oci-image-tool create failed during symlink copy

[zokrezyl]

->skopeo copy docker://saschagrunert/crio-playground oci:crio-playground:latest
->mkdir crio-playground-bundle ->oci-image-tool create --ref name=latest crio
->playground crio-playground-bundle

I get the following error

symlink thawte_Primary_Root_CA.pem crio-playground-bundle/rootfs/var/lib/ca-certificates/openssl/00673b5b.0: permission denied
unpack: error extracting layer
github.com/opencontainers/image-tools/image.unpackManifest.func2
        /build/go/src/github.com/opencontainers/image-tools/image/manifest.go:110
github.com/opencontainers/image-tools/image.(*pathWalker).find
        /build/go/src/github.com/opencontainers/image-tools/image/walker.go:242
github.com/opencontainers/image-tools/image.unpackManifest
        /build/go/src/github.com/opencontainers/image-tools/image/manifest.go:108
github.com/opencontainers/image-tools/image.createBundle
        /build/go/src/github.com/opencontainers/image-tools/image/image.go:338
github.com/opencontainers/image-tools/image.createRuntimeBundle
        /build/go/src/github.com/opencontainers/image-tools/image/image.go:289
github.com/opencontainers/image-tools/image.CreateRuntimeBundleLayout
        /build/go/src/github.com/opencontainers/image-tools/image/image.go:235
main.createAction
        /build/go/src/github.com/opencontainers/image-tools/cmd/oci-image-tool/create.go:74
github.com/opencontainers/image-tools/vendor/github.com/urfave/cli.HandleAction
        /build/go/src/github.com/opencontainers/image-tools/vendor/github.com/urfave/cli/app.go:485
github.com/opencontainers/image-tools/vendor/github.com/urfave/cli.Command.Run
        /build/go/src/github.com/opencontainers/image-tools/vendor/github.com/urfave/cli/command.go:193
github.com/opencontainers/image-tools/vendor/github.com/urfave/cli.(*App).Run
        /build/go/src/github.com/opencontainers/image-tools/vendor/github.com/urfave/cli/app.go:250
main.main
        /build/go/src/github.com/opencontainers/image-tools/cmd/oci-image-tool/main.go:63
runtime.main
        /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-go-1.12.9/share/go/src/runtime/proc.go:200
runtime.goexit
        /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-go-1.12.9/share/go/src/runtime/asm_amd64.s:1337
z```

Tried also with the latest version, but the problem is there

```oci-image-tool  --version
oci-image-tool version 1.0.0-rc1-dev commit: 93db3b16e6738bf9b8bee47d86ac93be5340838b

[cyphar]

I would suggest using https://github.com/openSUSE/umoci for OCI image operations. It is more consistently maintained and was written specifically because image-tools had lots of problems like the one you've hit.

[zokrezyl]

Thanks for the fast feedback. Did not try umoci as I did not find any nix expression on https://github.com/NixOS/nixpkgs and was lazy to write one, but in this case probably will create a PR for nixpkgs for umoci.

BTW, bit off topic: I am working on a concept to use nixpkgs to generate "dynamically" images for runc. Do you know where would be the best to discuss this with runc/"container/image"/crio specialists?

[cyphar]

You could try sending a message to dev@opencontainers.org.

[cyphar]

This project is no longer actively maintained. However, umoci is a much more full-featured tool for manipulating OCI images, and is now an OCI project as a reference implementation of the OCI image-spec. I would strongly suggest people move to using umoci.