archive: resolve absolute symlinks and hard links within extraction root

[thaJeztah]

• fixes / addresses CopyToContainer regression in 29.7.0: "path escapes from parent" when copying into paths that traverse /var/run → /run symlink moby#53258
• relates to / introduced in archive: harden tar extraction against path traversal #45

The move to os.Root caused archive extraction to reject paths that traverse absolute symlinks inside the destination. For example, given:

var/run -> /run

os.Root interprets /run as an absolute host path and reports that the path escapes the root. Archive extraction instead requires chroot-like semantics, where absolute symlink targets are resolved relative to the extraction root.

When os.Root cannot traverse an entry's parent, resolve it with fsRootPath and continue extraction using the resulting root-relative path. Leave the final component unresolved because extraction may create or replace it.

Apply this handling to Unpack and UnpackLayer, including implied directories, whiteouts, deferred directory timestamps, and opaque-whiteout path tracking. The actual filesystem operations continue to use os.Root and remain confined to the extraction destination.

This is a compatibility workaround that resolves paths separately from their use. It should eventually be replaced with handle-relative operations that provide resolve-in-root semantics.

A regression test was added, which fails before this patch;

=== RUN   TestUntarThroughAbsoluteSymlink
=== RUN   TestUntarThroughAbsoluteSymlink/existing_target
    archive_unix_test.go:558: assertion failed: error is not nil: statat var/run/existing/non-existing: path escapes from parent
=== RUN   TestUntarThroughAbsoluteSymlink/missing_target
    archive_unix_test.go:558: assertion failed: error is not nil: statat var/run/existing/non-existing: path escapes from parent
--- FAIL: TestUntarThroughAbsoluteSymlink (0.00s)
    --- FAIL: TestUntarThroughAbsoluteSymlink/existing_target (0.00s)
    --- FAIL: TestUntarThroughAbsoluteSymlink/missing_target (0.00s)

Release note:

* Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as `var/run -> /run`. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 67.77778% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.24%. Comparing base (216738e) to head (4f6cd58).
⚠️ Report is 67 commits behind head on main.

Files with missing lines	Patch %	Lines
archive.go	60.78%	14 Missing and 6 partials ⚠️
rootpath.go	75.00%	5 Missing and 2 partials ⚠️
diff.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #93      +/-   ##
==========================================
- Coverage   65.81%   65.24%   -0.57%     
==========================================
  Files          42       44       +2     
  Lines        2039     2325     +286     
==========================================
+ Hits         1342     1517     +175     
- Misses        519      595      +76     
- Partials      178      213      +35     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR updates tar/layer extraction to allow traversing absolute symlinks inside the extraction destination with chroot-like semantics (resolving absolute symlink targets relative to the extraction root), restoring compatibility after the move to os.Root.

Changes:

• Added resolveArchivePath to resolve intermediate symlinks when os.Root can’t traverse an entry’s parent, while keeping the final component unresolved.
• Applied the resolved path handling to both Untar (in archive.go) and UnpackLayer (in diff.go), including implied-directory creation and AUFS opaque-whiteout bookkeeping.
• Added a regression test for Untar covering extraction through an absolute symlink within the destination.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
diff.go	Uses resolveArchivePath during layer extraction and updates AUFS opaque-whiteout path tracking to use resolved native paths.
archive.go	Adds resolveArchivePath, routes Untar through it, and updates implied-directory creation to accept resolved root-relative paths.
archive_unix_test.go	Adds a regression test validating extraction through an absolute symlink under the destination root.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

diff.go:34

• The comment says unpackedPaths contains resolved paths, but dstPath is only sometimes resolved (resolveArchivePath is a no-op when root.Stat(parent) succeeds). This can be misleading, and it also means unpackedPaths may still contain unresolved symlink paths in cases where os.Root can traverse them.

Consider updating the comment to reflect that paths are only resolved when needed (e.g., when os.Root can't traverse the parent), or changing the keying logic to always use a consistently resolved form.

	// unpackedPaths tracks resolved, native-separator, root-relative paths
	// already written in this layer so that the AUFS opaque-whiteout walk
	// knows which paths to preserve.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.