Add ---commit

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Clippy
         run: cargo clippy --workspace -- -D warnings
       - name: Unit tests
-        run: cargo test --bin cfsrun
+        run: cargo test --lib --bin cfsrun
       - name: Build cfsrun
         run: cargo build
       - name: Build cfsctl

Justfile

@@ -15,7 +15,7 @@ build-release:
 
 # Run unit tests only (no container image needed)
 test-unit:
-    cargo test --bin cfsrun
+    cargo test --lib --bin cfsrun
 
 # Run integration tests (pulls test image on first run, requires cfsctl)
 test-integration: build

README.md

@@ -67,6 +67,7 @@ Options:
   --device <PATH[:PATH[:PERMS]]>  Add host device
   --read-only             Read-only rootfs
   --overlay-dir <PATH>    Persistent overlay directory
+  --commit <REF>          Save the run's changes as a new image
   --network <MODE>        host|pasta|bridge|private
   --hostname <NAME>       Container hostname
   --privileged            Full capabilities, no seccomp/SELinux
@@ -77,6 +78,25 @@ Options:
   --add-host <HOST:IP>    Extra /etc/hosts entries
 ```
 
+### Committing a run
+
+```bash
+cfsrun --repo /tmp/repo --commit updated cs10 -- sh -c 'echo hello > /hello'
+cfsrun --repo /tmp/repo updated -- cat /hello
+```
+
+Use `--commit <REF>` to save the container's changes as a new image in the same
+repository. The new image is based on the image used to start the container and
+keeps its default configuration.
+
+Changes are saved after the container exits, including when its command fails.
+cfsrun preserves the container's exit status even if saving the image fails.
+In that case, it reports an error and keeps the writable directory for recovery.
+Detailed diagnostics may be saved to a log at the reported path.
+
+`--commit` cannot be combined with `--read-only` or `--rootfs`. Changes to bind
+mounts and temporary filesystems are excluded.
+
 ### Testing
 
 ```bash

composefs-run/Cargo.toml

@@ -11,6 +11,7 @@ path = "src/main.rs"
 
 [dependencies]
 anyhow = { version = "1.0", default-features = false }
+chrono = { version = "0.4", default-features = false, features = ["std"] }
 clap = { version = "4.5", default-features = false, features = ["std", "help", "usage", "derive"] }
 clap_complete = { version = "4.5", default-features = false, features = ["unstable-dynamic"] }
 composefs = { workspace = true }
@@ -22,10 +23,13 @@ libc = { version = "0.2", default-features = false }
 rustix = { version = "1.0.0", default-features = false, features = ["fs", "process", "mount", "pipe"] }
 serde = { version = "1.0", default-features = false, features = ["derive"] }
 serde_json = { version = "1.0", default-features = false, features = ["std"] }
+shlex = "2"
+tar-core = "0.1"
 tokio = { version = "1", default-features = false, features = ["rt-multi-thread", "net", "time"] }
 
 [dev-dependencies]
 tar = { version = "0.4", default-features = false }
+tempfile = "3"
 rustix = { version = "1.0.0", default-features = false, features = ["process"] }
 
 [lints.rust]