Repository navigation
feat(oci): add reproducible host path copy layers - #10952
Conversation
Entire-Checkpoint: 50d575aaefdb
📝 WalkthroughWalkthrough
ChangesOCI copy support
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant OciBuild
participant Builder
participant build_layer_from_path
participant OCIManifest
User->>OciBuild: provide --copy HOST_PATH:IMAGE_PATH
OciBuild->>Builder: pass CLI and configured OciCopy entries
Builder->>build_layer_from_path: build a layer from each host path
build_layer_from_path-->>Builder: return layer blob and diff_id
Builder->>OCIManifest: add annotated copy layers to manifest
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Greptile SummaryThis PR adds a repeatable
Confidence Score: 5/5Safe to merge; all new code is confined to the experimental OCI build path and the logic is well-tested. The feature is well-scoped: validation, path resolution, layer construction, and manifest annotation all follow existing patterns in the codebase. Unit tests cover file, directory, and error cases; an e2e test verifies layer ordering and tarball contents end-to-end. The only issues found are cosmetic — duplicate step-comment numbers in builder.rs and a missing warning for absolute symlink targets in the single-symlink code path, both of which carry no correctness impact. No files require special attention; the cosmetic comment-numbering issue in Important Files Changed
Reviews (4): Last reviewed commit: "fix(oci): resolve config copy paths from..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
src/oci/builder.rs (1)
244-258: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winConsider warning when copying host paths, mirroring the existing
[env]secrets warning.
build_image_configalready warns when baking[env]values into the image because they're visible viadocker/skopeo inspect. Host paths copied via--copy/[[oci.copy]]carry the same risk (e.g. an accidentally-included.env,.git, or SSH key inside a copied directory) but get no equivalent notice.🛡️ Suggested addition
for copy in copies { copy.validate().map_err(eyre::Report::msg)?; + info!( + "mise oci build: copying host path {} into the image at {} — \ + review its contents for secrets/credentials before sharing the image", + copy.host.display(), + copy.image + ); let blob = layer::build_layer_from_path(©.host, ©.image, owner).wrap_err_with(🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/oci/builder.rs` around lines 244 - 258, In the arbitrary host-path layer handling around OciCopy and build_layer_from_path, emit a warning before copying each host path, matching the existing build_image_config warning style used for baked [env] values. Include enough context to identify the source and destination paths, without changing validation or layer-building behavior.e2e/oci/test_oci_build_slow (1)
145-146: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider verifying config copy layer content.
The test verifies the CLI copy layer content (
from-cliat line 146) but only checks the path existence for the config copy layer (line 145). Adding a content assertion forsrv/assets/config-copy.txtwould catch content corruption at minimal cost.💚 Suggested addition
assert_contains "tar -tzf ./out-copy/blobs/sha256/$config_copy_layer" "srv/assets/config-copy.txt" +assert_contains "tar -xOzf ./out-copy/blobs/sha256/$config_copy_layer srv/assets/config-copy.txt" "from-config" assert "tar -xOzf ./out-copy/blobs/sha256/$cli_copy_layer etc/cli-copy.txt" "from-cli"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@e2e/oci/test_oci_build_slow` around lines 145 - 146, Extend the OCI build test assertions so the config copy layer is validated for content, not just file presence. In the assertion around config_copy_layer, extract srv/assets/config-copy.txt from the tar archive and verify it contains the expected config-copy content, matching the existing CLI copy layer validation pattern.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/oci/layer.rs`:
- Around line 108-158: Update build_layer_from_path to preserve and validate
trailing-slash semantics for file and symlink sources instead of unconditionally
normalizing image_path via trim_matches. For non-directory metadata, require
image_path to be the exact destination path: either reject a trailing slash or
otherwise prevent it from being interpreted as a parent directory; keep
directory handling’s existing normalized target behavior unchanged.
---
Nitpick comments:
In `@e2e/oci/test_oci_build_slow`:
- Around line 145-146: Extend the OCI build test assertions so the config copy
layer is validated for content, not just file presence. In the assertion around
config_copy_layer, extract srv/assets/config-copy.txt from the tar archive and
verify it contains the expected config-copy content, matching the existing CLI
copy layer validation pattern.
