func useDirperm() bool {
	enableDirpermLock.Do(func() {
		base, err := ioutil.TempDir("", "storage-aufs-base")
		if err != nil {
			logrus.Errorf("Checking dirperm1: %v", err)
			return
		}
		defer os.RemoveAll(base)
		union, err := ioutil.TempDir("", "storage-aufs-union")
		if err != nil {
			logrus.Errorf("Checking dirperm1: %v", err)
			return
		}
		defer os.RemoveAll(union)
		opts := fmt.Sprintf("br:%s,dirperm1,xino=/dev/shm/aufs.xino", base)
		if err := mount("none", union, "aufs", 0, opts); err != nil {
			return
		}
		enableDirperm = true
		if err := Unmount(union); err != nil {
			logrus.Errorf("Checking dirperm1: failed to unmount %v", err)
		}
	})
	return enableDirperm
}
useDirperm checks dirperm1 mount option can be used with the current
version of aufs.
package aufs
import (
	"bufio"
	"fmt"
	"io"
	"io/ioutil"
	"os"
	"os/exec"
	"path"
	"path/filepath"
	"strings"
	"sync"
	"time"
	graphdriver "github.com/containers/storage/drivers"
	"github.com/containers/storage/pkg/archive"
	"github.com/containers/storage/pkg/chrootarchive"
	"github.com/containers/storage/pkg/directory"
	"github.com/containers/storage/pkg/idtools"
	"github.com/containers/storage/pkg/locker"
	mountpk "github.com/containers/storage/pkg/mount"
	"github.com/containers/storage/pkg/parsers"
	"github.com/containers/storage/pkg/system"
	"github.com/opencontainers/runc/libcontainer/userns"
	"github.com/opencontainers/selinux/go-selinux/label"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
	"github.com/vbatts/tar-split/tar/storage"
	"golang.org/x/sys/unix"
)
var (
	ErrAufsNotSupported = fmt.Errorf("AUFS was not found in /proc/filesystems")
	ErrAufsNested = fmt.Errorf("AUFS cannot be used in non-init user namespace")
	backingFs     = "<unknown>"
	enableDirpermLock sync.Once
	enableDirperm     bool
)
const defaultPerms = os.FileMode(0555)
func init() {
	graphdriver.Register("aufs", Init)
}
type Driver struct {
	sync.Mutex
	root          string
	uidMaps       []idtools.IDMap
	gidMaps       []idtools.IDMap
	ctr           *graphdriver.RefCounter
	pathCacheLock sync.Mutex
	pathCache     map[string]string
	naiveDiff     graphdriver.DiffDriver
	locker        *locker.Locker
	mountOptions  string
}
func Init(home string, options graphdriver.Options) (graphdriver.Driver, error) {
	if err := supportsAufs(); err != nil {
		return nil, errors.Wrap(graphdriver.ErrNotSupported, "kernel does not support aufs")
	}
	fsMagic, err := graphdriver.GetFSMagic(home)
	if err != nil {
		return nil, err
	}
	if fsName, ok := graphdriver.FsNames[fsMagic]; ok {
		backingFs = fsName
	}
	switch fsMagic {
	case graphdriver.FsMagicAufs, graphdriver.FsMagicBtrfs, graphdriver.FsMagicEcryptfs:
		logrus.Errorf("AUFS is not supported over %s", backingFs)
		return nil, errors.Wrapf(graphdriver.ErrIncompatibleFS, "AUFS is not supported over %q", backingFs)
	}
	var mountOptions string
	for _, option := range options.DriverOptions {
		key, val, err := parsers.ParseKeyValueOpt(option)
		if err != nil {
			return nil, err
		}
		key = strings.ToLower(key)
		switch key {
		case "aufs.mountopt":
			mountOptions = val
		default:
			return nil, fmt.Errorf("option %s not supported", option)
		}
	}
	paths := []string{
		"mnt",
		"diff",
		"layers",
	}
	a := &Driver{
		root:         home,
