Vendor in latest containers/storage

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

vendor.conf

@@ -16,7 +16,7 @@ github.com/containerd/continuity 004b46473808b3e7a4a3049c20e4376c91eb966d
 github.com/containernetworking/cni v0.7.0-alpha1
 github.com/containernetworking/plugins v0.7.4
 github.com/containers/image v1.3
-github.com/containers/storage v1.6
+github.com/containers/storage v1.7
 github.com/containers/psgo v1.1
 github.com/coreos/go-systemd v14
 github.com/cri-o/ocicni 2d2983e40c242322a56c22a903785e7f83eb378c

vendor/github.com/containers/storage/containers_ffjson.go

@@ -1,5 +1,5 @@
 // Code generated by ffjson <https://github.com/pquerna/ffjson>. DO NOT EDIT.
-// source: containers.go
+// source: ./containers.go
 
 package storage
 

vendor/github.com/containers/storage/drivers/aufs/aufs.go

@@ -253,6 +253,11 @@ func (a *Driver) AdditionalImageStores() []string {
 	return nil
 }
 
+// CreateFromTemplate creates a layer with the same contents and parent as another layer.
+func (a *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
+	return graphdriver.NaiveCreateFromTemplate(a, id, template, templateIDMappings, parent, parentIDMappings, opts, readWrite)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (a *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {

vendor/github.com/containers/storage/drivers/btrfs/btrfs.go

@@ -490,6 +490,11 @@ func (d *Driver) quotasDirID(id string) string {
 	return path.Join(d.quotasDir(), id)
 }
 
+// CreateFromTemplate creates a layer with the same contents and parent as another layer.
+func (d *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
+	return d.Create(id, template, opts)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {

vendor/github.com/containers/storage/drivers/devmapper/driver.go

@@ -123,6 +123,11 @@ func (d *Driver) Cleanup() error {
 	return err
 }
 
+// CreateFromTemplate creates a layer with the same contents and parent as another layer.
+func (d *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
+	return d.Create(id, template, opts)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {

vendor/github.com/containers/storage/drivers/driver.go

@@ -72,6 +72,9 @@ type ProtoDriver interface {
 	// specified id and parent and options passed in opts. Parent
 	// may be "" and opts may be nil.
 	Create(id, parent string, opts *CreateOpts) error
+	// CreateFromTemplate creates a new filesystem layer with the specified id
+	// and parent, with contents identical to the specified template layer.
+	CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *CreateOpts, readWrite bool) error
 	// Remove attempts to remove the filesystem layer with this id.
 	Remove(id string) error
 	// Get returns the mountpoint for the layered filesystem referred

vendor/github.com/containers/storage/drivers/overlay/check.go

@@ -10,6 +10,8 @@ import (
 	"path/filepath"
 	"syscall"
 
+	"github.com/containers/storage/pkg/ioutils"
+	"github.com/containers/storage/pkg/mount"
 	"github.com/containers/storage/pkg/system"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -57,10 +59,11 @@ func doesSupportNativeDiff(d, mountOpts string) error {
 	}
 
 	opts := fmt.Sprintf("lowerdir=%s:%s,upperdir=%s,workdir=%s", path.Join(td, "l2"), path.Join(td, "l1"), path.Join(td, "l3"), path.Join(td, "work"))
-	if mountOpts != "" {
-		opts = fmt.Sprintf("%s,%s", opts, mountOpts)
+	flags, data := mount.ParseOptions(mountOpts)
+	if data != "" {
+		opts = fmt.Sprintf("%s,%s", opts, data)
 	}
-	if err := unix.Mount("overlay", filepath.Join(td, "merged"), "overlay", 0, opts); err != nil {
+	if err := unix.Mount("overlay", filepath.Join(td, "merged"), "overlay", uintptr(flags), opts); err != nil {
 		return errors.Wrap(err, "failed to mount overlay")
 	}
 	defer func() {
@@ -103,3 +106,60 @@ func doesSupportNativeDiff(d, mountOpts string) error {
 
