@lakutata/containerd 0.0.0-stage → 3.0.0-beta.1

package/dist/esm/client/ImageStore.js

@@ -0,0 +1,628 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { mkdir, mkdtemp, readFile, rm, stat } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { extract as tarExtract, pack as tarPack } from 'tar-stream';
+import { isGRPCError } from './ContainerdClient.js';
+import { GRPCStatus } from '@lakutata/grpc';
+import { formatPlatform, hostPlatform, matchPlatform, normalizePlatform, platformRank } from './Platforms.js';
+import { imageName, parseReference } from './Reference.js';
+import { digestOf, isIndex, isManifest, MediaTypes, RegistryClient } from './Registry.js';
+/**
+ * The labels of containerd binding its content (its garbage collection keeps what an image references)
+ */
+const Labels = {
+    contentRef: (kind, index) => `containerd.io/gc.ref.content.${kind}${index === undefined ? '' : `.${index}`}`,
+    snapshotRef: (snapshotter) => `containerd.io/gc.ref.snapshot.${snapshotter}`,
+    uncompressed: 'containerd.io/uncompressed',
+    source: (registry) => `containerd.io/distribution.source.${registry}`
+};
+/**
+ * The bytes of a stream, whole
+ * @param chunks
+ */
+async function collect(chunks) {
+    const all = [];
+    for await (const chunk of chunks)
+        all.push(Buffer.from(chunk));
+    return Buffer.concat(all);
+}
+/**
+ * The identifiers of the chain of layers (OCI): the ones of the snapshots of their unpacking
+ * @param diffIds
+ */
+export function chainIds(diffIds) {
+    const chain = [];
+    for (const diffId of diffIds) {
+        chain.push(chain.length ? `sha256:${createHash('sha256').update(`${chain[chain.length - 1]} ${diffId}`).digest('hex')}` : diffId);
+    }
+    return chain;
+}
+/**
+ * The platform of the configuration of an image
+ * @param config
+ */
+function configPlatform(config) {
+    return normalizePlatform({ os: config.os, architecture: config.architecture, variant: config.variant });
+}
+/**
+ * The images of containerd: pulled from the registries, unpacked into the snapshots, pushed, imported and exported
+ * (OCI image layouts, the archives of docker save), as ctr and nerdctl do: their content bound by the labels of the
+ * garbage collection of containerd, under a lease until the image references it
+ */
+export class ImageStore {
+    /**
+     * @param client
+     * @param snapshotter
+     * @param temporary the directory of the archives extracted (a disk of the machine, not a small tmpfs)
+     * @param runnablePlatforms the platforms the machine runs, unpacked by the pulls and the imports (the one of the
+     * machine by default)
+     */
+    constructor(client, snapshotter, temporary = os.tmpdir(), runnablePlatforms = () => [hostPlatform()]) {
+        this.client = client;
+        this.snapshotter = snapshotter;
+        this.temporary = temporary;
+        this.runnablePlatforms = runnablePlatforms;
+    }
+    /**
+     * The JSON of a content
+     * @param digest
+     */
+    async readJson(digest) {
+        return JSON.parse((await this.client.readAll(digest)).toString('utf8'));
+    }
+    /**
+     * The best manifest of an index for a platform, among the ones the content store has (or all)
+     * @param index
+     * @param platform
+     * @param local
+     */
+    async chooseManifest(index, platform, local) {
+        let best;
+        for (const descriptor of index.manifests) {
+            if (!isManifest(descriptor.mediaType) || !descriptor.platform)
+                continue;
+            const rank = platformRank(descriptor.platform, platform);
+            if (rank === undefined || (best && best.rank <= rank))
+                continue;
+            if (local && !(await this.client.contentInfo(descriptor.digest)))
+                continue;
+            best = { descriptor: descriptor, rank: rank };
+        }
+        return best?.descriptor;
+    }
+    /**
+     * The image of a name (the reference given or its normalized name), undefined when it does not exist
+     * @param name
+     */
+    async get(name) {
+        return await this.client.getImage(imageName(name)) ?? (imageName(name) === name ? undefined : await this.client.getImage(name));
+    }
+    /**
+     * Resolve an image for a platform: its manifest and its configuration (the manifest of the platform of its index)
+     * @param name
+     * @param platform the one of the machine by default
+     */
+    async resolve(name, platform = hostPlatform()) {
+        const image = await this.get(name);
+        if (!image)
+            throw Object.assign(new Error(`The image ${name} does not exist`), { code: 'NOT_FOUND' });
+        const target = image.target;
+        let manifestDescriptor = target;
+        if (isIndex(target.mediaType)) {
+            const chosen = await this.chooseManifest(await this.readJson(target.digest), platform, true);
