improved Docker compatibility #1

2026-09-05T23:27:43+02:00

mi commented

2026-09-05 23:27:43 +02:00

No description provided.

mi added 10 commits 2026-09-05 23:27:43 +02:00

run: docker semantics for -e KEY and -w DIR d58491422c

-e KEY without a host value is dropped, not passed as KEY="" (docker
does the same). -w DIR is created when missing, as docker does, where
the sandbox is writable: bwrap --dir under a tmpfs or a read-write
bind; elsewhere a missing workdir fails with a clear message instead
of bwrap's "Can't chdir".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

run: --entrypoint, docker semantics 996a2950d3

--entrypoint PROGRAM runs PROGRAM with the positional arguments after
the image as its arguments; --entrypoint "" clears it (a no-op until
images carry ENTRYPOINT/CMD metadata, which the image-metadata issue
adds on top of this).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

store: docker/OCI image references, [registry/]repository[:tag] 0c466cceba

Images are addressed as eclipse-temurin:21, werkator-build:latest or
ghcr.io/example/build:2026.09; the tag defaults to latest. The store
nests them as images/<repository>/<tag>/{rootfs,image.json}; the flat
pre-tag layout is still read as <name>:latest, so existing stores
need no reload. A failed load prunes the repository directories it
created. `images` prints one reference per line in short form
(:latest omitted), which keeps Werkator's exact-line check working.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

import and load: docker's split 877579d79a

werkdock import ARCHIVE [REPOSITORY[:TAG]] creates an image from a
plain rootfs archive (docker import semantics; the store method is
renamed Import). load is docker load's slot for saved docker/OCI
image archives, not implemented yet: it refuses without --name and
keeps accepting a rootfs archive with --name for callers that predate
import (Werkator), with a note. Import recognizes an unpacked docker
save or OCI layout and refuses it, so the two do not blur.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

image metadata: import --change, inspect, run honors ENTRYPOINT/CMD/Env/WorkingDir c4b4866584

Every image stores the execution-relevant part of the OCI image
config (Env, Entrypoint, Cmd, WorkingDir, Labels, architecture, os)
in its image.json; images written before read back with an empty
config. import -c/--change applies ENTRYPOINT, CMD (exec or shell
form), ENV, WORKDIR, LABEL like docker import --change; USER, EXPOSE
and the rest are refused with a reason. inspect IMAGE... prints a
docker-shaped JSON array (RepoTags, Created, Architecture, Os,
Config, plus a Werkdock section). run merges the flags with the
config the docker way: image Env then -e, -w over WorkingDir,
--entrypoint over Entrypoint (dropping Cmd), arguments over Cmd — so
run IMAGE without a command works.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

run: --mount, docker's explicit mount syntax e53ef20067

--mount type=bind,src=SRC,dst=DEST[,readonly] and --mount
type=tmpfs,dst=DEST land on the same ordered mount list as -v and
--tmpfs, with docker's key aliases (source/src, destination/dst/
target, readonly/ro). type=volume and the kernel-tuning keys
(bind-propagation, tmpfs-size, ...) are refused with a reason.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

run: --network host accepted, other modes refused in docker's words c44ea34c55

The sandbox shares the host's network by contract; docker calls that
--network host, so the flag (and --net) is accepted as a no-op. Every
other mode fails with: network mode "X" is not available in
unprivileged shared-webspace environments; only "host" is supported.
-p/--publish stay refused, now explaining that port mapping needs a
network of its own.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CHANGELOG: release notes from the consumer's view 0c6eab8413

What the docker-compat branch changes for callers of the CLI, what
keeps working unchanged (Werkator's images and load -i --name calls),
which new forms are preferred, and what is incompatible.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

RFC 0004: docker-compatible image creation 4973858655

import, load, and later pull end in one image model, a flat rootfs
plus the OCI config; a toolchain is an ordinary image mounted with
docker's --mount type=image (Docker Engine 28), so RFC 0003's
composition stays reachable without a werkdock-only artifact kind.
load of docker save / OCI archives is the first step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

load: docker save and OCI image archives, layers flattened (RFC 0004) 05bb4e7ae5

werkdock load -i ARCHIVE reads the docker save manifest (legacy and
OCI layout) or a plain OCI image layout, applies the layers in order
into one rootfs with whiteout handling, and keeps the OCI config as
the image metadata. Layer extraction is werkdock's own: every path is
resolved inside the rootfs the way the sandbox sees it, following
lower layers' symlinks and clamping .. at the root as a chroot does,
so a hostile layer can rewrite the image but never the host. gzip
layers in-process, zstd through the zstd binary. RepoTags name the
image, each further tag is a hardlinked copy; a multi-arch index picks
the host platform, otherwise the available ones are listed.

Verified against docker 27 save archives of busybox:1.36 and
alpine:3.20, run in the sandbox afterwards.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mi added 1 commit 2026-09-05 23:29:46 +02:00

CHANGELOG: no branch name in the Unreleased heading 39a04c0331

Once merged, the statement would be wrong; the notes describe the
changes as being in.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mi added 1 commit 2026-09-06 13:39:45 +02:00

version 0.2.0: a merge to main is a release 1160d30084

The branch sets the version and titles its CHANGELOG section with it;
nothing on main is unreleased. 0.1.0-dev was the bootstrap.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mi added 1 commit 2026-09-10 13:18:52 +02:00

CHANGELOG: 0.2.0 merge date baa218182a

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mi merged commit a661a33340 into main

2026-09-10 13:19:14 +02:00

mi deleted branch docker-compat

2026-09-10 13:19:14 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkdock#1