[pve-devel] [PATCH container] Fix bug #6040 in the exclusion pattern of tar

[Fabian Grünbichler]

> Orwa Diraneyya via pve-devel <pve-devel at lists.proxmox.com> hat am 04.01.2025 19:47 CET geschrieben:
> From: Orwa Diraneyya <diraneyyaorwa at gmail.com>
> 
> After this fix, users of Proxmox will be able to
> use the root filesystem tarballs found publicly
> (e.g. at https://cloud-images.ubuntu.com/) as LXC
> container templates.
> 
> Currently, this results in a container-creation
> failure due to the root folder `/dev` exclusion
> pattern being ineffective.
> 
> The bugfix is also announced on the dev mailing
> list (mailman.74.1735960093.441.pve-devel)
> 
> Signed-off-by: Orwa Diraneyya <diraneyyaorwa at gmail.com>
> ---
>  src/PVE/LXC/Create.pm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/PVE/LXC/Create.pm b/src/PVE/LXC/Create.pm
> index 8c8cb9a..4d0d11e 100644
> --- a/src/PVE/LXC/Create.pm
> +++ b/src/PVE/LXC/Create.pm
> @@ -75,7 +75,7 @@ my sub restore_tar_archive_command {
>      # *sigh*, gnu...
>      push @$cmd, '--skip-old-files';
>      push @$cmd, '--anchored';
> -    push @$cmd, '--exclude' , './dev/*';
> +    push @$cmd, '--exclude' , 'dev/*';

Thanks for your patch!

Unfortunately, this is not the correct way to tackle this - because of `--anchored`, `./dev/*` and `dev/*` match different things:

$ mkdir dev; touch dev/test
$ ls dev
test
$ tar cf test.tar ./dev
$ tar tf test.tar
./dev/
./dev/test
$ rm -rf extract; mkdir extract
$ tar -xf test.tar -C extract --anchored --exclude './dev/*' -v
./dev/
$ rm -rf extract; mkdir extract
$ tar -xf test.tar -C extract --anchored --exclude 'dev/*' -v
./dev/
./dev/test

Note how the tarball contains a relative dir ./dev with a file test inside (like our/most container templates), and how extracting it with the original exclusion pattern just extracts the empty dev dir, skipping its contents, while your proposed pattern extracts the contents as well.

The inverse is true for your tarball with the contents the other way round:

$ rm test.tar
$ tar cf test.tar dev
$ tar tf test.tar
dev/
dev/test
$ rm -rf extract; mkdir extract
$ tar -xf test.tar -C extract --anchored --exclude './dev/*' -v
dev/
dev/test
$ rm -rf extract; mkdir extract
$ tar -xf test.tar -C extract --anchored --exclude 'dev/*' -v
dev/

So what we actually want if we want to support both variants is to exclude *both* patterns.

Note that your original use case of just passing an image not intended for container consumption might still fail for other reasons ;) But such a patch would at least allow manually created templates that don't use the ./ prefix to work properly.

>      if (defined($bwlimit)) {
>  	$cmd = [ ['cstream', '-t', $bwlimit*1024], $cmd ];
> -- 
> 2.46.0