Alexander Larsson, a creator of Flatpak working at Red Hat, introduced a preliminary version of patches implementing the Composefs file system for the Linux kernel. The proposed file system resembles Squashfs and is also suitable for mounting images in read-only mode. The differences boil down to providing effective shared storage of multiple mounted disk image contents and supporting the authentication of readable data. Use cases for Composefs include mounting container images and usage for a Git-like repository like OSTree.
Composefs uses a content-addressed storage model, i.e., the primary identifier is not the file name, but rather a hash of the file's contents. This model ensures deduplication, effectively allowing only one copy of identical files occurring in different mounted partitions to be stored. For example, container images contain numerous typical system files and, with Composefs, each of these files will be shared by all mounted images without using tricks like hard links. As a result, common files are stored as a single copy on disk and require only one entry in the page cache, saving both disk and RAM.
To save disk space, data and metadata in mounted images are separated. When mounted, the following are specified:
- A binary index containing all file system metadata, file names, access rights, and other information, excluding the actual content of the files.
- The base directory where the contents of all mounted images are stored. Files are stored linked to the hash of their content.
A bináris index minden fájlrendszer képhez létrejön, míg az alapértelmezett könyvtár közös minden képhez. Az egyes fájlok és az egész kép tartalmának ellenőrzésére a megosztott tárolás esetén alkalmazható a fs-verity mechanizmus, amely a fájlokhoz való hozzáféréskor ellenőrzi a bináris indexben megadott hash-ek és a tényleges tartalom megfelelőségét (azaz, ha a támadó módosítja a fájlt az alapértelmezett könyvtárban, vagy az adatok megsérülnek hiba következtében, az ilyen összehasonlítás felfedi az eltérést).
Forrás: opennet.ru