 	return nil
 }
+
+// doesMetacopy checks if the filesystem is going to optimize changes to
+// metadata by using nodes marked with an "overlay.metacopy" attribute to avoid
+// copying up a file from a lower layer unless/until its contents are being
+// modified
+func doesMetacopy(d, mountOpts string) (bool, error) {
+	td, err := ioutil.TempDir(d, "metacopy-check")
+	if err != nil {
+		return false, err
+	}
+	defer func() {
+		if err := os.RemoveAll(td); err != nil {
+			logrus.Warnf("Failed to remove check directory %v: %v", td, err)
+		}
+	}()
+
+	// Make directories l1, l2, work, merged
+	if err := os.MkdirAll(filepath.Join(td, "l1"), 0755); err != nil {
+		return false, err
+	}
+	if err := ioutils.AtomicWriteFile(filepath.Join(td, "l1", "f"), []byte{0xff}, 0700); err != nil {
+		return false, err
+	}
+	if err := os.MkdirAll(filepath.Join(td, "l2"), 0755); err != nil {
+		return false, err
+	}
+	if err := os.Mkdir(filepath.Join(td, "work"), 0755); err != nil {
+		return false, err
+	}
+	if err := os.Mkdir(filepath.Join(td, "merged"), 0755); err != nil {
+		return false, err
+	}
+	// Mount using the mandatory options and configured options
+	opts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", path.Join(td, "l1"), path.Join(td, "l2"), path.Join(td, "work"))
+	flags, data := mount.ParseOptions(mountOpts)
+	if data != "" {
+		opts = fmt.Sprintf("%s,%s", opts, data)
+	}
+	if err := unix.Mount("overlay", filepath.Join(td, "merged"), "overlay", uintptr(flags), opts); err != nil {
+		return false, errors.Wrap(err, "failed to mount overlay for metacopy check")
+	}
+	defer func() {
+		if err := unix.Unmount(filepath.Join(td, "merged"), 0); err != nil {
+			logrus.Warnf("Failed to unmount check directory %v: %v", filepath.Join(td, "merged"), err)
+		}
+	}()
+	// Make a change that only impacts the inode, and check if the pulled-up copy is marked
+	// as a metadata-only copy
+	if err := os.Chmod(filepath.Join(td, "merged", "f"), 0600); err != nil {
+		return false, errors.Wrap(err, "error changing permissions on file for metacopy check")
+	}
+	metacopy, err := system.Lgetxattr(filepath.Join(td, "l2", "f"), "trusted.overlay.metacopy")
+	if err != nil {
+		return false, errors.Wrap(err, "metacopy flag was not set on file in upper layer")
+	}
+	return metacopy != nil, nil
+}

vendor/github.com/containers/storage/drivers/overlay/overlay.go

@@ -85,13 +85,12 @@ const (
 )
 
 type overlayOptions struct {
-	overrideKernelCheck bool
-	imageStores         []string
-	quota               quota.Quota
-	mountProgram        string
-	ostreeRepo          string
-	skipMountHome       bool
-	mountOptions        string
+	imageStores   []string
+	quota         quota.Quota
+	mountProgram  string
+	ostreeRepo    string
+	skipMountHome bool
+	mountOptions  string
 }
 
 // Driver contains information about the home directory and the list of active mounts that are created using this driver.
@@ -105,6 +104,7 @@ type Driver struct {
 	options       overlayOptions
 	naiveDiff     graphdriver.DiffDriver
 	supportsDType bool
+	usingMetacopy bool
 	locker        *locker.Locker
 	convert       map[string]bool
 }
@@ -174,6 +174,18 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
 		}
 	}
 
+	usingMetacopy, err := doesMetacopy(home, opts.mountOptions)
+	if err == nil {
+		if usingMetacopy {
+			logrus.Debugf("overlay test mount indicated that metacopy is being used")
+		} else {
+			logrus.Debugf("overlay test mount indicated that metacopy is not being used")
+		}
+	} else {
+		logrus.Warnf("overlay test mount did not indicate whether or not metacopy is being used: %v", err)
+		return nil, err
+	}
+
 	if !opts.skipMountHome {
 		if err := mount.MakePrivate(home); err != nil {
 			return nil, err
@@ -193,6 +205,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
 		gidMaps:       gidMaps,
 		ctr:           graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicOverlay)),
 		supportsDType: supportsDType,
+		usingMetacopy: usingMetacopy,
 		locker:        locker.New(),
 		options:       *opts,
 		convert:       make(map[string]bool),
@@ -212,7 +225,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
 		return nil, fmt.Errorf("Storage option overlay.size only supported for backingFS XFS. Found %v", backingFs)
 	}
 
