[crazy-max]

• supersedes and closes Fix xattrs on dangling symlinks #120
• fixes docker pull fails with "lsetxattr ... security.selinux: no such file or directory" on images with SELinux-labeled layers (regression in 29.7.0, moby/go-archive v0.3.0) #109

This applies extended attributes to the archive entry itself, so labeled dangling symlinks such as bin -> usr/bin can be extracted before their targets exist.

The Linux implementation adapts the pinned-parent approach from moby/buildkit#7034, opening the parent through os.Root before applying xattrs without following the final component. This avoids resolving the parent pathname again at the syscall boundary. When procfs is unavailable, restoration uses an isolated filesystem context, including for direct callers without prepared chroot options. This requires permission to call unshare(CLONE_FS); extraction returns an error if that operation is blocked. Existing xattr error handling is preserved, and diagnostics include the logical archive entry name.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 60.93750% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.21%. Comparing base (953c7df) to head (d2b7dda).
⚠️ Report is 22 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/unshare/unshare_linux.go	0.00%	20 Missing ⚠️
archive.go	91.30%	2 Missing ⚠️
xattr_unsupported.go	0.00%	2 Missing ⚠️
xattr_supported_unix.go	80.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #125      +/-   ##
==========================================
+ Coverage   65.48%   74.21%   +8.73%     
==========================================
  Files          46       48       +2     
  Lines        2393     2420      +27     
==========================================
+ Hits         1567     1796     +229     
- Misses        605      622      +17     
+ Partials      221        2     -219     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[thaJeztah]

@crazy-max still draft? Was something wrong with the patch?

[Copilot]

🔵 Needs a closer look

Security-sensitive path resolution and per-thread filesystem isolation warrant final human validation.

0 open findings

What changed in this PR

Fixes xattr restoration for dangling symlinks while preserving extraction-root confinement.

Changes:

• Preserves final-component no-follow semantics for xattrs.
• Pins Linux parent directories, with an isolated-filesystem fallback when procfs is unavailable.
• Adds regression, confinement, and chroot coverage.

File	Description
archive.go	Centralizes xattr application and improves diagnostics.
xattr_supported_linux.go	Implements pinned-parent Linux restoration.
xattr_supported_unix.go	Preserves final components on supported Unix systems.
xattr_unsupported.go	Adds the no-op unsupported-platform abstraction.
archive_linux_test.go	Tests dangling symlinks and path confinement.
archive_linux_chrooted_test.go	Tests restoration without procfs.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.