From 6524107008a601fa747cf9015c297a7e9303954e Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Wed, 15 Jul 2026 13:18:27 +0300 Subject: Set up immich jail --- .../templates/usr_local_bin_extract_image.sh | 47 ++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 roles/jails/20_immich/templates/usr_local_bin_extract_image.sh (limited to 'roles/jails/20_immich/templates/usr_local_bin_extract_image.sh') diff --git a/roles/jails/20_immich/templates/usr_local_bin_extract_image.sh b/roles/jails/20_immich/templates/usr_local_bin_extract_image.sh new file mode 100644 index 0000000..e8226dd --- /dev/null +++ b/roles/jails/20_immich/templates/usr_local_bin_extract_image.sh @@ -0,0 +1,47 @@ +#!/bin/sh +# Extract a Docker image to a directory under /image/ +# Usage: extract-image.sh +# Example: extract-image.sh ghcr.io/immich-app/immich-server:v2.4.1 immich-server + +set -eu + +IMAGE="$1" +NAME="$2" +IMAGE_DIR="/image" +TARGET="${IMAGE_DIR}/${NAME}" +TMP_DIR="/tmp/oci-${NAME}" + +echo "Extracting ${IMAGE} to ${TARGET}..." + +# Clean up any previous extraction attempt +rm -rf "${TMP_DIR}" +mkdir -p "${TMP_DIR}" + +# Pull image layers +skopeo copy --override-os linux "docker://${IMAGE}" "dir:${TMP_DIR}" + +# Extract all layers in order into new rootfs +rm -rf "${TARGET}.new" +mkdir -p "${TARGET}.new" + +# Parse layer digests from manifest and extract each layer +grep -o '"sha256:[a-f0-9]*"' "${TMP_DIR}/manifest.json" | \ + sed 's/"//g; s/sha256://' | \ + while read hash; do + if [ -f "${TMP_DIR}/${hash}" ]; then + echo " Extracting layer ${hash}..." + tar -xzf "${TMP_DIR}/${hash}" -C "${TARGET}.new" 2>/dev/null || \ + tar -xf "${TMP_DIR}/${hash}" -C "${TARGET}.new" 2>/dev/null || true + fi + done + +# Swap in the new rootfs +if [ -d "${TARGET}" ]; then + mv "${TARGET}" "${TARGET}.old" +fi +mv "${TARGET}.new" "${TARGET}" + +# Cleanup +rm -rf "${TMP_DIR}" "${TARGET}.old" + +echo "Done: ${TARGET}" -- cgit v1.3