		uidMaps:      options.UIDMaps,
		gidMaps:      options.GIDMaps,
		pathCache:    make(map[string]string),
		ctr:          graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicAufs)),
		locker:       locker.New(),
		mountOptions: mountOptions,
	}
	rootUID, rootGID, err := idtools.GetRootUIDGID(options.UIDMaps, options.GIDMaps)
	if err != nil {
		return nil, err
	}
	if err := idtools.MkdirAllAs(home, 0700, rootUID, rootGID); err != nil {
		if os.IsExist(err) {
			return a, nil
		}
		return nil, err
	}
	if err := mountpk.MakePrivate(home); err != nil {
		return nil, err
	}
	for _, p := range paths {
		if err := idtools.MkdirAllAs(path.Join(home, p), 0700, rootUID, rootGID); err != nil {
			return nil, err
		}
	}
	logger := logrus.WithFields(logrus.Fields{
		"module": "graphdriver",
		"driver": "aufs",
	})
	for _, path := range []string{"mnt", "diff"} {
		p := filepath.Join(home, path)
		entries, err := ioutil.ReadDir(p)
		if err != nil {
			logger.WithError(err).WithField("dir", p).Error("error reading dir entries")
			continue
		}
		for _, entry := range entries {
			if !entry.IsDir() {
				continue
			}
			if strings.HasSuffix(entry.Name(), "-removing") {
				logger.WithField("dir", entry.Name()).Debug("Cleaning up stale layer dir")
				if err := system.EnsureRemoveAll(filepath.Join(p, entry.Name())); err != nil {
					logger.WithField("dir", entry.Name()).WithError(err).Error("Error removing stale layer dir")
				}
			}
		}
	}
	a.naiveDiff = graphdriver.NewNaiveDiffDriver(a, a)
	return a, nil
}
func supportsAufs() error {
	exec.Command("modprobe", "aufs").Run()
	if userns.RunningInUserNS() {
		return ErrAufsNested
	}
	f, err := os.Open("/proc/filesystems")
	if err != nil {
		return err
	}
	defer f.Close()
	s := bufio.NewScanner(f)
	for s.Scan() {
		if strings.Contains(s.Text(), "aufs") {
			return nil
		}
	}
	return ErrAufsNotSupported
}
func (a *Driver) rootPath() string {
	return a.root
}
func (*Driver) String() string {
	return "aufs"
}
func (a *Driver) Status() [][2]string {
	ids, _ := loadIds(path.Join(a.rootPath(), "layers"))
	return [][2]string{
		{"Root Dir", a.rootPath()},
		{"Backing Filesystem", backingFs},
		{"Dirs", fmt.Sprintf("%d", len(ids))},
		{"Dirperm1 Supported", fmt.Sprintf("%v", useDirperm())},
	}
}
func (a *Driver) Metadata(id string) (map[string]string, error) {
	return nil, nil
}
func (a *Driver) Exists(id string) bool {
	if _, err := os.Lstat(path.Join(a.rootPath(), "layers", id)); err != nil {
		return false
	}
	return true
}
func (a *Driver) AdditionalImageStores() []string {
	return nil
}
func (a *Driver) CreateFromTemplate(id, template string, templateIDMappings *idtools.IDMappings, parent string, parentIDMappings *idtools.IDMappings, opts *graphdriver.CreateOpts, readWrite bool) error {
	if opts == nil {
		opts = &graphdriver.CreateOpts{}
	}
	return graphdriver.NaiveCreateFromTemplate(a, id, template, templateIDMappings, parent, parentIDMappings, opts, readWrite)
}
func (a *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
	return a.Create(id, parent, opts)
}
func (a *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
	if opts != nil && len(opts.StorageOpt) != 0 {
		return fmt.Errorf("--storage-opt is not supported for aufs")
	}