+            if (!chosen)
+                throw Object.assign(new Error(`The image ${name} has no manifest of the platform ${formatPlatform(platform)}`), { code: 'PLATFORM' });
+            manifestDescriptor = chosen;
+        }
+        const manifest = await this.readJson(manifestDescriptor.digest);
+        const config = await this.readJson(manifest.config.digest);
+        return { image: image, name: image.name, target: target, manifestDescriptor: manifestDescriptor, manifest: manifest, config: config, platform: configPlatform(config) };
+    }
+    /**
+     * The platforms of an image the content store has (the ones pulled)
+     * @param name
+     */
+    async platforms(name) {
+        const image = await this.get(name);
+        if (!image)
+            return [];
+        if (!isIndex(image.target.mediaType))
+            return [configPlatform(await this.readJson((await this.readJson(image.target.digest)).config.digest))];
+        const platforms = [];
+        for (const descriptor of (await this.readJson(image.target.digest)).manifests) {
+            if (descriptor.platform && isManifest(descriptor.mediaType) && await this.client.contentInfo(descriptor.digest))
+                platforms.push(normalizePlatform(descriptor.platform));
+        }
+        return platforms;
+    }
+    /**
+     * Unpack the layers of an image into the snapshots of the snapshotter (named by the chain of their identifiers), the
+     * configuration bound to the last one
+     * @param manifest
+     * @param lease
+     */
+    async unpack(manifest, lease) {
+        const config = await this.readJson(manifest.config.digest);
+        const diffIds = config.rootfs?.diff_ids ?? [];
+        if (diffIds.length !== manifest.layers.length)
+            throw new Error(`The image ${manifest.config.digest} has ${manifest.layers.length} layers and ${diffIds.length} identifiers of them`);
+        const chain = chainIds(diffIds);
+        for (let index = 0; index < chain.length; index++) {
+            if (await this.client.statSnapshot(this.snapshotter, chain[index]))
+                continue;
+            const key = `extract-${randomBytes(6).toString('hex')}-${chain[index]}`;
+            const mounts = await this.client.prepareSnapshot(this.snapshotter, key, index ? chain[index - 1] : '', {}, lease);
+            try {
+                const applied = await this.client.applyLayer(manifest.layers[index], mounts, lease);
+                if (applied.digest !== diffIds[index])
+                    throw new Error(`The layer ${manifest.layers[index].digest} unpacked is ${applied.digest}, not ${diffIds[index]}`);
+                await this.client.commitSnapshot(this.snapshotter, chain[index], key, {}, lease);
+            }
+            catch (error) {
+                await this.client.removeSnapshot(this.snapshotter, key);
+                //Unpacked meanwhile
+                if (isGRPCError(error, GRPCStatus.ALREADY_EXISTS))
+                    continue;
+                throw error;
+            }
+        }
+        if (chain.length)
+            await this.client.labelContent(manifest.config.digest, { [Labels.snapshotRef(this.snapshotter)]: chain[chain.length - 1] });
+        return chain[chain.length - 1] ?? '';
+    }
+    /**
+     * Write a manifest, its configuration and its layers (the blobs given by a source), bound by the labels of the
+     * garbage collection
+     * @param manifest
+     * @param blob the bytes of a blob (its stream)
+     * @param lease
+     * @param labels the labels of all the content (its source)
+     * @param progress
+     */
+    async writeImage(manifest, blob, lease, labels, progress) {
+        const configData = await blob(manifest.config);
+        const configBytes = configData instanceof Uint8Array ? Buffer.from(configData) : await collect(configData);
+        await this.client.writeContent(manifest.config, configBytes, lease, labels);
+        const config = JSON.parse(configBytes.toString('utf8'));
+        for (let index = 0; index < manifest.layers.length; index++) {
+            const layer = manifest.layers[index];
+            const uncompressed = config.rootfs?.diff_ids?.[index] ? { [Labels.uncompressed]: config.rootfs.diff_ids[index] } : {};
+            if (await this.client.contentInfo(layer.digest)) {
+                await this.client.labelContent(layer.digest, { ...labels, ...uncompressed });
+                progress?.({ digest: layer.digest, mediaType: layer.mediaType, current: layer.size, total: layer.size });
+                continue;
+            }
+            const data = await blob(layer);
+            let current = 0;
+            const counted = async function* () {
+                for await (const chunk of data) {
+                    current += chunk.length;