-	logrus.Debugf("backingFs=%s, projectQuotaSupported=%v, useNativeDiff=%v", backingFs, projectQuotaSupported, !d.useNaiveDiff())
+	logrus.Debugf("backingFs=%s, projectQuotaSupported=%v, useNativeDiff=%v, usingMetacopy=%v", backingFs, projectQuotaSupported, !d.useNaiveDiff(), d.usingMetacopy)
 
 	return d, nil
 }
@@ -226,12 +239,6 @@ func parseOptions(options []string) (*overlayOptions, error) {
 		}
 		key = strings.ToLower(key)
 		switch key {
-		case ".override_kernel_check", "overlay.override_kernel_check", "overlay2.override_kernel_check":
-			logrus.Debugf("overlay: override_kernelcheck=%s", val)
-			o.overrideKernelCheck, err = strconv.ParseBool(val)
-			if err != nil {
-				return nil, err
-			}
 		case ".mountopt", "overlay.mountopt", "overlay2.mountopt":
 			o.mountOptions = val
 		case ".size", "overlay.size", "overlay2.size":
@@ -375,6 +382,7 @@ func (d *Driver) Status() [][2]string {
 		{"Backing Filesystem", backingFs},
 		{"Supports d_type", strconv.FormatBool(d.supportsDType)},
 		{"Native Overlay Diff", strconv.FormatBool(!d.useNaiveDiff())},
+		{"Using metacopy", strconv.FormatBool(d.usingMetacopy)},
 	}
 }
 
@@ -410,6 +418,14 @@ func (d *Driver) Cleanup() error {
 	return mount.Unmount(d.home)
 }
 
+// CreateFromTemplate creates a layer with the same contents and parent as another layer.
+func (d *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
+	if readWrite {
+		return d.CreateReadWrite(id, template, opts)
+	}
+	return d.Create(id, template, opts)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {

vendor/github.com/containers/storage/drivers/template.go

@@ -0,0 +1,45 @@
+package graphdriver
+
+import (
+	"github.com/sirupsen/logrus"
+
+	"github.com/containers/storage/pkg/idtools"
+)
+
+// TemplateDriver is just barely enough of a driver that we can implement a
+// naive version of CreateFromTemplate on top of it.
+type TemplateDriver interface {
+	DiffDriver
+	CreateReadWrite(id, parent string, opts *CreateOpts) error
+	Create(id, parent string, opts *CreateOpts) error
+	Remove(id string) error
+}
+
+// CreateFromTemplate creates a layer with the same contents and parent as
+// another layer.  Internally, it may even depend on that other layer
+// continuing to exist, as if it were actually a child of the child layer.
+func NaiveCreateFromTemplate(d TemplateDriver, id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *CreateOpts, readWrite bool) error {
+	var err error
+	if readWrite {
+		err = d.CreateReadWrite(id, parent, opts)
+	} else {
+		err = d.Create(id, parent, opts)
+	}
+	if err != nil {
+		return err
+	}
+	diff, err := d.Diff(template, templateIDMappings, parent, parentIDMappings, opts.MountLabel)
+	if err != nil {
+		if err2 := d.Remove(id); err2 != nil {
+			logrus.Errorf("error removing layer %q: %v", id, err2)
+		}
+		return err
+	}
+	if _, err = d.ApplyDiff(id, templateIDMappings, parent, opts.MountLabel, diff); err != nil {
+		if err2 := d.Remove(id); err2 != nil {
+			logrus.Errorf("error removing layer %q: %v", id, err2)
+		}
+		return err
+	}
+	return nil
+}

vendor/github.com/containers/storage/drivers/vfs/driver.go

@@ -99,6 +99,14 @@ func (d *Driver) Cleanup() error {
 	return nil
 }
 
+// CreateFromTemplate creates a layer with the same contents and parent as another layer.
+func (d *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
+	if readWrite {
+		return d.CreateReadWrite(id, template, opts)
+	}
+	return d.Create(id, template, opts)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {

vendor/github.com/containers/storage/drivers/windows/windows.go

@@ -185,6 +185,11 @@ func (d *Driver) Exists(id string) bool {
 	return result
 }
 
