Cisco has proposed a new file system, PuzzleFS, implemented as a module for the Linux kernel written in Rust. The FS is designed to be used to host isolated containers and continues the development of the ideas proposed in the Atomfs FS. The implementation is still at the prototype stage, supports building with the rust-next Linux kernel branch, and is open under the Apache 2.0 and MIT licenses.
The project is aimed at circumventing the limitations that arise when using container images in the OCI (Open Container Initiative) format. PuzzleFS addresses issues such as efficient storage of duplicate data, direct mount capability, repeatable image building, and memory safety.
For deduplication of data repeated in different containers, the FastCDC (Fast Content-Defined Chunking) algorithm is used, which works by dividing data into fragments of arbitrary size and maintaining an index with hashes of processed fragments. Repeating fragments are stored once and are jointly indexed for all FS layers, i.e. deduplication can cover different mount points (a new FS layer can be launched based on the existing one and use the data fragments in it during deduplication).
Repeatable assembly of container images is achieved through the definition of a canonical representation of the container image format. Direct mounting (direct-mount) allows you to mount an OCI container image from the global shared storage without first unpacking it, using the content hash from the container manifest as an identifier. To verify the integrity of data in the conditions of using a shared storage, the fs-verity mechanism can be used, which, when accessing files, checks whether the hashes specified in the binary index correspond to the actual content.
The Rust language was chosen as combining high performance of the resulting code with memory-safe capabilities, which reduces the risk of vulnerabilities caused by problems such as memory access after freeing and buffer overruns. The use of Rust for the kernel module also made it possible to share code in the kernel and user-space components to create a single secure implementation.
Other goals of the project include very fast build and mount of images, the ability to use an optional intermediate stage for canonicalization of images, the optional mtree-style FS tree traversals when using a layered structure, casync-style changes, and an easy-to-implement architecture.
Source: opennet.ru