mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-12 10:35:06 +08:00
Ron Lev
0741459b15
Fixes #783 Adds an `image` source to `ActorTemplate`'s `VolumeSource`: a container can mount the contents of an OCI image it does not run. This is how tooling gets into images built by third parties without rebuilding them. ```yaml spec: containers: - name: sandbox image: docker.io/example/benchmark@sha256:... command: ["/ate/agent"] volumeMounts: - name: agent mountPath: /ate volumes: - name: agent image: reference: registry.example.com/agent@sha256:... ``` ## How it works atelet pulls the image through the existing layer cache and records the volume's layers in the bundle's overlay spec, next to the rootfs layers. ateom composes the volume inside the bundle — the cached layers with no writable layer on top, so the mount is read-only — and the container binds it at the declared path. The volume is composed per container: containers of one actor may mount the same volume, and each gets its own mount point inside its own bundle, all backed by the same shared layers. On resume the volume is re-composed the same way. References must be digest-pinned, the same rule as container images: a snapshot is only valid against the exact bytes it was taken with. On micro-VMs the volume rides the same read-only virtio-fs share as the container rootfs: ateom stages each composed volume beside the rootfs on the host, and the guest binds it into the container at the declared path.