+                    progress?.({ digest: layer.digest, mediaType: layer.mediaType, current: current, total: layer.size });
+                    yield chunk;
+                }
+            };
+            await this.client.writeContent(layer, data instanceof Uint8Array ? data : counted(), lease, { ...labels, ...uncompressed });
+        }
+    }
+    /**
+     * The labels of a manifest binding its configuration and its layers
+     * @param manifest
+     */
+    manifestLabels(manifest) {
+        const labels = { [Labels.contentRef('config')]: manifest.config.digest };
+        manifest.layers.forEach((layer, index) => labels[Labels.contentRef('l', index)] = layer.digest);
+        return labels;
+    }
+    /**
+     * Pull an image from its registry: the manifests of the platforms asked (of its index), their configurations and
+     * their layers; the image named by its reference (docker.io/library/busybox:latest), unpacked for the machine
+     * @param reference
+     * @param options
+     */
+    async pull(reference, options = {}) {
+        const parsed = parseReference(reference);
+        const registry = new RegistryClient(parsed, options.registry);
+        const platforms = options.platforms ?? [hostPlatform()];
+        const source = { [Labels.source(parsed.registry)]: parsed.repository };
+        const lease = await this.client.createLease();
+        try {
+            const root = await registry.resolve(parsed.digest ?? parsed.tag);
+            const manifests = [];
+            if (isIndex(root.descriptor.mediaType)) {
+                const index = JSON.parse(root.data.toString('utf8'));
+                const chosen = new Set();
+                if (platforms === 'all') {
+                    index.manifests.filter((descriptor) => isManifest(descriptor.mediaType) && descriptor.platform?.os !== 'unknown').forEach((descriptor) => chosen.add(descriptor));
+                }
+                else {
+                    for (const platform of platforms) {
+                        const descriptor = await this.chooseManifest(index, platform, false);
+                        if (!descriptor) {
+                            const available = index.manifests.filter((item) => !!item.platform && item.platform.os !== 'unknown').map((item) => formatPlatform(normalizePlatform(item.platform))).join(', ');
+                            throw Object.assign(new Error(`The image ${parsed.name} has no manifest of the platform ${formatPlatform(platform)} (it has ${available})`), { code: 'PLATFORM' });
+                        }
+                        chosen.add(descriptor);
+                    }
+                }
+                for (const descriptor of chosen)
+                    manifests.push({ descriptor: descriptor, data: await registry.fetchManifest(descriptor), index: index.manifests.indexOf(descriptor) });
+            }
+            else {
+                manifests.push(root);
+            }
+            for (const { descriptor, data } of manifests) {
+                const manifest = JSON.parse(data.toString('utf8'));
+                await this.writeImage(manifest, (blob) => registry.fetchBlob(blob), lease, source, options.progress);
+                await this.client.writeContent(descriptor, data, lease, { ...source, ...this.manifestLabels(manifest) });
+            }
+            if (isIndex(root.descriptor.mediaType)) {
+                const labels = { ...source };
+                manifests.forEach(({ descriptor, index }) => labels[Labels.contentRef('m', index)] = descriptor.digest);
+                await this.client.writeContent(root.descriptor, root.data, lease, labels);
+            }
+            await this.client.putImage({ name: parsed.name, target: root.descriptor }, lease);
+            if (options.unpack ?? true)
+                await this.unpackFor(parsed.name, lease);
+            return parsed.name;
+        }
+        finally {
+            await this.client.deleteLease(lease);
+        }
+    }
+    /**
+     * Unpack an image for the platforms the machine runs, among the ones the content store has (its manifests pulled):
+     * not the other platforms, nor the attestations (unknown/unknown)
+     * @param name
+     * @param lease
+     */
+    async unpackFor(name, lease) {
+        const image = await this.get(name);
+        if (!image)
+            return;
+        const manifests = isIndex(image.target.mediaType)
+            ? (await this.readJson(image.target.digest)).manifests.filter((descriptor) => isManifest(descriptor.mediaType))
+            : [image.target];
+        const runnable = this.runnablePlatforms();
+        for (const descriptor of manifests) {
+            if (!(await this.client.contentInfo(descriptor.digest)))
+                continue;
+            const manifest = await this.readJson(descriptor.digest);
