NAME¶

umoci unpack - Unpacks an OCI image tag into an runtime bundle

SYNOPSIS¶

umoci unpack --image=image[:tag] [--rootless] [--uid-map=value] [--uid-map=value] [--keep-dirlinks] bundle

DESCRIPTION¶

Extracts all of the layers (deterministically) to an OCI runtime bundle at the path bundle, as well as generating an OCI runtime configuration that corresponds to the image's configuration. In addition, an mtree(8) specification is generated at the time of unpacking to allow filesystem deltas to be generated by umoci-repack(1) and thus allowing for the creation of layered OCI images.

OPTIONS¶

The global options are defined in umoci(1).

--image=image[:tag]
The OCI image tag which will be extracted to the bundle. image must be a
path to a valid OCI image and tag must be a valid tag in the image. If
tag is not provided it defaults to "latest".

--rootless
Enable rootless unpacking support. This allows for umoci-unpack(1) and
umoci-repack(1) to be used as an unprivileged user. Use of this flag
implies --uid-map=0:$(id -u):1 and --gid-map=0:$(id -g):1, as well as
enabling several features to fake parts of the unpacking in an attempt to
generate an as-close-as-possible extraction of the filesystem. Note that it
is almost always not possible to perfectly extract an OCI image with
--rootless, but it will be as close as possible.

--uid-map=value
Specifies a UID mapping to use while unpacking (and repacking) layers. This
is used in a similar fashion to user_namespaces(7), and is of the form
container:host[:size].

--gid-map=value
Specifies a GID mapping to use while unpacking (and repacking) layers. This
is used in a similar fashion to user_namespaces(7), and is of the form
container:host[:size].

--keep-dirlinks
Instead of overwriting directories which are links to other directories when
higher layers have an explicit directory, just write through the symlink.
This option is inspired by rsync's option of the same name.

EXAMPLE¶

The following downloads an image from a docker(1) registry using skopeo(1), unpacks said image and then creates a new container using the extracted OCI runtime bundle with runc(8). Then, the image is repacked with umoci-repack(1).

% skopeo copy docker://opensuse/amd64:42.2 oci:image:latest
# umoci unpack --image image bundle
# runc run -b bundle ctr
[ container session ]
# umoci repack --image image bundle

With --rootless it is also possible to do the above example without root privileges. umoci will generate a configuration that works with rootless containers in runc(8).

% skopeo copy docker://opensuse/amd64:42.2 oci:image:latest
% umoci unpack --image image --rootless bundle
% runc --root $HOME/runc run -b bundle ctr
[ rootless container session ]
% umoci repack --image image --rootless bundle

SEE ALSO¶

umoci(1), umoci-repack(1), runc(8)