+// CreateFromTemplate creates a layer with the same contents and parent as another layer.
+func (d *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
+	return graphdriver.NaiveCreateFromTemplate(d, id, template, templateIDMappings, parent, parentIDMappings, opts, readWrite)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {

vendor/github.com/containers/storage/drivers/zfs/zfs.go

@@ -259,6 +259,11 @@ func (d *Driver) mountPath(id string) string {
 	return path.Join(d.options.mountPath, "graph", getMountpoint(id))
 }
 
+// CreateFromTemplate creates a layer with the same contents and parent as another layer.
+func (d *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
+	return d.Create(id, template, opts)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {

vendor/github.com/containers/storage/images.go

@@ -42,7 +42,9 @@ type Image struct {
 
 	// MappedTopLayers are the IDs of alternate versions of the top layer
 	// which have the same contents and parent, and which differ from
-	// TopLayer only in which ID mappings they use.
+	// TopLayer only in which ID mappings they use.  When the image is
+	// to be removed, they should be removed before the TopLayer, as the
+	// graph driver may depend on that.
 	MappedTopLayers []string `json:"mapped-layers,omitempty"`
 
 	// Metadata is data we keep for the convenience of the caller.  It is not

vendor/github.com/containers/storage/images_ffjson.go

@@ -1,5 +1,5 @@
 // Code generated by ffjson <https://github.com/pquerna/ffjson>. DO NOT EDIT.
-// source: images.go
+// source: ./images.go
 
 package storage
 

vendor/github.com/containers/storage/layers.go

@@ -551,9 +551,20 @@ func (r *layerStore) Put(id string, parentLayer *Layer, names []string, mountLab
 		}
 	}
 	parent := ""
-	var parentMappings *idtools.IDMappings
 	if parentLayer != nil {
 		parent = parentLayer.ID
+	}
+	var parentMappings, templateIDMappings, oldMappings *idtools.IDMappings
+	if moreOptions.TemplateLayer != "" {
+		templateLayer, ok := r.lookup(moreOptions.TemplateLayer)
+		if !ok {
+			return nil, -1, ErrLayerUnknown
+		}
+		templateIDMappings = idtools.NewIDMappingsFromMaps(templateLayer.UIDMap, templateLayer.GIDMap)
+	} else {
+		templateIDMappings = &idtools.IDMappings{}
+	}
+	if parentLayer != nil {
 		parentMappings = idtools.NewIDMappingsFromMaps(parentLayer.UIDMap, parentLayer.GIDMap)
 	} else {
 		parentMappings = &idtools.IDMappings{}
@@ -566,23 +577,34 @@ func (r *layerStore) Put(id string, parentLayer *Layer, names []string, mountLab
 		MountLabel: mountLabel,
 		StorageOpt: options,
 	}
-	if writeable {
-		if err = r.driver.CreateReadWrite(id, parent, &opts); err != nil {
+	if moreOptions.TemplateLayer != "" {
+		if err = r.driver.CreateFromTemplate(id, moreOptions.TemplateLayer, templateIDMappings, parent, parentMappings, &opts, writeable); err != nil {
 			if id != "" {
-				return nil, -1, errors.Wrapf(err, "error creating read-write layer with ID %q", id)
+				return nil, -1, errors.Wrapf(err, "error creating copy of template layer %q with ID %q", moreOptions.TemplateLayer, id)
 			}
-			return nil, -1, errors.Wrapf(err, "error creating read-write layer")
+			return nil, -1, errors.Wrapf(err, "error creating copy of template layer %q", moreOptions.TemplateLayer)
 		}
+		oldMappings = templateIDMappings
 	} else {
-		if err = r.driver.Create(id, parent, &opts); err != nil {
-			if id != "" {
-				return nil, -1, errors.Wrapf(err, "error creating layer with ID %q", id)
+		if writeable {
+			if err = r.driver.CreateReadWrite(id, parent, &opts); err != nil {
+				if id != "" {
+					return nil, -1, errors.Wrapf(err, "error creating read-write layer with ID %q", id)
+				}
+				return nil, -1, errors.Wrapf(err, "error creating read-write layer")
+			}
+		} else {
+			if err = r.driver.Create(id, parent, &opts); err != nil {
+				if id != "" {
+					return nil, -1, errors.Wrapf(err, "error creating layer with ID %q", id)
+				}
+				return nil, -1, errors.Wrapf(err, "error creating layer")
 			}
-			return nil, -1, errors.Wrapf(err, "error creating layer")
 		}
+		oldMappings = parentMappings
 	}
-	if !reflect.DeepEqual(parentMappings.UIDs(), idMappings.UIDs()) || !reflect.DeepEqual(parentMappings.GIDs(), idMappings.GIDs()) {
-		if err = r.driver.UpdateLayerIDMap(id, parentMappings, idMappings, mountLabel); err != nil {
+	if !reflect.DeepEqual(oldMappings.UIDs(), idMappings.UIDs()) || !reflect.DeepEqual(oldMappings.GIDs(), idMappings.GIDs()) {
+		if err = r.driver.UpdateLayerIDMap(id, oldMappings, idMappings, mountLabel); err != nil {
 			// We don't have a record of this layer, but at least
 			// try to clean it up underneath us.
 			r.driver.Remove(id)

