Fix for task a7f4ca61: Use docker pull instead of containerd export to avoid fuse-overlayfs whiteout corruption

setup-fix.patch

--- setup.sh.orig	2026-01-19
+++ setup.sh	2026-01-19
@@ -433,12 +433,41 @@ tag_existing_image_as_v1() {
 }
 
 build_image() {
     echo "=== Building Docker image with bug ==="
     cd /tmp/repo
 
-    ctr --address /run/k3s/containerd/containerd.sock -n k8s.io image export pythonslim.tar docker.io/library/python:3.11-slim
-    docker image import pythonslim.tar python:3.11-slim
+    # Step 1: Export from containerd (layers have fuse-overlayfs whiteout corruption)
+    echo "Exporting python:3.11-slim from containerd..."
+    ctr --address /run/k3s/containerd/containerd.sock -n k8s.io \
+        image export pythonslim-oci.tar docker.io/library/python:3.11-slim
+
+    # Step 2: Load into Docker (corrupted, but loadable)
+    echo "Loading into Docker..."
+    docker load < pythonslim-oci.tar
+
+    # Step 3: Flatten to fix whiteout corruption
+    echo "Flattening image to remove whiteout corruption..."
+    docker create --name flatten-python docker.io/library/python:3.11-slim /bin/true
+    docker export flatten-python > python-flat.tar
+    docker rm flatten-python
+
+    # Step 4: Remove corrupted image and import flattened version with metadata
+    docker rmi docker.io/library/python:3.11-slim || true
+    docker import \
+        --change 'CMD ["python3"]' \
+        --change 'ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin' \
+        --change 'ENV LANG=C.UTF-8' \
+        --change 'ENV GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D' \
+        --change 'ENV PYTHON_VERSION=3.11.11' \
+        --change 'ENV PYTHON_PIP_VERSION=24.0' \
+        --change 'ENV PYTHON_SETUPTOOLS_VERSION=65.5.1' \
+        --change 'WORKDIR /' \
+        python-flat.tar python:3.11-slim
+
+    # Cleanup
+    rm -f pythonslim-oci.tar python-flat.tar
 
+    # Now build with the flattened image
     docker build -f bleat-service/Dockerfile -t bleat-service:v2 .
 }