Add a `transaction-overlayfs` helper script to the Docker images by jviotti · Pull Request #706 · sourcemeta/one

jviotti · 2026-03-04T18:33:55Z

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

augmentcode · 2026-03-04T18:36:24Z

🤖 Augment PR Summary

Summary: This PR ships a new Docker helper, sourcemeta-transaction-overlayfs, intended to run a command against a transactional overlay on top of the configured output directory.

Changes:

Adds docker/transaction-overlayfs.sh which mounts an overlayfs over an output directory, rewrites matching command arguments to the merged path, and conditionally merges changes back on success
Copies the helper into the standard image (/usr/bin/sourcemeta-transaction-overlayfs)
Copies the helper into the enterprise image as well

Technical Notes: The script uses kernel overlayfs (mount -t overlay) and then merges the upper layer back into the original directory after unmounting.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 4 suggestions posted.

Comment augment review to trigger a new review at any time.

enterprise/Dockerfile

docker/transaction-overlayfs.sh

augmentcode · 2026-03-04T18:36:25Z

docker/transaction-overlayfs.sh

+mkdir -p "$OVERLAY_UPPER" "$OVERLAY_WORK" "$OVERLAY_MERGED"
+
+TIME_START=$(date +%s%3N)
+mount -t overlay overlay \


With set -o errexit, failures after a successful mount (e.g., umount busy, cp error, etc.) can exit the script without cleaning up $OVERLAY_DIR (and potentially without unmounting). Consider a trap to always attempt umount and remove the temp directory on any exit path.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-03-04T18:36:25Z

docker/transaction-overlayfs.sh

+fi
+
+TIME_START=$(date +%s%3N)
+cp -a "$OVERLAY_UPPER"/. "$OUTPUT_DIR/"


The “merge” step cp -a "$OVERLAY_UPPER"/. "$OUTPUT_DIR"/ won’t apply overlayfs deletion/whiteout semantics, so files deleted during the transaction may remain in $OUTPUT_DIR (or whiteout entries may be copied through). That can break the intended transactional behavior for deletes/renames.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

cubic-dev-ai

3 issues found across 3 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docker/transaction-overlayfs.sh">

<violation number="1" location="docker/transaction-overlayfs.sh:33">
P2: With `set -o errexit` enabled, if any command fails after the overlayfs is mounted (e.g., `umount` returns busy, `cp` encounters an error), the script will exit immediately without cleaning up `$OVERLAY_DIR` or unmounting the filesystem. Add a `trap` handler (e.g., `trap 'umount "$OVERLAY_MERGED" 2>/dev/null; rm -rf "$OVERLAY_DIR"' EXIT`) after the mount succeeds to ensure cleanup on all exit paths.</violation>

<violation number="2" location="docker/transaction-overlayfs.sh:50">
P1: The argument-rewrite loop reorders arguments by appending each processed argument to the end of the remaining list, so the command receives a different argument order than the caller provided.</violation>

<violation number="3" location="docker/transaction-overlayfs.sh:76">
P2: Copying only the upper layer does not propagate deletions from the overlay, so removed files remain in the output directory after a successful transaction.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-04T18:40:25Z

docker/transaction-overlayfs.sh

+  shift
+  if [ "$CURRENT" = "$OUTPUT_DIR" ]
+  then
+    set -- "$@" "$OVERLAY_MERGED"


P1: The argument-rewrite loop reorders arguments by appending each processed argument to the end of the remaining list, so the command receives a different argument order than the caller provided.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docker/transaction-overlayfs.sh, line 50: <comment>The argument-rewrite loop reorders arguments by appending each processed argument to the end of the remaining list, so the command receives a different argument order than the caller provided.</comment> <file context> @@ -0,0 +1,83 @@ + shift + if [ "$CURRENT" = "$OUTPUT_DIR" ] + then + set -- "$@" "$OVERLAY_MERGED" + else + set -- "$@" "$CURRENT" </file context>

docker/transaction-overlayfs.sh

cubic-dev-ai

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docker/transaction-overlayfs.sh">

<violation number="1" location="docker/transaction-overlayfs.sh:91">
P1: `find -type c` matches **all** character devices, not just overlayfs whiteouts (major:minor `0:0`). If the wrapped command creates a legitimate character device, it will be mistakenly deleted from both the upper layer and `OUTPUT_DIR`. Filter by device number to match only actual whiteouts.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-04T18:46:55Z

docker/transaction-overlayfs.sh

+find "$OVERLAY_UPPER" -type c | while read -r WHITEOUT_PATH
+do
+  RELATIVE_PATH="${WHITEOUT_PATH#$OVERLAY_UPPER/}"
+  rm -rf "${OUTPUT_DIR:?}/$RELATIVE_PATH"
+  rm "$WHITEOUT_PATH"
+done


