archive.insert_path(
-                Path::new("images")
-                    .join(&*ARCH)
-                    .join(&image)
-                    .with_extension("json"),
-                Entry::file(CompatSource::Buffered(
-                    serde_json::to_vec(&serde_json::json!({
-                        "workdir": workdir
-                    }))
-                    .with_kind(ErrorKind::Serialization)?
-                    .into(),
-                )),
-            )?;
+                .lines()
+                .filter(|l| {
+                    l.trim()
+                        .split_once("=")
+                        .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
+                })
+                .join("\n")
+                    + "\n";
+                let workdir = Path::new(
+                    String::from_utf8(
+                        Command::new(CONTAINER_TOOL)
+                            .arg("run")
+                            .arg("--rm")
+                            .arg(&docker_platform)
+                            .arg("--entrypoint")
+                            .arg("pwd")
+                            .arg(&image_name)
+                            .invoke(ErrorKind::Docker)
+                            .await?,
+                    )?
+                    .trim(),
+                )
+                .to_owned();
+                Command::new("bash")
+                    .arg("-c")
+                    .arg(format!(
+                        "{CONTAINER_TOOL} export {id} | mksquashfs - {sqfs} -tar",
+                        id = id.trim(),
+                        sqfs = sqfs_path.display()
+                    ))
+                    .invoke(ErrorKind::Docker)
+                    .await?;
+                Command::new(CONTAINER_TOOL)
+                    .arg("rm")
+                    .arg(id.trim())
+                    .invoke(ErrorKind::Docker)
+                    .await?;
+                archive.insert_path(
+                    Path::new("images")
+                        .join(&arch)
+                        .join(&image)
+                        .with_extension("squashfs"),
+                    Entry::file(CompatSource::File(sqfs_path)),
+                )?;
+                archive.insert_path(
+                    Path::new("images")
+                        .join(&arch)
+                        .join(&image)
+                        .with_extension("env"),
+                    Entry::file(CompatSource::Buffered(Vec::from(env).into())),
+                )?;
+                archive.insert_path(
+                    Path::new("images")
+                        .join(&arch)
+                        .join(&image)
+                        .with_extension("json"),
+                    Entry::file(CompatSource::Buffered(
+                        serde_json::to_vec(&serde_json::json!({
+                            "workdir": workdir
+                        }))
+                        .with_kind(ErrorKind::Serialization)?
+                        .into(),
+                    )),
+                )?;
+                Command::new(CONTAINER_TOOL)
+                    .arg("rmi")
+                    .arg(&image_name)
+                    .invoke(ErrorKind::Docker)
+                    .await?;
+            }
         }
-        Command::new(CONTAINER_TOOL)
-            .arg("image")
-            .arg("prune")
-            .arg("-af")
-            .invoke(ErrorKind::Docker)
-            .await?;
 
         // assets
         let asset_dir = scratch_dir.join("assets");
@@ -312,9 +322,10 @@ impl S9pk<Section<MultiCursorFile>> {
 
         scratch_dir.delete().await?;
 
-        Ok(S9pk::deserialize(&MultiCursorFile::from(
-            File::open(destination.as_ref()).await?,
-        ))
+        Ok(S9pk::deserialize(
+            &MultiCursorFile::from(File::open(destination.as_ref()).await?),
+            false,
+        )
         .await?)
     }
 }

core/startos/src/s9pk/v2/mod.rs

@@ -173,7 +173,7 @@ impl<S: FileSource> S9pk<S> {
 
 impl<S: ArchiveSource> S9pk<Section<S>> {
     #[instrument(skip_all)]
-    pub async fn deserialize(source: &S) -> Result<Self, Error> {
+    pub async fn deserialize(source: &S, apply_filter: bool) -> Result<Self, Error> {
         use tokio::io::AsyncReadExt;
 
         let mut header = source
@@ -193,7 +193,9 @@ impl<S: ArchiveSource> S9pk<Section<S>> {
 
         let mut archive = MerkleArchive::deserialize(source, &mut header).await?;
 
-        archive.filter(filter)?;
+        if apply_filter {
+            archive.filter(filter)?;
+        }
 
         archive.sort_by(|a, b| match (priority(a), priority(b)) {
             (Some(a), Some(b)) => a.cmp(&b),
@@ -206,11 +208,15 @@ impl<S: ArchiveSource> S9pk<Section<S>> {
     }
 }
 impl S9pk {
-    pub async fn from_file(file: File) -> Result<Self, Error> {
-        Self::deserialize(&MultiCursorFile::from(file)).await
+    pub async fn from_file(file: File, apply_filter: bool) -> Result<Self, Error> {
+        Self::deserialize(&MultiCursorFile::from(file), apply_filter).await
     }
-    pub async fn open(path: impl AsRef<Path>, id: Option<&PackageId>) -> Result<Self, Error> {
-        let res = Self::from_file(tokio::fs::File::open(path).await?).await?;
+    pub async fn open(
+        path: impl AsRef<Path>,
+        id: Option<&PackageId>,
+        apply_filter: bool,
+    ) -> Result<Self, Error> {
+        let res = Self::from_file(tokio::fs::File::open(path).await?, apply_filter).await?;
         if let Some(id) = id {
             ensure_code!(
                 &res.as_manifest().id == id,