+            const platform = descriptor.platform ? normalizePlatform(descriptor.platform) : configPlatform(await this.readJson(manifest.config.digest));
+            if (!runnable.some((item) => matchPlatform(platform, item)))
+                continue;
+            await this.unpack(manifest, lease);
+        }
+    }
+    /**
+     * Push an image to a registry (as another reference): the manifest of the platform asked; without it, the manifests
+     * of all the platforms and the index when the content store has all of them, the manifest of the machine's platform
+     * otherwise
+     * @param name
+     * @param options
+     */
+    async push(name, options = {}) {
+        const image = await this.get(name);
+        if (!image)
+            throw Object.assign(new Error(`The image ${name} does not exist`), { code: 'NOT_FOUND' });
+        const parsed = parseReference(options.reference ?? image.name);
+        const registry = new RegistryClient(parsed, options.registry);
+        const tag = parsed.tag ?? parsed.digest;
+        const pushManifest = async (descriptor, reference) => {
+            const data = await this.client.readAll(descriptor.digest);
+            const manifest = JSON.parse(data.toString('utf8'));
+            for (const blob of [manifest.config, ...manifest.layers]) {
+                await registry.pushBlob(blob, () => this.client.readContent(blob.digest));
+                options.progress?.({ digest: blob.digest, mediaType: blob.mediaType, current: blob.size, total: blob.size });
+            }
+            await registry.pushManifest(reference, descriptor.mediaType, data);
+        };
+        const target = image.target;
+        if (!isIndex(target.mediaType)) {
+            if (options.platform) {
+                const platform = configPlatform(await this.readJson((await this.readJson(target.digest)).config.digest));
+                if (!matchPlatform(platform, options.platform))
+                    throw Object.assign(new Error(`The image ${name} has no manifest of the platform ${formatPlatform(options.platform)} to push (it is ${formatPlatform(platform)})`), { code: 'PLATFORM' });
+            }
+            return await pushManifest(target, tag);
+        }
+        const index = await this.readJson(target.digest);
+        const local = [];
+        for (const descriptor of index.manifests)
+            if (await this.client.contentInfo(descriptor.digest))
+                local.push(descriptor);
+        if (!options.platform && local.length === index.manifests.length) {
+            for (const descriptor of local)
+                await pushManifest(descriptor, descriptor.digest);
+            return await registry.pushManifest(tag, target.mediaType, await this.client.readAll(target.digest));
+        }
+        const chosen = await this.chooseManifest(index, options.platform ?? hostPlatform(), true);
+        if (!chosen)
+            throw Object.assign(new Error(`The image ${name} has no manifest of the platform ${formatPlatform(options.platform ?? hostPlatform())} to push`), { code: 'PLATFORM' });
+        await pushManifest(chosen, tag);
+    }
+    /**
+     * Commit the changes of a snapshot (the one of a container) on its image: a layer of their diff, the configuration
+     * of the image with its changes, a manifest of the platform, the image named (and unpacked)
+     * @param options
+     */
+    async commit(options) {
+        const base = await this.resolve(options.image, options.platform);
+        const name = imageName(options.name);
+        const lease = await this.client.createLease();
+        const view = `commit-${randomBytes(6).toString('hex')}`;
+        try {
+            const chain = chainIds(base.config.rootfs?.diff_ids ?? []);
+            const left = chain.length ? await this.client.viewSnapshot(this.snapshotter, view, chain[chain.length - 1], lease) : [];
+            const right = await this.client.snapshotMounts(this.snapshotter, options.snapshotKey);
+            const layer = await this.client.diff(left, right, lease);
+            const diffId = (await this.client.contentInfo(layer.digest))?.labels?.[Labels.uncompressed];
+            if (!diffId)
+                throw new Error(`The layer ${layer.digest} of the commit has no uncompressed digest`);
+            const created = new Date().toISOString();
+            const changes = options.changes ?? {};
+            const config = {
+                ...structuredClone(base.config),
+                created: created,
+                rootfs: { type: 'layers', diff_ids: [...base.config.rootfs?.diff_ids ?? [], diffId] }
+            };
+            const containerConfig = config.config ??= {};
+            if (changes.cmd)
+                containerConfig.Cmd = changes.cmd;
+            if (changes.entrypoint)
+                containerConfig.Entrypoint = changes.entrypoint;
+            if (changes.env) {
