[kvinwang]

Problem

Image names are checked by three hand-written rules, and none rejects .:

• DeleteImage only refuses empty names, .. and /. DeleteImage { id: "." } passes, image.path.join(".") exists, and remove_dir_all deletes every image on the node before failing on the root itself. The in-use check compares against ".", so images of running VMs go too:

  {"error": "failed to delete image directory: /tmp/vmmimg.iRNM/images/.: failed to remove directory `/tmp/vmmimg.iRNM/images/.`: Invalid argument (os error 22)"}
  

  (ls images is empty afterwards.)

• load_vm / load_or_update_vm use is_alphanumeric (accepts any Unicode letter) and also accept ..

• UpdateVm / ResizeVm set manifest.image unchecked and write the manifest before load_vm validates it. A missing or invalid image leaves a manifest that fails to load on every VMM start, so the VM drops out of the inventory.

Fix

• ImageConfig::image_dir(name) is the single check for the VMM RPC paths: non-empty, at most 64 chars, ASCII [A-Za-z0-9_.-], no leading .. Used by load_vm, load_or_update_vm and DeleteImage. make_sys_config only runs after load_vm, and the one-shot CLI keeps accepting a path from its local config file, so both are left as they are.
• apply_resource_updates resolves and loads the requested image before it touches the manifest, so a bad image fails the RPC and changes nothing.

Names with non-ASCII letters or a leading . are now refused; image names shipped by dstack are all ASCII.

Verification

• Ran dstack-vmm (unix socket, temp image dir with img-a, img-b) and called DeleteImage {"id":"."}:
  • origin/next: the error above, image dir emptied.
  • this branch: {"error": "invalid image name: \".\""}, both images remain.
• cargo test -p dstack-vmm --all-features: 217 passed, including image_dir_stays_a_direct_child_of_the_image_root.
• cargo clippy -p dstack-vmm --all-features -- -D warnings -D clippy::unwrap_used -D clippy::expect_used clean.
• The UpdateVm / ResizeVm ordering fix is not exercised at runtime (it needs a stopped VM).