P1: find -type c matches all character devices, not just overlayfs whiteouts (major:minor 0:0). If the wrapped command creates a legitimate character device, it will be mistakenly deleted from both the upper layer and OUTPUT_DIR. Filter by device number to match only actual whiteouts.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docker/transaction-overlayfs.sh, line 91: <comment>`find -type c` matches **all** character devices, not just overlayfs whiteouts (major:minor `0:0`). If the wrapped command creates a legitimate character device, it will be mistakenly deleted from both the upper layer and `OUTPUT_DIR`. Filter by device number to match only actual whiteouts.</comment> <file context> @@ -60,24 +75,26 @@ echo "transaction(overlayfs): command took $((TIME_END - TIME_START))ms" >&2 + +# Process overlayfs whiteouts (file deletions) in the upper layer. +# Whiteouts are character devices with major:minor 0:0 +find "$OVERLAY_UPPER" -type c | while read -r WHITEOUT_PATH +do + RELATIVE_PATH="${WHITEOUT_PATH#$OVERLAY_UPPER/}" </file context>

Suggested change

find "$OVERLAY_UPPER" -type c | while read -r WHITEOUT_PATH

do

RELATIVE_PATH="${WHITEOUT_PATH#$OVERLAY_UPPER/}"

rm -rf "${OUTPUT_DIR:?}/$RELATIVE_PATH"

rm "$WHITEOUT_PATH"

done

find "$OVERLAY_UPPER" -type c | while read -r WHITEOUT_PATH

do

# Verify this is actually a whiteout (major:minor 0:0)

MAJOR_MINOR=$(stat -c '%t:%T' "$WHITEOUT_PATH" 2>/dev/null) || continue

[ "$MAJOR_MINOR" = "0:0" ] || continue

RELATIVE_PATH="${WHITEOUT_PATH#$OVERLAY_UPPER/}"

rm -rf "${OUTPUT_DIR:?}/$RELATIVE_PATH"

rm "$WHITEOUT_PATH"

done

github-actions

Benchmark Index (community)

Details

Benchmark suite	Current: `9e3009e`	Previous: `2899731`	Ratio
`Add one schema (0 existing)`	`41` ms	`51` ms	`0.80`
`Add one schema (100 existing)`	`401` ms	`438` ms	`0.92`
`Add one schema (1000 existing)`	`4155` ms	`4472` ms	`0.93`

This comment was automatically generated by workflow using github-action-benchmark.

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions

Benchmark Index (enterprise)

Details

Benchmark suite	Current: `9e3009e`	Previous: `2899731`	Ratio
`Add one schema (0 existing)`	`44` ms	`50` ms	`0.88`
`Add one schema (100 existing)`	`413` ms	`415` ms	`1.00`
`Add one schema (1000 existing)`	`4129` ms	`4460` ms	`0.93`

This comment was automatically generated by workflow using github-action-benchmark.

Add a transaction-overlayfs helper script to the Docker images

82b6b56

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

augmentcode bot reviewed Mar 4, 2026

View reviewed changes

cubic-dev-ai bot reviewed Mar 4, 2026

View reviewed changes

github-actions bot reviewed Mar 4, 2026

View reviewed changes

Fixes

9e3009e

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

jviotti force-pushed the transaction-overlayfs branch from c9dbc8d to 9e3009e Compare March 4, 2026 19:01

github-actions bot reviewed Mar 4, 2026

View reviewed changes

jviotti merged commit 7f15cc3 into main Mar 4, 2026
5 checks passed

jviotti deleted the transaction-overlayfs branch March 4, 2026 19:16

Uh oh!

Conversation

jviotti commented Mar 4, 2026

Uh oh!

augmentcode bot commented Mar 4, 2026

Uh oh!

augmentcode bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

augmentcode bot Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode bot Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Benchmark Index (community)

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Benchmark Index (enterprise)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cubic-dev-ai bot Mar 4, 2026 •

edited

Loading

cubic-dev-ai bot Mar 4, 2026 •

edited

Loading

github-actions bot left a comment •

edited

Loading