feat(feature): add dev container features support (#33)

Implements the full features pipeline: OCI registry download with
SHA-256 verification and bearer token auth, local feature staging,
topological sort on installsAfter, COPY-based build context into a
named temp dir, and option key normalization to uppercase env vars.

Adds integration tests for common-utils, node, and python OCI
features across ubuntu and fedora base images, plus a local feature
test exercising option passing and multi-file feature scripts.

Signed-off-by: Philippe Martin <phmartin@redhat.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: feloy

Cargo.lock

@@ -23,10 +23,17 @@ edition = "2024"
 clap = { version = "4", features = ["derive", "env"] }
 dirs = "5"
 env_logger = "0.11"
+flate2 = "1"
+kdn-workspace-configuration = { git = "https://github.com/openkaiden/kdn-api", tag = "v0.14.0" }
 log = "0.4"
+oci-spec = { version = "0.7", features = ["image"] }
 serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+tar = "0.4"
 tempfile = "3"
 toml = "0.8"
+ureq = "2"
 
 [dev-dependencies]
 ctor = "0.2"

Cargo.toml

@@ -76,3 +76,68 @@ Install the Claude agent in the image:
 ```sh
 openshell-image-builder --agent claude myimage:latest
 ```
+
+## Dev Container Features
+
+The tool supports [Dev Container Features](https://containers.dev/implementors/features/) declared in `.kaiden/workspace.json` in the current directory.
+
+### workspace.json schema
+
+```json
+{
+  "features": {
+    "<feature-ref>": {
+      "<option>": "<value>"
+    }
+  }
+}
+```
+
+Each key in `features` is a feature reference; each value is a map of options passed to the feature's `install.sh`.
+
+### Feature references
+
+| Format | Example | Resolves to |
+| --- | --- | --- |
+| OCI registry reference | `ghcr.io/devcontainers/features/rust:1` | downloaded from registry |
+| Local path | `./my-feature` | `.kaiden/my-feature/` |
+
+Local paths are resolved relative to `.kaiden/`: `./my-feature` points to `.kaiden/my-feature/`.
+
+OCI references without an explicit registry default to `ghcr.io`. Tags and digests (`@sha256:…`) are both supported. Direct `http://` / `https://` tarball URLs are not supported.
+
+### Installation order
+
+Features are installed in the order defined by each feature's `installsAfter` field in its `devcontainer-feature.json`. Within the same dependency level, features are processed in alphabetical order by reference.
+
+### Example
+
+```json
+{
+  "features": {
+    "ghcr.io/devcontainers/features/rust:1": {
+      "version": "stable",
+      "profile": "minimal"
+    },
+    "./my-feature": {}
+  }
+}
+```
+
+With the above, `./my-feature` refers to a local feature at `.kaiden/my-feature/`.
+
+### How it works
+
+When `.kaiden/workspace.json` is present, the tool:
+
+1. Downloads and extracts each OCI feature into a temporary build context directory (`/tmp/openshell-image-builder…`).
+2. Copies local feature directories into the same build context.
+3. Passes the build context to `podman build`, where each feature is installed via:
+   ```dockerfile
+   COPY features/<dir>/ /tmp/feature-install/<dir>/
+   RUN chmod +x /tmp/feature-install/<dir>/install.sh && \
+       OPTION="value" /tmp/feature-install/<dir>/install.sh
+   ```
+4. Cleans up all feature files from the image with `RUN rm -rf /tmp/feature-install` after all features are installed.
+
+Features run as root so install scripts can write to system paths.

README.md

@@ -15,6 +15,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use std::io::Write;
+use std::path::Path;
 use std::process::{Command, ExitStatus};
 
 use tempfile::NamedTempFile;
@@ -66,20 +67,26 @@ impl From<std::io::Error> for BuildError {
     }
 }
 
-pub fn build(containerfile: &str, tag: &str, runner: &impl Runner) -> Result<(), BuildError> {
+pub fn build(
+    containerfile: &str,
+    tag: &str,
+    runner: &impl Runner,
+    context_dir: &Path,
+) -> Result<(), BuildError> {
     let mut tmpfile = NamedTempFile::new()?;
     tmpfile.write_all(containerfile.as_bytes())?;
 
     log::debug!(
-        "running: podman build -f {} -t {tag} .",
-        tmpfile.path().display()
+        "running: podman build -f {} -t {tag} {}",
+        tmpfile.path().display(),
+        context_dir.display()
     );
 
     let mut cmd = Command::new("podman");
     cmd.args(["build", "-f"])
         .arg(tmpfile.path())
         .args(["-t", tag])
-        .arg(".");
+        .arg(context_dir);
 
     let status = runner.run(&mut cmd)?;
 
@@ -118,21 +125,21 @@ mod tests {
     #[test]
     fn build_succeeds() {
         let runner = FakeRunner(|| Ok(exit_with(0)));
-        assert!(build(CONTAINERFILE, TAG, &runner).is_ok());
+        assert!(build(CONTAINERFILE, TAG, &runner, Path::new(".")).is_ok());
     }
 
     #[test]
     fn build_fails_with_exit_code() {
         let runner = FakeRunner(|| Ok(exit_with(1)));
-        let err = build(CONTAINERFILE, TAG, &runner).unwrap_err();
+        let err = build(CONTAINERFILE, TAG, &runner, Path::new(".")).unwrap_err();
         assert!(matches!(err, BuildError::Failed { exit_code: Some(1) }));
     }
 
     #[test]
     fn build_propagates_io_error() {
         let runner =
             FakeRunner(|| Err(io::Error::new(io::ErrorKind::NotFound, "podman not found")));
-        let err = build(CONTAINERFILE, TAG, &runner).unwrap_err();
+        let err = build(CONTAINERFILE, TAG, &runner, Path::new(".")).unwrap_err();
         assert!(matches!(err, BuildError::Io(_)));
     }
 
@@ -141,7 +148,7 @@ mod tests {
     fn build_signal_killed() {
         use std::os::unix::process::ExitStatusExt;
         let runner = FakeRunner(|| Ok(ExitStatus::from_raw(9)));
-        let err = build(CONTAINERFILE, TAG, &runner).unwrap_err();
+        let err = build(CONTAINERFILE, TAG, &runner, Path::new(".")).unwrap_err();
         assert!(matches!(err, BuildError::Failed { exit_code: None }));
     }