	if err := a.createDirsFor(id, parent); err != nil {
		return err
	}
	f, err := os.Create(path.Join(a.rootPath(), "layers", id))
	if err != nil {
		return err
	}
	defer f.Close()
	if parent != "" {
		ids, err := getParentIDs(a.rootPath(), parent)
		if err != nil {
			return err
		}
		if _, err := fmt.Fprintln(f, parent); err != nil {
			return err
		}
		for _, i := range ids {
			if _, err := fmt.Fprintln(f, i); err != nil {
				return err
			}
		}
	}
	return nil
}
func (a *Driver) createDirsFor(id, parent string) error {
	paths := []string{
		"mnt",
		"diff",
	}
	for _, p := range paths {
		rootPair := idtools.NewIDMappingsFromMaps(a.uidMaps, a.gidMaps).RootPair()
		rootPerms := defaultPerms
		if parent != "" {
			st, err := system.Stat(path.Join(a.rootPath(), p, parent))
			if err != nil {
				return err
			}
			rootPerms = os.FileMode(st.Mode())
			rootPair.UID = int(st.UID())
			rootPair.GID = int(st.GID())
		}
		if err := idtools.MkdirAllAndChownNew(path.Join(a.rootPath(), p, id), rootPerms, rootPair); err != nil {
			return err
		}
	}
	return nil
}
func (a *Driver) Remove(id string) error {
	a.locker.Lock(id)
	defer a.locker.Unlock(id)
	a.pathCacheLock.Lock()
	mountpoint, exists := a.pathCache[id]
	a.pathCacheLock.Unlock()
	if !exists {
		mountpoint = a.getMountpoint(id)
	}
	logger := logrus.WithFields(logrus.Fields{
		"module": "graphdriver",
		"driver": "aufs",
		"layer":  id,
	})
	var retries int
	for {
		mounted, err := a.mounted(mountpoint)
		if err != nil {
			if os.IsNotExist(err) {
				break
			}
			return err
		}
		if !mounted {
			break
		}
		err = a.unmount(mountpoint)
		if err == nil {
			break
		}
		if err != unix.EBUSY {
			return errors.Wrapf(err, "aufs: unmount error: %s", mountpoint)
		}
		if retries >= 5 {
			return errors.Wrapf(err, "aufs: unmount error after retries: %s", mountpoint)
		}
		retries++
		logger.Warnf("unmount failed due to EBUSY: retry count: %d", retries)
		time.Sleep(100 * time.Millisecond)
	}
	if err := os.Remove(path.Join(a.rootPath(), "layers", id)); err != nil && !os.IsNotExist(err) {
		return errors.Wrapf(err, "error removing layers dir for %s", id)
	}
	if err := atomicRemove(a.getDiffPath(id)); err != nil {
		return errors.Wrapf(err, "could not remove diff path for id %s", id)
	}
	if err := atomicRemove(mountpoint); err != nil {
		if errors.Cause(err) == unix.EBUSY {
			logger.WithField("dir", mountpoint).WithError(err).Warn("error performing atomic remove due to EBUSY")
		}
		return errors.Wrapf(err, "could not remove mountpoint for id %s", id)
	}
	a.pathCacheLock.Lock()
	delete(a.pathCache, id)
	a.pathCacheLock.Unlock()
	return nil
}
func atomicRemove(source string) error {
	target := source + "-removing"
	err := os.Rename(source, target)
	switch {
	case err == nil, os.IsNotExist(err):
	case os.IsExist(err):
		if _, e := os.Stat(source); !os.IsNotExist(e) {
			return errors.Wrapf(err, "target rename dir '%s' exists but should not, this needs to be manually cleaned up", target)
		}
	default:
		return errors.Wrapf(err, "error preparing atomic delete")
	}
	return system.EnsureRemoveAll(target)
}
func (a *Driver) Get(id string, options graphdriver.MountOpts) (string, error) {
	a.locker.Lock(id)
	defer a.locker.Unlock(id)
	parents, err := a.getParentLayerPaths(id)
