FR: Ability to output oci_image as a .tar file

[reddaly]

As part of migrating from rules_docker to rules_oci, I would like to list the contents of the file system of an image produced by oci_image. I'm not finding an easy way to do this.

I tried to use crane export to create a tarball from the image directory output by oci_image. However, Crane doesn't accept the image directory output by rules_oci as an argument to crane export (see google/go-containerregistry#1992).

[thesayyn]

We have oci_load rule that you can use in combination with filegroup to get a .tar file. It's not likely that we are gonna make oci_image output a tar file as we learned that it is a recipe for disaster.

And as for filesystem inspection, you can use https://github.com/wagoodman/dive

Since, you can do this already today by creating a macro in your repo, there is nothing to fix here.

[reddaly]

What issues did you find with a .tar target?

[thesayyn]

What issues did you find with a .tar target?

It is IO heavy, when there is multiple .tar targets building simultaneously, it creates huge IO load. Even in a single bit change in oci_image layers leads to recreation of the said tarball.

I have seen people;

• Nuke the remote cache because they upgraded their base images
• Have painfully slow CI, because a layer in the oci_image 5 level down has changed.

[hypdeb]

I'm looking for a way of creating sysroots for a cc_toolchain and landed here. Would this feature allow me to use the filesystem of the image as said sysroot by extracting the .tar? Is this use-case already covered by another rule?

[thesayyn]

No, there is no rule in rules_oci that would allow you do flatten and extract layers from a base image.

[thesayyn]

I am going to close this issue as this is already supported by oci_load.

[andyliuliming]

looks like the file exported by the oci_load is in "docker" format instead of "oci"?
so the **.json.sha256 is different with the sha256 of the exported tar which may cause problem

[thesayyn]

so the **.json.sha256 is different with the sha256 of the exported tar which may cause problem

please see #617