Artifact add optimization on macOS and Windows #27426

Honny1 · 2025-11-03T17:09:00Z

This PR adds a new local artifact add API endpoint and enforces absolute path requirements for local file operations.

Fixes: https://issues.redhat.com/browse/RUN-3385
Fixes: #26321

Benchmark

Command: podman artifact add quay.io/myartifact/benchmark:latest ./artifacts/random-file
Artifacts Dir content:

$ du -a -h | sort -hr
5G	.
5.0G ./random-file

Benchmark Results:

Mac OS

Number of runs: 10
Machine:
- Chip: Apple M3 Pro
- RAM: 36 GB
- SSD: 1 TB Apple SSD
Podman machine configuration:
- CPUs: 8
- Memory: 8.1 GB
report

Providers

applehv

Before: 32.82 s
After: 5.77 s

libkrun (krunkit 0.2.1)

Before: 25.87 s
After: 7.17 s

Windows

Windows 10
Number of runs: 10
Machine:
- CPU: Intel Core i7-8665U
- RAM: 32 GB
- SSD: 500 GB Samsung 970 Evo Plus
Podman machine configuration:
- CPUs: 8
- Memory: 2 GB (WSL) | 8.2 GB (Hyper-v)
report

Providers

WSL

Memory: 2 GB
Before: 35.25 s
After: 78.31 s

Hyper-V

Memory: 8.2 GB
Before: 362.70 s
After: 51.66 s

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Added new local artifact add API endpoint (`libpod/local/artifacts/add`) for loading artifacts from local files
Image and artifact load endpoints now require absolute paths for local file operations to improve security and prevent path ambiguity

TomSweeneyRedHat · 2025-11-04T21:59:34Z

Quick breeze, it LGTM, and happy green test buttons to boot!

baude · 2025-11-06T21:26:45Z

really quick pass LGTM ... hopefully someone can walk through a little slower than today allowed.

Honny1 · 2025-11-19T13:20:08Z

Based on benchmark results, I disabled this improvement for WSL. I rebenchmarked this improvement on Windows 11 and it didn't get better, but overall CPU usage is lower. Let me know if you think disabling this feature for WSL makes sense.

Benchmark report

PTAL: @Luap99 @baude @TomSweeneyRedHat @mheon

Honny1 · 2025-11-19T15:00:13Z

Unrelated CI failure; fixed in #27562

Fixes: https://issues.redhat.com/browse/RUN-3385 Fixes: containers#26321 Signed-off-by: Jan Rodák <[email protected]>

Signed-off-by: Jan Rodák <[email protected]>

The local API path optimization is ineffective on WSL because of NTFS mounting overhead. Signed-off-by: Jan Rodák <[email protected]>

TomSweeneyRedHat · 2025-11-19T20:27:04Z

LGTM
but I'd like a head nod or two from folks more familiar with macOS and Windows than I.

Honny1 · 2025-11-20T10:37:03Z

PTAL @l0rd

l0rd · 2025-11-20T16:57:59Z

@Honny1 I have tested with hyper-v but I cannot see any difference in terms of perfs. I will look at it closer tomorrow.

Honny1 · 2025-11-21T15:37:33Z

I reran that on Windows 11 and Hyper-V, and the results are the same; here is the report. I observed performance changes depending on the resources allocated to the Podman machine. I think I can set up an experiment to test different combinations, specifically comparing 2GB vs. 8GB of memory. Also, I am running these benchmarks on older hardware.

WDYT? @l0rd

Benchmark Report (hyperv)

l0rd · 2025-11-21T17:33:13Z

The problem was on my side. I didn't replace the podman service in the machine. Now I have fixed that and I can see the improvemnts in perfs (5s vs 65s!) and I have also quickly verified that a file in a drive that is not mounted in the machine is correctly copied (and is slower as expected).

LGTM on the Hyper-V side. I can have a look on WSL too if you want.

Honny1 · 2025-11-21T17:54:43Z

That would be great to verify if WSL can benefit from newer hardware. Don't forget to build from source and drop the latest commit from this PR. (It disables this feature for WSL.)

l0rd · 2025-11-24T10:16:39Z

I confirm that on WSL, there is no performance difference before/after if I use the last commit of this PR (11s vs 5s with HyperV). But I get the same performances using commit 2f7094c too:

> .\bin\windows\podman version
Client:       Podman Engine
....
Git Commit:   2f7094c0dea104703c9adb9aedc505e503d34c42-dirty
....
Server:       Podman Engine
...
Git Commit:   2f7094c0dea104703c9adb9aedc505e503d34c42
...

