@@ -82,6 +82,8 @@ const (
8282 // whiteoutOpaqueDir file means directory has been made opaque - meaning
8383 // readdir calls to this directory do not follow to lower layers.
8484 whiteoutOpaqueDir = whiteoutMetaPrefix + ".opq"
85+
86+ paxSchilyXattr = "SCHILY.xattrs."
8587)
8688
8789// Apply applies a tar stream of an OCI style diff tar.
@@ -388,9 +390,10 @@ func (cw *changeWriter) HandleChange(k fs.ChangeKind, p string, f os.FileInfo, e
388390 if capability , err := getxattr (source , "security.capability" ); err != nil {
389391 return errors .Wrap (err , "failed to get capabilities xattr" )
390392 } else if capability != nil {
391- hdr .Xattrs = map [ string ] string {
392- "security.capability" : string ( capability ),
393+ if hdr .PAXRecords == nil {
394+ hdr . PAXRecords = map [ string ] string {}
393395 }
396+ hdr .PAXRecords [paxSchilyXattr + "security.capability" ] = string (capability )
394397 }
395398
396399 if err := cw .tw .WriteHeader (hdr ); err != nil {
@@ -509,13 +512,16 @@ func createTarFile(ctx context.Context, path, extractDir string, hdr *tar.Header
509512 }
510513 }
511514
512- for key , value := range hdr .Xattrs {
513- if err := setxattr (path , key , value ); err != nil {
514- if errors .Cause (err ) == syscall .ENOTSUP {
515- log .G (ctx ).WithError (err ).Warnf ("ignored xattr %s in archive" , key )
516- continue
515+ for key , value := range hdr .PAXRecords {
516+ if strings .HasPrefix (key , paxSchilyXattr ) {
517+ key = key [len (paxSchilyXattr ):]
518+ if err := setxattr (path , key , value ); err != nil {
519+ if errors .Cause (err ) == syscall .ENOTSUP {
520+ log .G (ctx ).WithError (err ).Warnf ("ignored xattr %s in archive" , key )
521+ continue
522+ }
523+ return err
517524 }
518- return err
519525 }
520526 }
521527
0 commit comments