Add extract command to retrieve files from image layers

Adds a new "extract" subcommand that extracts file contents from
container image layers. Layers are searched in reverse order so the
result matches the effective filesystem of a running container.
Supports writing to stdout (default) or to a directory via --output_dir.

Author: pcj

main.go

@@ -5,8 +5,10 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 	"sort"
 	"strconv"
+	"strings"
 	"text/tabwriter"
 
 	"github.com/dustin/go-humanize"
@@ -61,6 +63,27 @@ func main() {
 					},
 				},
 			},
+			{
+				Name:  "extract",
+				Usage: "extract files from an image and print to stdout",
+				Action: func(c *cli.Context) error {
+					cfg := &config{
+						ref:       c.Args().First(),
+						files:     c.Args().Tail(),
+						outputDir: c.String("output_dir"),
+					}
+					if err := extract(cfg); err != nil {
+						return cli.Exit(c.Command.Name+": "+err.Error(), 1)
+					}
+					return nil
+				},
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:  "output_dir",
+						Usage: "Write extracted files to this directory instead of stdout",
+					},
+				},
+			},
 		},
 	}
 
@@ -75,6 +98,10 @@ type config struct {
 	layerIDs []string
 	// sort is true if the output should be sorted by size.
 	sort bool
+	// files is the list of file paths to extract.
+	files []string
+	// outputDir is the directory to write extracted files to.
+	outputDir string
 }
 
 // makeOptions returns the options for crane.
@@ -271,3 +298,110 @@ func files(cfg *config, layer v1.Layer) error {
 
 	return tw.Flush()
 }
+
+// extract extracts files from an image and writes them to stdout or a directory.
+func extract(cfg *config) error {
+	if len(cfg.files) == 0 {
+		return fmt.Errorf("no files specified")
+	}
+
+	image, err := getImage(cfg.ref)
+	if err != nil {
+		return err
+	}
+
+	layers, err := image.Layers()
+	if err != nil {
+		return fmt.Errorf("getting layers: %w", err)
+	}
+
+	// Build a set of wanted files for quick lookup.
+	// Normalize by stripping leading slash.
+	wanted := make(map[string]bool, len(cfg.files))
+	for _, f := range cfg.files {
+		wanted[strings.TrimPrefix(f, "/")] = true
+	}
+
+	found := make(map[string]bool, len(cfg.files))
+
+	// Search layers in reverse order (last wins) to match container runtime behavior.
+	for i := len(layers) - 1; i >= 0; i-- {
+		layer := layers[i]
+
+		uncompressed, err := layer.Uncompressed()
+		if err != nil {
+			return fmt.Errorf("getting layer: %w", err)
+		}
+
+		tarReader := tar.NewReader(uncompressed)
+		for {
+			header, err := tarReader.Next()
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				uncompressed.Close()
+				return fmt.Errorf("reading tar: %w", err)
+			}
+
+			name := strings.TrimPrefix(header.Name, "./")
+			name = strings.TrimPrefix(name, "/")
+
+			if !wanted[name] || found[name] {
+				continue
+			}
+
+			if err := extractFile(cfg, name, tarReader); err != nil {
+				uncompressed.Close()
+				return err
+			}
+			found[name] = true
+
+			// Stop early if all files found.
+			if len(found) == len(wanted) {
+				uncompressed.Close()
+				return nil
+			}
+		}
+		uncompressed.Close()
+	}
+
+	// Report any files not found.
+	var missing []string
+	for _, f := range cfg.files {
+		name := strings.TrimPrefix(f, "/")
+		if !found[name] {
+			missing = append(missing, f)
+		}
+	}
+	if len(missing) > 0 {
+		return fmt.Errorf("files not found: %s", strings.Join(missing, ", "))
+	}
+
+	return nil
+}
+
+// extractFile writes the contents of a tar entry to stdout or to a file under outputDir.
+func extractFile(cfg *config, name string, r io.Reader) error {
+	if cfg.outputDir == "" {
+		_, err := io.Copy(os.Stdout, r)
+		return err
+	}
+
+	outPath := filepath.Join(cfg.outputDir, name)
+	if err := os.MkdirAll(filepath.Dir(outPath), 0o755); err != nil {
+		return fmt.Errorf("creating directory for %s: %w", name, err)
+	}
+
+	f, err := os.Create(outPath)
+	if err != nil {
+		return fmt.Errorf("creating file %s: %w", outPath, err)
+	}
+	defer f.Close()
+
+	if _, err := io.Copy(f, r); err != nil {
+		return fmt.Errorf("writing file %s: %w", outPath, err)
+	}
+
+	return nil
+}