fix #134 use the trusted top layer id from image info

[dingp]

No description provided.

[dingp]

Ooops, sorry for containing # in the branch name. That makes the pip install repo_URL@branch fail, and no way to escape # there (a pip limitation).

[dingp]

Test procedure:

Test with pre-built images

0. Install podman-hpc using this feature branch;
1. Find a a multi-layer image, inspect the image with skopeo, e.g. skopeo inspect docker://docker.io/ubuntu:16.04
2. Pull the image;
3. List the image to verify it has been migrated;
4. Remove the local image with podman-hpc rmi <img_id>;
5. Run the container with the migrated image on the same node;
6. Run the container with the migrated image on a different login node;
7. Run the container with the migrated image on a compute node.
8. Delete the squashed image (optional before moving to test the next image, but should be done at least for one image).

Test with the followinw images:

• ubuntu:16.04
• nvcr.io/nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
• NERSC custom-built tensorflow image registry.nersc.gov/library/nersc/tensorflow:ngc-24.05-v1

Test with locally-built images

Similar as steps above, but test with a locally-built image.

[dingp]

It passed all my tests listed above.

I also tested with a locally-built image where I added a file in the last (outermost) layer. The image was migrated with the patch version. I was able to see it in the squashed image on a compute node (container was running with podman-hpc v1.1.3).

[dingp]

I updated the version to 1.1.4. If the PR is ready to merge, we can tag the main branch with v1.1.4 right after the merge.

[scanon]

LGTM. The key issue was the wrong layer was being linked up. The actual squash image contents are correct because that uses the image ID. But it was being attached to the wrong layer.