vendor/github.com/containers/storage/layers_ffjson.go

@@ -1,5 +1,5 @@
 // Code generated by ffjson <https://github.com/pquerna/ffjson>. DO NOT EDIT.
-// source: layers.go
+// source: ./layers.go
 
 package storage
 

vendor/github.com/containers/storage/pkg/archive/example_changes.go

@@ -0,0 +1,97 @@
+// +build ignore
+
+// Simple tool to create an archive stream from an old and new directory
+//
+// By default it will stream the comparison of two temporary directories with junk files
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path"
+
+	"github.com/containers/storage/pkg/archive"
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	flDebug  = flag.Bool("D", false, "debugging output")
+	flNewDir = flag.String("newdir", "", "")
+	flOldDir = flag.String("olddir", "", "")
+	log      = logrus.New()
+)
+
+func main() {
+	flag.Usage = func() {
+		fmt.Println("Produce a tar from comparing two directory paths. By default a demo tar is created of around 200 files (including hardlinks)")
+		fmt.Printf("%s [OPTIONS]\n", os.Args[0])
+		flag.PrintDefaults()
+	}
+	flag.Parse()
+	log.Out = os.Stderr
+	if (len(os.Getenv("DEBUG")) > 0) || *flDebug {
+		logrus.SetLevel(logrus.DebugLevel)
+	}
+	var newDir, oldDir string
+
+	if len(*flNewDir) == 0 {
+		var err error
+		newDir, err = ioutil.TempDir("", "storage-test-newDir")
+		if err != nil {
+			log.Fatal(err)
+		}
+		defer os.RemoveAll(newDir)
+		if _, err := prepareUntarSourceDirectory(100, newDir, true); err != nil {
+			log.Fatal(err)
+		}
+	} else {
+		newDir = *flNewDir
+	}
+
+	if len(*flOldDir) == 0 {
+		oldDir, err := ioutil.TempDir("", "storage-test-oldDir")
+		if err != nil {
+			log.Fatal(err)
+		}
+		defer os.RemoveAll(oldDir)
+	} else {
+		oldDir = *flOldDir
+	}
+
+	changes, err := archive.ChangesDirs(newDir, oldDir)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	a, err := archive.ExportChanges(newDir, changes)
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer a.Close()
+
+	i, err := io.Copy(os.Stdout, a)
+	if err != nil && err != io.EOF {
+		log.Fatal(err)
+	}
+	fmt.Fprintf(os.Stderr, "wrote archive of %d bytes", i)
+}
+
+func prepareUntarSourceDirectory(numberOfFiles int, targetPath string, makeLinks bool) (int, error) {
+	fileData := []byte("fooo")
+	for n := 0; n < numberOfFiles; n++ {
+		fileName := fmt.Sprintf("file-%d", n)
+		if err := ioutil.WriteFile(path.Join(targetPath, fileName), fileData, 0700); err != nil {
+			return 0, err
+		}
+		if makeLinks {
+			if err := os.Link(path.Join(targetPath, fileName), path.Join(targetPath, fileName+"-link")); err != nil {
+				return 0, err
+			}
+		}
+	}
+	totalSize := numberOfFiles * len(fileData)
+	return totalSize, nil
+}

vendor/github.com/containers/storage/store.go

@@ -482,6 +482,10 @@ type LayerOptions struct {
 	// inherit settings from its parent layer or, if it has no parent
 	// layer, the Store object.
 	IDMappingOptions
+	// TemplateLayer is the ID of a layer whose contents will be used to
+	// initialize this layer.  If set, it should be a child of the layer
+	// which we want to use as the parent of the new layer.
+	TemplateLayer string
 }
 
