Skip to content

Conversation

@Honny1
Copy link
Member

@Honny1 Honny1 commented Dec 18, 2025

This PR adds a new local artifact add API endpoint and enforces absolute path requirements for local file operations.

Fixes: https://issues.redhat.com/browse/RUN-3385
Fixes: #26321

Benchmark

  • Command: podman artifact add quay.io/myartifact/benchmark:latest ./artifacts/random-file
  • Artifacts Dir content:
$ du -a -h | sort -hr
5G	.
5.0G ./random-file

Benchmark Results:

Mac OS

  • Number of runs: 10
  • Machine:
    • Chip: Apple M3 Pro
    • RAM: 36 GB
    • SSD: 1 TB Apple SSD
  • Podman machine configuration:
    • CPUs: 8
    • Memory: 8.1 GB
  • report

Providers

applehv
  • Before: 32.82 s
  • After: 5.77 s
libkrun (krunkit 0.2.1)
  • Before: 25.87 s
  • After: 7.17 s

Windows

  • Windows 10
  • Number of runs: 10
  • Machine:
    • CPU: Intel Core i7-8665U
    • RAM: 32 GB
    • SSD: 500 GB Samsung 970 Evo Plus
  • Podman machine configuration:
    • CPUs: 8
    • Memory: 2 GB (WSL) | 8.2 GB (Hyper-v)
  • report

Providers

WSL
  • Memory: 2 GB
  • Before: 35.25 s
  • After: 78.31 s
Hyper-V
  • Memory: 8.2 GB
  • Before: 362.70 s
  • After: 51.66 s

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

  • Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
    commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
    the sign-off email address. See CONTRIBUTING.md
    for more information.
  • Referenced issues using Fixes: #00000 in commit message (if applicable)
  • Tests have been added/updated (or no tests are needed)
  • Documentation has been updated (or no documentation changes are needed)
  • All commits pass make validatepr (format/lint checks)
  • Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Added new local artifact add API endpoint (`libpod/local/artifacts/add`) for loading artifacts from local files
Image and artifact load endpoints now require absolute paths for local file operations to improve security and prevent path ambiguity

Signed-off-by: Jan Rodák <[email protected]>
(cherry picked from commit 2f7094c)
The local API path optimization is ineffective on WSL because of NTFS mounting overhead.

Signed-off-by: Jan Rodák <[email protected]>
(cherry picked from commit d889aeb)
@Honny1 Honny1 added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. 5.8 labels Dec 18, 2025
@github-actions github-actions bot added the kind/api-change Change to remote API; merits scrutiny label Dec 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

5.8 do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. kind/api-change Change to remote API; merits scrutiny

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant