Initial commit: OCI image mounting via containers-storage

slocker-lite validates an OCI Image Layout tar, imports its layers into
containers-storage's layer store in order, and mounts the assembled image
using fuse-overlayfs, printing the resulting merged path.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -0,0 +1,57 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project state
+
+`slocker-lite` (C++20, built with Meson) mounts an OCI Image Layout tar (`oci-layout` +
+`index.json` + `blobs/sha256/*`, as produced by `skopeo`/`podman save --format
+oci-archive`/modern `docker save`) using `containers-storage` and `fuse-overlayfs`. Given
+an image tar path, it validates the layout, imports each layer into containers-storage's
+layer store in order (chained by parent), mounts the assembled top layer, and prints the
+resulting merged path. There is no README or broader architecture doc yet — treat this
+repo as still early-stage.
+
+Source layout (all under `src/`):
+- `main.cpp` — CLI entry point, dependency checks, orchestration.
+- `oci_image.{h,cpp}` — validates/parses the OCI Image Layout tar (libarchive +
+  nlohmann_json) and extracts layer blobs.
+- `containers_storage.{h,cpp}` — wraps the `containers-storage` CLI (`import-layer`,
+  `mount`), forcing `fuse-overlayfs` as the overlay `mount_program`.
+- `process.{h,cpp}` — argv-based subprocess helper (fork/execvp/pipe, no shell).
+
+Errors are logged via `spdlog::error`; every external command is also traced at debug
+level in `run_process()` (`src/process.cpp`) — visible via `SPDLOG_LEVEL=debug`, since
+spdlog's default level is `info` — and a failed external command additionally logs a
+`spdlog::warn`, which is visible by default (no env var needed). The final "mounted
+image at: ..." success line is direct stdout program output, not a log.
+
+Because `containers-storage mount` runs rootless, the resulting mount lives in a private
+user+mount namespace; the printed path is only directly usable from within that same
+namespace (e.g. via `containers-storage unshare`), not from an arbitrary external shell.
+
+## Build & test commands
+
+Build directory is `buildDir/` (already configured).
+
+- Configure (only needed if `buildDir/` is missing or deleted): `meson setup buildDir`
+- Build: `meson compile -C buildDir` (or `ninja -C buildDir`)
+- Run the executable: `./buildDir/slocker_lite <image.tar>`
+- Run tests: `meson test -C buildDir`
+
+## Code style
+
+- Null-pointer checks: prefer `if (!ptr)` / `if (ptr)` over `if (ptr == nullptr)` / `if (ptr != nullptr)`.
+
+## Licensing
+
+- Every `.c`/`.cpp`/`.h` file under `src/` must start with the GPLv2-or-later copyright
+  header (see any existing file under `src/` for the exact text).
+- After adding a new source file under `src/`, run `./add-license.sh` from the repo
+  root to prepend the header (it reads `copyright-header` and inserts it via `sed`,
+  skipping files that already have it, so it's safe to re-run at any time).
+
+## Build configuration notes
+
+- `meson.build` sets `warning_level=3` and `cpp_std=c++20` — keep new code warning-clean under `-Wall -Wextra -Wpedantic`-equivalent settings.
+- The single Meson `test()` target runs `slocker_lite` against a fixture OCI image tar generated at build time by `tests/gen_fixture.py` (a `custom_target`) and checks its exit code (no test framework is wired in yet).