 // ImageOptions is used for passing options to a Store's CreateImage() method.
@@ -973,7 +977,7 @@ func (s *store) CreateImage(id string, names []string, layer, metadata string, o
 	return ristore.Create(id, names, layer, metadata, creationDate, options.Digest)
 }
 
-func (s *store) imageTopLayerForMapping(image *Image, ristore ROImageStore, readWrite bool, rlstore LayerStore, lstores []ROLayerStore, options IDMappingOptions) (*Layer, error) {
+func (s *store) imageTopLayerForMapping(image *Image, ristore ROImageStore, createMappedLayer bool, rlstore LayerStore, lstores []ROLayerStore, options IDMappingOptions) (*Layer, error) {
 	layerMatchesMappingOptions := func(layer *Layer, options IDMappingOptions) bool {
 		// If the driver supports shifting and the layer has no mappings, we can use it.
 		if s.graphDriver.SupportsShifting() && len(layer.UIDMap) == 0 && len(layer.GIDMap) == 0 {
@@ -994,7 +998,6 @@ func (s *store) imageTopLayerForMapping(image *Image, ristore ROImageStore, read
 		return reflect.DeepEqual(layer.UIDMap, options.UIDMap) && reflect.DeepEqual(layer.GIDMap, options.GIDMap)
 	}
 	var layer, parentLayer *Layer
-	var layerHomeStore ROLayerStore
 	// Locate the image's top layer and its parent, if it has one.
 	for _, store := range append([]ROLayerStore{rlstore}, lstores...) {
 		if store != rlstore {
@@ -1027,7 +1030,6 @@ func (s *store) imageTopLayerForMapping(image *Image, ristore ROImageStore, read
 				if layer == nil {
 					layer = cLayer
 					parentLayer = cParentLayer
-					layerHomeStore = store
 				}
 			}
 		}
@@ -1037,27 +1039,25 @@ func (s *store) imageTopLayerForMapping(image *Image, ristore ROImageStore, read
 	}
 	// The top layer's mappings don't match the ones we want, but it's in a read-only
 	// image store, so we can't create and add a mapped copy of the layer to the image.
-	if !readWrite {
+	// We'll have to do the mapping for the container itself, elsewhere.
+	if !createMappedLayer {
 		return layer, nil
 	}
 	// The top layer's mappings don't match the ones we want, and it's in an image store
 	// that lets us edit image metadata...
 	if istore, ok := ristore.(*imageStore); ok {
-		// ... so extract the layer's contents, create a new copy of it with the
-		// desired mappings, and register it as an alternate top layer in the image.
-		noCompression := archive.Uncompressed
-		diffOptions := DiffOptions{
-			Compression: &noCompression,
-		}
-		rc, err := layerHomeStore.Diff("", layer.ID, &diffOptions)
-		if err != nil {
-			return nil, errors.Wrapf(err, "error reading layer %q to create an ID-mapped version of it", layer.ID)
-		}
-		defer rc.Close()
-
+		// ... so create a duplicate of the layer with the desired mappings, and
+		// register it as an alternate top layer in the image.
 		var layerOptions LayerOptions
 		if s.graphDriver.SupportsShifting() {
-			layerOptions = LayerOptions{IDMappingOptions: IDMappingOptions{HostUIDMapping: true, HostGIDMapping: true, UIDMap: nil, GIDMap: nil}}
+			layerOptions = LayerOptions{
+				IDMappingOptions: IDMappingOptions{
+					HostUIDMapping: true,
+					HostGIDMapping: true,
+					UIDMap:         nil,
+					GIDMap:         nil,
+				},
+			}
 		} else {
 			layerOptions = LayerOptions{
 				IDMappingOptions: IDMappingOptions{
@@ -1068,9 +1068,10 @@ func (s *store) imageTopLayerForMapping(image *Image, ristore ROImageStore, read
 				},
 			}
 		}
-		mappedLayer, _, err := rlstore.Put("", parentLayer, nil, layer.MountLabel, nil, &layerOptions, false, nil, rc)
+		layerOptions.TemplateLayer = layer.ID
+		mappedLayer, _, err := rlstore.Put("", parentLayer, nil, layer.MountLabel, nil, &layerOptions, false, nil, nil)
 		if err != nil {
-			return nil, errors.Wrapf(err, "error creating ID-mapped copy of layer %q", layer.ID)
+			return nil, errors.Wrapf(err, "error creating an ID-mapped copy of layer %q", layer.ID)
 		}
 		if err = istore.addMappedTopLayer(image.ID, mappedLayer.ID); err != nil {
 			if err2 := rlstore.Delete(mappedLayer.ID); err2 != nil {
@@ -1144,7 +1145,9 @@ func (s *store) CreateContainer(id string, names []string, image, layer, metadat
 		}
 		imageID = cimage.ID
 