+                const env = new Map((containerConfig.Env ?? []).map((entry) => [entry.split('=')[0], entry]));
+                for (const entry of changes.env)
+                    env.set(entry.split('=')[0], entry);
+                containerConfig.Env = [...env.values()];
+            }
+            if (changes.workingDir !== undefined)
+                containerConfig.WorkingDir = changes.workingDir;
+            if (changes.user !== undefined)
+                containerConfig.User = changes.user;
+            if (changes.labels)
+                containerConfig.Labels = { ...containerConfig.Labels ?? {}, ...changes.labels };
+            if (changes.exposedPorts)
+                containerConfig.ExposedPorts = { ...containerConfig.ExposedPorts ?? {}, ...Object.fromEntries(changes.exposedPorts.map((port) => [port.includes('/') ? port : `${port}/tcp`, {}])) };
+            if (options.author)
+                config.author = options.author;
+            config.history = [...config.history ?? [], { created: created, created_by: 'lakutata commit', ...options.comment ? { comment: options.comment } : {}, ...options.author ? { author: options.author } : {} }];
+            const configData = Buffer.from(JSON.stringify(config));
+            const configDescriptor = { mediaType: MediaTypes.OCI_CONFIG, digest: digestOf(configData), size: configData.length };
+            await this.client.writeContent(configDescriptor, configData, lease);
+            const manifest = {
+                schemaVersion: 2,
+                mediaType: MediaTypes.OCI_MANIFEST,
+                config: configDescriptor,
+                layers: [...base.manifest.layers.map((item) => ({ mediaType: item.mediaType, digest: item.digest, size: item.size })), { mediaType: layer.mediaType, digest: layer.digest, size: Number(layer.size) }]
+            };
+            const manifestData = Buffer.from(JSON.stringify(manifest));
+            const manifestDescriptor = { mediaType: MediaTypes.OCI_MANIFEST, digest: digestOf(manifestData), size: manifestData.length };
+            await this.client.writeContent(manifestDescriptor, manifestData, lease, this.manifestLabels(manifest));
+            await this.client.putImage({ name: name, target: manifestDescriptor }, lease);
+            await this.unpack(manifest, lease);
+            return name;
+        }
+        finally {
+            await this.client.removeSnapshot(this.snapshotter, view);
+            await this.client.deleteLease(lease);
+        }
+    }
+    /**
+     * Name an image again (a tag), its target the same
+     * @param name
+     * @param reference
+     */
+    async tag(name, reference) {
+        const image = await this.get(name);
+        if (!image)
+            throw Object.assign(new Error(`The image ${name} does not exist`), { code: 'NOT_FOUND' });
+        const target = imageName(reference);
+        await this.client.putImage({ name: target, target: image.target, labels: image.labels });
+        return target;
+    }
+    /**
+     * Remove an image (its content and its snapshots are collected by containerd once nothing references them)
+     * @param name
+     */
+    async remove(name) {
+        const image = await this.get(name);
+        if (!image)
+            throw Object.assign(new Error(`The image ${name} does not exist`), { code: 'NOT_FOUND' });
+        await this.client.deleteImage(image.name, true);
+    }
+    /**
+     * Import an archive of images: an OCI image layout (nerdctl save, docker save of Docker 25+), or an archive of
+     * docker save; the images named by the archive (or by a name given, to an archive of one image), unpacked for the
+     * platforms the machine runs
+     * @param source a file, or its stream
+     * @param options
+     */
+    async import(source, options = {}) {
+        await mkdir(this.temporary, { recursive: true });
+        const directory = await mkdtemp(path.join(this.temporary, 'lakutata-containerd-import-'));
+        const lease = await this.client.createLease();
+        try {
+            await this.extract(typeof source === 'string' ? createReadStream(source) : source, directory);
+            const file = (name) => path.join(directory, ...name.split('/'));
+            const blobFile = (digest) => file(`blobs/${digest.replace(':', '/')}`);
+            const exists = async (name) => !!(await stat(name).catch(() => undefined));
+            const names = [];
+            const named = (name) => options.name ? imageName(options.name) : name ? imageName(name) : undefined;
+            const index = await exists(file('index.json')) ? JSON.parse(await readFile(file('index.json'), 'utf8')) : undefined;
+            const entries = await exists(file('manifest.json')) ? JSON.parse(await readFile(file('manifest.json'), 'utf8')) : [];
+            if (options.name) {
