brauner / docker-melt Goto Github PK

This is a bit hard to show given #1, but if it did work, you'll end up with the following:

% docker run -it tumbleweed:squashed sh
sh-4.3# useradd user
sh-4.3# su user
bash-4.3$ ping -c1 127.0.0.1
ping: icmp open socket: Operation not permitted

If you check the ping binary with getcap you find that it doesn't have any extended attributes (which it should on an opensuse image).

If I generate a new image using melt:

% docker save opensuse/amd64:tumbleweed > tumbleweed.tar
% ./melt -i tumbleweed.tar -o tumbleweed-squashed.tar -t tmp
% docker import tumbleweed-squashed.tar tumbleweed:squashed
% docker run -it tumbleweed:squashed sh
sh-4.3# useradd user
sh-4.3# su user
su: failed to execute /bin/bash: Permission denied

Which doesn't look right.

If I have a Dockerfile like this:

FROM opensuse/amd64:tumbleweed

RUN truncate --size 200M /somefile
RUN unlink /somefile

The resultant image is 200M larger than is necessary. When using melt the resultant rootfs doesn't appear to realise that the file can be removed. Docker does appear to prioritise removal of files over their creation, which means that this doesn't cause effects like files sticking around even though they were removed.

You might want to look at how "whiteout" files are implemented.