	if err != nil && !os.IsNotExist(err) {
		return "", err
	}
	a.pathCacheLock.Lock()
	m, exists := a.pathCache[id]
	a.pathCacheLock.Unlock()
	if !exists {
		m = a.getDiffPath(id)
		if len(parents) > 0 {
			m = a.getMountpoint(id)
		}
	}
	if count := a.ctr.Increment(m); count > 1 {
		return m, nil
	}
	if len(parents) > 0 {
		if err := a.mount(id, m, parents, options); err != nil {
			return "", err
		}
	}
	a.pathCacheLock.Lock()
	a.pathCache[id] = m
	a.pathCacheLock.Unlock()
	return m, nil
}
func (a *Driver) Put(id string) error {
	a.locker.Lock(id)
	defer a.locker.Unlock(id)
	a.pathCacheLock.Lock()
	m, exists := a.pathCache[id]
	if !exists {
		m = a.getMountpoint(id)
		a.pathCache[id] = m
	}
	a.pathCacheLock.Unlock()
	if count := a.ctr.Decrement(m); count > 0 {
		return nil
	}
	err := a.unmount(m)
	if err != nil {
		logrus.Debugf("Failed to unmount %s aufs: %v", id, err)
	}
	return err
}
func (a *Driver) ReadWriteDiskUsage(id string) (*directory.DiskUsage, error) {
	a.locker.Lock(id)
	defer a.locker.Unlock(id)
	a.pathCacheLock.Lock()
	m, exists := a.pathCache[id]
	if !exists {
		m = a.getMountpoint(id)
		a.pathCache[id] = m
	}
	a.pathCacheLock.Unlock()
	return directory.Usage(m)
}
func (a *Driver) isParent(id, parent string) bool {
	parents, _ := getParentIDs(a.rootPath(), id)
	if parent == "" && len(parents) > 0 {
		return false
	}
	return !(len(parents) > 0 && parent != parents[0])
}
func (a *Driver) Diff(id string, idMappings *idtools.IDMappings, parent string, parentMappings *idtools.IDMappings, mountLabel string) (io.ReadCloser, error) {
	if !a.isParent(id, parent) {
		return a.naiveDiff.Diff(id, idMappings, parent, parentMappings, mountLabel)
	}
	if idMappings == nil {
		idMappings = &idtools.IDMappings{}
	}
	return archive.TarWithOptions(path.Join(a.rootPath(), "diff", id), &archive.TarOptions{
		Compression:     archive.Uncompressed,
		ExcludePatterns: []string{archive.WhiteoutMetaPrefix + "*", "!" + archive.WhiteoutOpaqueDir},
		UIDMaps:         idMappings.UIDs(),
		GIDMaps:         idMappings.GIDs(),
	})
}
type fileGetNilCloser struct {
	storage.FileGetter
}
func (f fileGetNilCloser) Close() error {
	return nil
}
func (a *Driver) DiffGetter(id string) (graphdriver.FileGetCloser, error) {
	p := path.Join(a.rootPath(), "diff", id)
	return fileGetNilCloser{storage.NewPathFileGetter(p)}, nil
}
func (a *Driver) applyDiff(id string, idMappings *idtools.IDMappings, diff io.Reader) error {
	if idMappings == nil {
		idMappings = &idtools.IDMappings{}
	}
	return chrootarchive.UntarUncompressed(diff, path.Join(a.rootPath(), "diff", id), &archive.TarOptions{
		UIDMaps: idMappings.UIDs(),
		GIDMaps: idMappings.GIDs(),
	})
}
func (a *Driver) DiffSize(id string, idMappings *idtools.IDMappings, parent string, parentMappings *idtools.IDMappings, mountLabel string) (size int64, err error) {
	if !a.isParent(id, parent) {
		return a.naiveDiff.DiffSize(id, idMappings, parent, parentMappings, mountLabel)
	}
	return directory.Size(path.Join(a.rootPath(), "diff", id))
}
func (a *Driver) ApplyDiff(id, parent string, options graphdriver.ApplyDiffOpts) (size int64, err error) {
	if !a.isParent(id, parent) {
		return a.naiveDiff.ApplyDiff(id, parent, options)
	}
	if err = a.applyDiff(id, options.Mappings, options.Diff); err != nil {