In `@src/oci/builder.rs`:
- Around line 244-258: In the arbitrary host-path layer handling around OciCopy
and build_layer_from_path, emit a warning before copying each host path,
matching the existing build_image_config warning style used for baked [env]
values. Include enough context to identify the source and destination paths,
without changing validation or layer-building behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 22e2bdd1-ddd3-468f-9711-e2d4cbf91e23
📒 Files selected for processing (10)
docs/cli/oci/build.mddocs/dev-tools/mise-oci.mde2e/oci/test_oci_build_slowmise.usage.kdlsrc/cli/oci/build.rssrc/cli/oci/push.rssrc/cli/oci/run.rssrc/oci/builder.rssrc/oci/layer.rssrc/oci/mod.rs
Hyperfine Performance
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 x -- echo |
25.4 ± 1.8 | 20.0 | 31.1 | 1.00 |
mise x -- echo |
25.6 ± 2.6 | 21.5 | 62.0 | 1.01 ± 0.12 |
mise env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 env |
23.8 ± 1.9 | 19.8 | 31.5 | 1.00 |
mise env |
25.3 ± 2.0 | 20.6 | 33.1 | 1.06 ± 0.12 |
mise hook-env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 hook-env |
25.9 ± 1.7 | 20.6 | 31.6 | 1.03 ± 0.10 |
mise hook-env |
25.2 ± 1.8 | 20.4 | 32.0 | 1.00 |
mise ls
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 ls |
19.0 ± 1.6 | 16.0 | 24.7 | 1.04 ± 0.11 |
mise ls |
18.3 ± 1.1 | 16.5 | 23.2 | 1.00 |
xtasks/test/perf
| Command | mise-2026.7.5 | mise | Variance |
|---|---|---|---|
| install (cached) | 171ms | 170ms | +0% |
| ls (cached) | 68ms | 67ms | +1% |
| bin-paths (cached) | 71ms | 71ms | +0% |
| task-ls (cached) | 147ms | 150ms | -2% |
Entire-Checkpoint: db71c691bebd
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@man/man1/mise.1`:
- Around line 2312-2313: Update the --copy option description in the manpage to
state that it accepts a host file, directory, or symlink, while preserving the
existing repeatable HOST_PATH:IMAGE_PATH syntax and wording.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 2fcbecf2-3184-428b-aaeb-d5780f9d575a
📒 Files selected for processing (6)
docs/dev-tools/mise-oci.mde2e/oci/test_oci_build_slowman/man1/mise.1src/oci/builder.rssrc/oci/layer.rssrc/oci/mod.rs
🚧 Files skipped from review as they are similar to previous changes (5)
- src/oci/layer.rs
- src/oci/builder.rs
- e2e/oci/test_oci_build_slow
- src/oci/mod.rs
- docs/dev-tools/mise-oci.md
Entire-Checkpoint: b00499a1f5b3
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d3de54f. Configure here.
Entire-Checkpoint: 72b840cacfdd
Summary
mise oci build --copy HOST_PATH:IMAGE_PATHsupport[[oci.copy]]configuration entriesdev.mise.copyCloses the feature request discussed in #10934.
Validation
cargo test oci::layer::testsmise run test:e2e e2e/oci/test_oci_build_slowmise run lint-fixNote
Medium Risk
New OCI build surface can embed arbitrary host filesystem content into images (with a secrets warning); behavior is well validated but mistakes could leak local files into published images.
Overview
mise oci buildcan now copy arbitrary host paths into the image as independent, content-addressed layers (after per-tool layers), via repeatable--copy HOST_PATH:IMAGE_PATHand[[oci.copy]]inmise.toml.Each payload is built with
build_layer_from_path(files, dirs, or symlinks; dirs map contents under the absolute image path without appending the source name). Layers are tagged withdev.mise.copy=<image path>. Image destinations must be absolute with no./..; config-relativehostpaths resolve from the declaring config file, CLI paths from CWD; layered configs append copies so more-specific targets win, with CLI copies last. The builder warns about secrets in copied paths.oci run/oci pushpass an emptycopywhen they trigger a build.Docs, usage/man output, unit tests, and e2e coverage for annotated layers and tar contents are included.
Reviewed by Cursor Bugbot for commit b6824ac. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
mise oci build --copy HOST_PATH:IMAGE_PATHoption to copy host files, directories, or symlinks into the OCI image as independent layers.[oci]/[[oci.copy]]configuration support for declaring these copy layers.--copy/[[oci.copy]]usage, destination path rules, and copy layer semantics/annotations.[[oci.copy]]source paths in config files are now resolved relative to the declaring config directory.