Filesystem layout

The skeleton

Before it installs anything, corefs creates these directories in the target:

Created by corefs

boot  dev  etc  mnt  proc  run  sys  var  var/cache  var/log
usr  usr/bin  usr/lib  usr/lib64  usr/sbin
root   (mode 700)
tmp    (mode 1777)

The core-base package then adds what every system needs that no program ships: /etc/passwd, /etc/group, /etc/shadow, /etc/fstab, /etc/hosts, /etc/profile, /home, /var/tmp, and links such as /etc/os-release → /usr/lib/os-release and /var/run → /run.

usr merge

Core Linux is usr-merged: the top-level program and library directories are links into /usr.

Path	Links to
/bin	usr/bin
/lib	usr/lib
/lib64	usr/lib64
/sbin	usr/sbin

That's why repack moves these directories under usr/ when it converts an Alpine package.

Install records

For every package it unpacks, corefs writes a record:

/var/lib/corefs/<name>/

version   # the installed version, e.g. 1.37.0-r30
files     # every path the package unpacked

corefs can't upgrade or remove packages yet. The records are there so that can be added later without guessing what's installed.

The download cache

While it builds, corefs keeps downloaded packages in var/cache/corefs/pkg inside the target and deletes them before it finishes. Nothing is left in your working directory, and no build inputs ship in the finished system.

If you set COREFS_CACHE, corefs uses that directory instead and leaves it in place: a cache you chose yourself is one you want to keep.

Why not /tmp?

/tmp is writable by every user on the machine. corefs runs as root and unpacks packages into a root filesystem, so downloading them where other users can write would let them tamper with packages before they're unpacked.

Reproducible file modes

A root filesystem whose permissions depend on who built it isn't reproducible, and nothing tells you when it goes wrong. corefs prevents that with two lines:

umask 022        # fixes the modes of everything corefs creates itself
tar -xpJf ...    # -p: use the modes stored in the archive, not the umask

Building the same root filesystem under umasks 002, 027 and 077 gives identical file modes.

What goes wrong without -p

Without -p, tar run by a normal user applies the umask to the files it extracts. Under a strict umask like 077, that gives you an /etc/passwd with mode 600, and a system that can't look up a user name.