		return
	}
	return directory.Size(path.Join(a.rootPath(), "diff", id))
}
func (a *Driver) Changes(id string, idMappings *idtools.IDMappings, parent string, parentMappings *idtools.IDMappings, mountLabel string) ([]archive.Change, error) {
	if !a.isParent(id, parent) {
		return a.naiveDiff.Changes(id, idMappings, parent, parentMappings, mountLabel)
	}
	layers, err := a.getParentLayerPaths(id)
	if err != nil {
		return nil, err
	}
	return archive.Changes(layers, path.Join(a.rootPath(), "diff", id))
}
func (a *Driver) getParentLayerPaths(id string) ([]string, error) {
	parentIds, err := getParentIDs(a.rootPath(), id)
	if err != nil {
		return nil, err
	}
	layers := make([]string, len(parentIds))
	for i, p := range parentIds {
		layers[i] = path.Join(a.rootPath(), "diff", p)
	}
	return layers, nil
}
func (a *Driver) mount(id string, target string, layers []string, options graphdriver.MountOpts) error {
	a.Lock()
	defer a.Unlock()
	if mounted, err := a.mounted(target); err != nil || mounted {
		return err
	}
	rw := a.getDiffPath(id)
	if err := a.aufsMount(layers, rw, target, options); err != nil {
		return fmt.Errorf("error creating aufs mount to %s: %v", target, err)
	}
	return nil
}
func (a *Driver) unmount(mountPath string) error {
	a.Lock()
	defer a.Unlock()
	if mounted, err := a.mounted(mountPath); err != nil || !mounted {
		return err
	}
	if err := Unmount(mountPath); err != nil {
		return err
	}
	return nil
}
func (a *Driver) mounted(mountpoint string) (bool, error) {
	return graphdriver.Mounted(graphdriver.FsMagicAufs, mountpoint)
}
func (a *Driver) Cleanup() error {
	var dirs []string
	if err := filepath.Walk(a.mntPath(), func(path string, info os.FileInfo, err error) error {
		if err != nil {
			return err
		}
		if !info.IsDir() {
			return nil
		}
		dirs = append(dirs, path)
		return nil
	}); err != nil {
		return err
	}
	for _, m := range dirs {
		if err := a.unmount(m); err != nil {
			logrus.Debugf("aufs error unmounting %s: %s", m, err)
		}
	}
	return mountpk.Unmount(a.root)
}
func (a *Driver) aufsMount(ro []string, rw, target string, options graphdriver.MountOpts) (err error) {
	defer func() {
		if err != nil {
			Unmount(target)
		}
	}()
	offset := 54
	if useDirperm() {
		offset += len(",dirperm1")
	}
	b := make([]byte, unix.Getpagesize()-len(options.MountLabel)-offset)  
	bp := copy(b, fmt.Sprintf("br:%s=rw", rw))
	index := 0
	for ; index < len(ro); index++ {
		layer := fmt.Sprintf(":%s=ro+wh", ro[index])
		if bp+len(layer) > len(b) {
			break
		}
		bp += copy(b[bp:], layer)
	}
	opts := "dio,xino=/dev/shm/aufs.xino"
	mountOptions := a.mountOptions
	if len(options.Options) > 0 {
		mountOptions = strings.Join(options.Options, ",")
	}
	if mountOptions != "" {
		opts += fmt.Sprintf(",%s", mountOptions)
	}
	if useDirperm() {
		opts += ",dirperm1"
	}
	data := label.FormatMountLabel(fmt.Sprintf("%s,%s", string(b[:bp]), opts), options.MountLabel)
	if err = mount("none", target, "aufs", 0, data); err != nil {
		return
	}
	for ; index < len(ro); index++ {
		layer := fmt.Sprintf(":%s=ro+wh", ro[index])
		data := label.FormatMountLabel(fmt.Sprintf("append%s", layer), options.MountLabel)
		if err = mount("none", target, "aufs", unix.MS_REMOUNT, data); err != nil {
			return
		}
	}
	return
}