fix(erofs): write per-instance VMDK descriptor to bundle dir; use atomic write

[austinvazquez]

The merged_fs.vmdk descriptor was written to the snapshotter directory and reused across mounts via a bare existence check. If the backing extent files moved or were cleaned up, the cached descriptor became permanently stale with no recovery path.

Switch to a simpler, more correct design:

• Per-instance descriptor: write to the OCI bundle directory (filepath.Join(bundleDir, "merged_fs.vmdk")) so the file is scoped to one container lifetime and torn down with the bundle. No descriptor is shared across instances.
• Unconditional regeneration: regenerate on every transformMounts call — no existence check, no cache, no stale state possible.
• Atomic write: os.CreateTemp + fsync + os.Rename so concurrent writers each get a unique temporary filename and a reader never observes a partially-written file.

bundleDir is threaded through setupMounts and transformMounts; the erofs branch writes the descriptor to filepath.Join(bundleDir, "merged_fs.vmdk").

No new public API is introduced.

The erofs snapshotter now writes the VMDK extent descriptor to the per-instance bundle directory and regenerates it on every mount, eliminating the class of failures caused by stale cached descriptors.

[Copilot]

Pull request overview

Adds self-healing for the cached merged_fs.vmdk descriptor in the erofs snapshotter: descriptors are now validated on each mount, regenerated when stale, written with extent paths relative to the descriptor directory, and persisted via an atomic temp-file + rename.

Changes:

• internal/erofs/vmdk.go: New ParseVMDKDescriptorExtents; DumpVMDKDescriptor takes a baseDir to resolve relative paths for stat-ing; DumpVMDKDescriptorToFile writes atomically via .tmp + rename.
• internal/shim/task/mount.go: Computes per-descriptor relative device paths, validates the existing descriptor via new vmdkDescriptorIsStale, and regenerates on stale/parse failure.
• internal/erofs/vmdk_test.go: Adds round-trip, stale-detection, relative-path, large-extent, and atomic-write tests.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
internal/erofs/vmdk.go	Adds parser, atomic write, baseDir-aware stat, and relative-path support for descriptor writing.
internal/shim/task/mount.go	Builds relative extent paths, validates the cached descriptor, and triggers regeneration on stale/parse failure.
internal/erofs/vmdk_test.go	New unit tests covering round-trip parse, stale detection scenarios, relative-path resilience, and atomic write.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dmcgowan]

Ugh, this is still way too fragile

[austinvazquez]

Agreed on both fronts — generating per-instance and never persisting is the cleaner shape, and matches what the rest of the producer code in mount.go does (the bundle dir is already the natural home for ephemeral per-VM state). I'll rework this PR to:

• keep the tmp + fsync + rename atomic write
• move merged_fs.vmdk into the bundle dir and regenerate it unconditionally on each transformMounts call
• drop ParseVMDKDescriptorExtents and the relative-extent-path logic; they exist only to make the cache safe, and there's no cache anymore

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[hsiangkao]

If vmdks are generated in the bundle dirs, I think there is no concurrent write anyway.
but leaving write+fsync+rename is also fine.