+                //One name for one image (its tags: its entries of the same digest), checked before any import
+                const images = new Set((index?.manifests ?? []).map((entry) => entry.digest)).size || new Set(entries.map((entry) => entry.Config)).size;
+                if (images > 1)
+                    throw new Error(`The archive has ${images} images: the name ${options.name} can only be given to an archive of one image`);
+            }
+            if (index) {
+                const blob = async (descriptor) => createReadStream(blobFile(descriptor.digest));
+                for (const entry of index.manifests) {
+                    const name = named(entry.annotations?.['io.containerd.image.name'] ?? entry.annotations?.['org.opencontainers.image.ref.name']);
+                    await this.writeTree(entry, blob, lease);
+                    if (!name)
+                        continue;
+                    await this.client.putImage({ name: name, target: { mediaType: entry.mediaType, digest: entry.digest, size: entry.size } }, lease);
+                    if (!names.includes(name))
+                        names.push(name);
+                }
+            }
+            if (!names.length && entries.length) {
+                //docker save: uncompressed layers (or compressed ones), the configuration, the tags
+                for (const entry of entries) {
+                    const configData = await readFile(file(entry.Config));
+                    const layers = [];
+                    const layerFiles = new Map();
+                    for (const layer of entry.Layers) {
+                        const data = await readFile(file(layer));
+                        const digest = digestOf(data);
+                        const magic = data.subarray(0, 4).toString('hex');
+                        const mediaType = magic.startsWith('1f8b') ? MediaTypes.DOCKER_LAYER_GZIP : magic === '28b52ffd' ? 'application/vnd.oci.image.layer.v1.tar+zstd' : MediaTypes.DOCKER_LAYER;
+                        layers.push({ mediaType: mediaType, digest: digest, size: data.length });
+                        layerFiles.set(digest, file(layer));
+                    }
+                    const manifest = { schemaVersion: 2, mediaType: MediaTypes.DOCKER_MANIFEST, config: { mediaType: MediaTypes.DOCKER_CONFIG, digest: digestOf(configData), size: configData.length }, layers: layers };
+                    const manifestData = Buffer.from(JSON.stringify(manifest));
+                    const descriptor = { mediaType: MediaTypes.DOCKER_MANIFEST, digest: digestOf(manifestData), size: manifestData.length };
+                    await this.writeImage(manifest, async (blob) => blob.digest === manifest.config.digest ? configData : createReadStream(layerFiles.get(blob.digest)), lease, {});
+                    await this.client.writeContent(descriptor, manifestData, lease, this.manifestLabels(manifest));
+                    const tags = options.name ? [options.name] : entry.RepoTags?.length ? entry.RepoTags : [`import-${Date.now()}@${descriptor.digest}`];
+                    for (const tag of tags) {
+                        const name = imageName(tag);
+                        await this.client.putImage({ name: name, target: descriptor }, lease);
+                        names.push(name);
+                    }
+                }
+            }
+            if (!names.length)
+                throw new Error('The archive has no image: an OCI image layout (index.json) or an archive of docker save (manifest.json)');
+            if (options.unpack ?? true)
+                for (const name of names)
+                    await this.unpackFor(name, lease);
+            return names;
+        }
+        finally {
+            await this.client.deleteLease(lease);
+            await rm(directory, { recursive: true, force: true });
+        }
+    }
+    /**
+     * Write a manifest or an index of an archive, and what it references (the manifests the archive has)
+     * @param descriptor
+     * @param blob
+     * @param lease
+     */
+    async writeTree(descriptor, blob, lease) {
+        const data = await collect(await blob(descriptor));
+        if (isIndex(descriptor.mediaType)) {
+            const index = JSON.parse(data.toString('utf8'));
+            const labels = {};
+            for (let position = 0; position < index.manifests.length; position++) {
+                const child = index.manifests[position];
+                try {
+                    await this.writeTree(child, blob, lease);
+                    labels[Labels.contentRef('m', position)] = child.digest;
+                }
+                catch (error) {
+                    //The archives of a platform have the index of all of them
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+            return await this.client.writeContent(descriptor, data, lease, labels);
