dberkov 610e3916ad Add node-local OCI image layer cache (imagecache), replacing memorypullcache ...

Content-addressed pool of unpacked image layers, shared by every actor on
the node; actor rootfs becomes an overlayfs mount (cached layers as read-
only lowers, bundle-local upper) instead of a full re-untar per run.
atelet (no capabilities) pulls and unpacks; the privileged ateoms finalize
whiteouts and mount. Tag refs resolve via one HEAD and become cacheable;
pull memory is O(stream buffers); the cache survives restarts.

Phase 1 of #463. Fixes #437, #166, #228.

Validated: kind + GKE counter demos (gvisor and microvm), suspend/resume
(oci_unpack ~3ms vs ~15-20s), 411 SWE-bench-scale images pulled and
unpacked with 0 failures, root-gated unit tests for the privileged paths.
Known gaps: no GC yet (Phase 2, see internal/imagecache/README.md);
upgrade ordering — deploy new ateoms before/with the new atelet.

2026-07-22 21:15:39 -07:00

..

gnostic-models

Update/verify dep vendoring (#132)

2026-06-02 20:02:51 -07:00

go-cmp

Update/verify dep vendoring (#132)

2026-06-02 20:02:51 -07:00

go-containerregistry

Add node-local OCI image layer cache (imagecache), replacing memorypullcache

2026-07-22 21:15:39 -07:00

nftables

Fix ateom cleanup failure handling

2026-06-10 22:37:09 -07:00

s2a-go

Update/verify dep vendoring (#132)

2026-06-02 20:02:51 -07:00

uuid

Update/verify dep vendoring (#132)

2026-06-02 20:02:51 -07:00