-		ilayer, err := s.imageTopLayerForMapping(cimage, imageHomeStore, imageHomeStore == istore, rlstore, lstores, idMappingsOptions)
+		createMappedLayer := imageHomeStore == istore
+
+		ilayer, err := s.imageTopLayerForMapping(cimage, imageHomeStore, createMappedLayer, rlstore, lstores, idMappingsOptions)
 		if err != nil {
 			return nil, err
 		}
@@ -1170,7 +1173,14 @@ func (s *store) CreateContainer(id string, names []string, image, layer, metadat
 	}
 	var layerOptions *LayerOptions
 	if s.graphDriver.SupportsShifting() {
-		layerOptions = &LayerOptions{IDMappingOptions: IDMappingOptions{HostUIDMapping: true, HostGIDMapping: true, UIDMap: nil, GIDMap: nil}}
+		layerOptions = &LayerOptions{
+			IDMappingOptions: IDMappingOptions{
+				HostUIDMapping: true,
+				HostGIDMapping: true,
+				UIDMap:         nil,
+				GIDMap:         nil,
+			},
+		}
 	} else {
 		layerOptions = &LayerOptions{
 			IDMappingOptions: IDMappingOptions{
@@ -2091,10 +2101,10 @@ func (s *store) DeleteImage(id string, commit bool) (layers []string, err error)
 				break
 			}
 			lastRemoved = layer
-			layersToRemove = append(layersToRemove, lastRemoved)
 			if layer == image.TopLayer {
 				layersToRemove = append(layersToRemove, image.MappedTopLayers...)
 			}
+			layersToRemove = append(layersToRemove, lastRemoved)
 			layer = parent
 		}
 	} else {
@@ -3064,9 +3074,6 @@ type OptionsConfig struct {
 	// Size
 	Size string `toml:"size"`
 
-	// OverrideKernelCheck
-	OverrideKernelCheck string `toml:"override_kernel_check"`
-
 	// RemapUIDs is a list of default UID mappings to use for layers.
 	RemapUIDs string `toml:"remap-uids"`
 	// RemapGIDs is a list of default GID mappings to use for layers.
@@ -3191,9 +3198,6 @@ func ReloadConfigurationFile(configFile string, storeOptions *StoreOptions) {
 	if config.Storage.Options.MountOpt != "" {
 		storeOptions.GraphDriverOptions = append(storeOptions.GraphDriverOptions, fmt.Sprintf("%s.mountopt=%s", config.Storage.Driver, config.Storage.Options.MountOpt))
 	}
-	if config.Storage.Options.OverrideKernelCheck != "" {
-		storeOptions.GraphDriverOptions = append(storeOptions.GraphDriverOptions, fmt.Sprintf("%s.override_kernel_check=%s", config.Storage.Driver, config.Storage.Options.OverrideKernelCheck))
-	}
 	if config.Storage.Options.RemapUser != "" && config.Storage.Options.RemapGroup == "" {
 		config.Storage.Options.RemapGroup = config.Storage.Options.RemapUser
 	}