OCI file mounts are not extracted from Unikraft initrd

[kastakhov]

Description

CopyFileMountsToInitrd appends OCI bind mounts as a second CPIO archive. Unikraft stops at the TRAILER!!! record in the original archive, so the appended files are not extracted.

This makes Kubernetes-mounted ConfigMaps, Secrets, and /etc/resolv.conf unavailable inside an initrd-based Unikraft guest.

System info

• urunc: v0.7.0 and main (3395292)
• Arch: amd64
• VMM: QEMU
• Unikernel: Unikraft

Steps to reproduce

1. Run an initrd-based Unikraft workload with an OCI file bind mount, for example a Kubernetes ConfigMap key mounted with subPath.
2. Read the mounted path from the guest.

Logs / output

The mounted path is absent in the guest. Inspecting the generated initrd shows the original TRAILER!!! before the appended mount records. Merging the records into the original CPIO archive makes the same mounted files visible.

LLM usage

OpenAI Codex (GPT-5) assisted with reviewing the implementation and drafting this report. I reviewed the final content.

[cmainas]

Hello @kastakhov ,

this sounds reasonable. Could you also point to some Unikraft references? As far as I remember Unikraft uses the bsdcpio format and not GNU's new. So the current initrd code in urunc might need more changes to be compatible with Unikraft.

[kastakhov]

Could you also point to some Unikraft references? As far as I remember Unikraft uses the bsdcpio format and not GNU's new. So the current initrd code in urunc might need more changes to be compatible with Unikraft.

Yes. unikraft uses bsdcpio, and while build the newc format passes explicitly with mkcpio script. Also, their libukcpio accepts both the 070701 (newc) and 070702 (crc) magics.

However, per their source code unikraft’s extractor explicitly terminates when it sees the first TRAILER!!! entry, per my understanding this happenings due to the next lines of code:

1. UKCPIO_ISLAST identifies the trailer (https://github.com/unikraft/unikraft/blob/RELEASE-0.21.0/lib/ukcpio/include/uk/cpio.h#L132-L133):

#define UKCPIO_ISLAST(header) \
	(strcmp(UKCPIO_FILENAME(header), "TRAILER!!!") == 0)

2. When the trailer is encountered, process_section() sets the header pointer to NULL (https://github.com/unikraft/unikraft/blob/RELEASE-0.21.0/lib/ukcpio/cpio.c#L449-L452):

	if (unlikely(UKCPIO_ISLAST(header))) {
		*headerp = NULL;
		return UKCPIO_SUCCESS;
	}

3. The extraction loop continues only while header is non-NULL (https://github.com/unikraft/unikraft/blob/RELEASE-0.21.0/lib/ukcpio/cpio.c#L514-L518):

	while (header && error == UKCPIO_SUCCESS) {
		error = process_section(&ilist,
					&header, pathbuf,
					(char *)header + buflen, destlen);
	}

Therefore, the first TRAILER!!! makes header set to NULL, the loop ends, and bytes containing a second appended CPIO archive are never examined.

As temporary workaround while running the urunc extension with a Unikraft image on Talos Linux I used the next patch: 0002-merge-mounts-into-initrd.patch. As well as I prepared similar fix for future PR, if you okay with such workaround.