+        }
+        const manifest = JSON.parse(data.toString('utf8'));
+        await this.writeImage(manifest, blob, lease, {});
+        await this.client.writeContent(descriptor, data, lease, this.manifestLabels(manifest));
+    }
+    /**
+     * Extract an archive into a directory
+     * @param source
+     * @param directory
+     */
+    async extract(source, directory) {
+        const extractor = tarExtract();
+        extractor.on('entry', (header, entry, next) => {
+            const stream = entry;
+            const target = path.resolve(directory, header.name);
+            if (header.type !== 'file' || !target.startsWith(directory + path.sep)) {
+                stream.on('end', () => next()).resume();
+                return;
+            }
+            mkdir(path.dirname(target), { recursive: true })
+                .then(() => pipeline(stream, createWriteStream(target)))
+                .then(() => next(), (error) => next(error));
+        });
+        await pipeline(source, extractor);
+    }
+    /**
+     * Export images into an archive: an OCI image layout (named by io.containerd.image.name), with the manifest.json of
+     * docker load (the manifest of the platform of the machine, or the first one)
+     * @param names
+     * @param destination a file, or its stream
+     */
+    async export(names, destination) {
+        const blobs = new Map();
+        const entries = [];
+        const dockerManifests = [];
+        const blobPath = (digest) => `blobs/${digest.replace(':', '/')}`;
+        for (const name of names) {
+            const image = await this.get(name);
+            if (!image)
+                throw Object.assign(new Error(`The image ${name} does not exist`), { code: 'NOT_FOUND' });
+            const target = { mediaType: image.target.mediaType, digest: image.target.digest, size: Number(image.target.size) };
+            const reference = (() => {
+                try {
+                    return parseReference(image.name);
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            entries.push({ ...target, annotations: { 'io.containerd.image.name': image.name, ...reference?.tag ? { 'org.opencontainers.image.ref.name': reference.tag } : {} } });
+            blobs.set(target.digest, target);
+            const manifests = isIndex(target.mediaType) ? (await this.readJson(target.digest)).manifests : [target];
+            let first;
+            for (const descriptor of manifests) {
+                if (!isManifest(descriptor.mediaType) || !(await this.client.contentInfo(descriptor.digest)))
+                    continue;
+                const manifest = await this.readJson(descriptor.digest);
+                blobs.set(descriptor.digest, descriptor);
+                for (const blob of [manifest.config, ...manifest.layers])
+                    blobs.set(blob.digest, blob);
+                const config = await this.readJson(manifest.config.digest);
+                if (!first || platformRank(configPlatform(config), hostPlatform()) !== undefined)
+                    first = manifest;
+            }
+            if (first && reference) {
+                const short = reference.registry === 'docker.io' ? reference.repository.replace(/^library\//, '') : `${reference.registry}/${reference.repository}`;
+                dockerManifests.push({ Config: blobPath(first.config.digest), RepoTags: reference.tag ? [`${short}:${reference.tag}`] : [], Layers: first.layers.map((layer) => blobPath(layer.digest)) });
+            }
+        }
+        const archive = tarPack();
+        const output = pipeline(archive, typeof destination === 'string' ? createWriteStream(destination) : destination);
+        const entry = (name, data) => new Promise((resolve, reject) => void archive.entry({ name: name, size: data.length, mode: 0o644 }, data, (error) => error ? reject(error) : resolve()));
+        try {
+            await entry('oci-layout', Buffer.from(JSON.stringify({ imageLayoutVersion: '1.0.0' })));
+            for (const blob of blobs.values()) {
+                const size = Number((await this.client.contentInfo(blob.digest))?.size ?? blob.size);
+                await new Promise((resolve, reject) => {
+                    const writer = archive.entry({ name: blobPath(blob.digest), size: size, mode: 0o644 }, (error) => error ? reject(error) : resolve());
+                    pipeline(this.client.readContent(blob.digest), writer).catch(reject);
+                });
+            }
+            await entry('index.json', Buffer.from(JSON.stringify({ schemaVersion: 2, mediaType: MediaTypes.OCI_INDEX, manifests: entries })));
+            await entry('manifest.json', Buffer.from(JSON.stringify(dockerManifests)));
+            archive.finalize();
+        }
+        catch (error) {
+            archive.destroy(error);
+        }
+        await output;
+    }
+}