> Measure-Command { ./bin/windows/podman artifact add quay.io/myartifact/benchmark:latest ./artifacts/random-file }

Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 11
Milliseconds      : 933
Ticks             : 119333670
TotalDays         : 0.000138117673611111
TotalHours        : 0.00331482416666667
TotalMinutes      : 0.19888945
TotalSeconds      : 11.933367
TotalMilliseconds : 11933.367

> wsl --version
WSL version: 2.6.1.0
Kernel version: 6.6.87.2-1
WSLg version: 1.0.66
MSRDC version: 1.2.6353
Direct3D version: 1.611.1-81528511
DXCore version: 10.0.26100.1-240331-1435.ge-release
Windows version: 10.0.26200.7171

Honny1 · 2025-11-25T10:43:39Z

This indicates that on faster computers, this operation can perform similarly. I would still keep this feature disabled for WSL.

l0rd

I have reviewed the code and, except a minor comment/question, LGTM.

Out of curiosity (and It's not something introduced by this PR anyway), but why do we require the artifact path to be absolute?

l0rd · 2025-11-26T00:29:47Z

internal/localapi/utils.go

-// IsHyperVProvider checks if the current machine provider is Hyper-V.
-// It returns true if the provider is Hyper-V, false otherwise, or an error if the check fails.
-func IsHyperVProvider(ctx context.Context) (bool, error) {
+func getVmProviderType(ctx context.Context) (define.VMType, error) {


Can't we use getProvider here?

No, because this creates a small issue with providers and clients. When a user is using multiple providers, the client needs to determine which provider is used for the specific machine using that connection. I got caught by this. If we used getProvider, the user would need to specify CONTAINERS_MACHINE_PROVIDER before each command that utilizes the local API to determine which provider should be detected.

openshift-ci · 2025-11-26T00:37:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Honny1, l0rd

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Honny1,l0rd]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Honny1 · 2025-11-26T10:01:20Z

Out of curiosity (and It's not something introduced by this PR anyway), but why do we require the artifact path to be absolute?

The local API facilitates path translation from client to server for convenience. Mounted host directories mimic the host's absolute paths, so a path on the host matches the path inside the VM (with a small exception for Windows, where C:\\ translates to /mnt/c/). Consequently, users utilizing the Podman client do not need to strictly use absolute paths. This is standard behavior across all local APIs.

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Nov 3, 2025

github-actions bot added the kind/api-change Change to remote API; merits scrutiny label Nov 3, 2025

Honny1 force-pushed the local-api-artifact-add branch 6 times, most recently from 0b018d8 to 28a90c6 Compare November 4, 2025 14:00

Honny1 marked this pull request as ready for review November 6, 2025 10:27

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 6, 2025

Honny1 force-pushed the local-api-artifact-add branch from 28a90c6 to 7a6d65e Compare November 19, 2025 13:13

Honny1 added 3 commits November 19, 2025 18:20

Add local artifact add API endpoint

91af437

Fixes: https://issues.redhat.com/browse/RUN-3385 Fixes: containers#26321 Signed-off-by: Jan Rodák <[email protected]>

Require absolute path for local API

2f7094c

Signed-off-by: Jan Rodák <[email protected]>

artifact: Skip AddLocal optimization on WSL

d889aeb

The local API path optimization is ineffective on WSL because of NTFS mounting overhead. Signed-off-by: Jan Rodák <[email protected]>

Honny1 force-pushed the local-api-artifact-add branch from 7a6d65e to d889aeb Compare November 19, 2025 17:20

l0rd approved these changes Nov 26, 2025

View reviewed changes

Artifact add optimization on macOS and Windows #27426

Are you sure you want to change the base?

Artifact add optimization on macOS and Windows #27426

Uh oh!

Conversation

Honny1 commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmark

Benchmark Results:

Mac OS

Providers

applehv

libkrun (krunkit 0.2.1)

Windows

Providers

WSL

Hyper-V

Checklist

Does this PR introduce a user-facing change?

Uh oh!

TomSweeneyRedHat commented Nov 4, 2025

Uh oh!

baude commented Nov 6, 2025

Uh oh!

Honny1 commented Nov 19, 2025

Uh oh!

Honny1 commented Nov 19, 2025

Uh oh!

TomSweeneyRedHat commented Nov 19, 2025

Uh oh!

Honny1 commented Nov 20, 2025

Uh oh!

l0rd commented Nov 20, 2025

Uh oh!

Honny1 commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

l0rd commented Nov 21, 2025

Uh oh!

Honny1 commented Nov 21, 2025

Uh oh!

l0rd commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Honny1 commented Nov 25, 2025

Uh oh!

l0rd left a comment

Choose a reason for hiding this comment

Uh oh!

l0rd Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

Honny1 Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 26, 2025

Uh oh!

Honny1 commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Honny1 commented Nov 3, 2025 •

edited

Loading

Honny1 commented Nov 21, 2025 •

edited

Loading

l0rd commented Nov 24, 2025 •

edited

Loading