@@ -27,5 +27,5 @@ type Tagger interface {

 // functions without needing to import graph.

 type Recorder interface {

 	Exists(id string) bool

-	Register(img *image.Image, layerData io.Reader) error

+	Register(img image.Descriptor, layerData io.Reader) error

 }

@@ -40,6 +40,26 @@ const (

 	filterDriver

 )

+// CustomImageDescriptor is an image descriptor for use by RestoreCustomImages

+type customImageDescriptor struct {

+	img *image.Image

+}

+

+// ID returns the image ID specified in the image structure.

+func (img customImageDescriptor) ID() string {

+	return img.img.ID

+}

+

+// Parent returns the parent ID - in this case, none

+func (img customImageDescriptor) Parent() string {

+	return ""

+}

+

+// MarshalConfig renders the image structure into JSON.

+func (img customImageDescriptor) MarshalConfig() ([]byte, error) {

+	return json.Marshal(img.img)

+}

+

 // Driver represents a windows graph driver.

 type Driver struct {

 	// info stores the shim driver information

@@ -426,7 +446,7 @@ func (d *Driver) RestoreCustomImages(tagger graphdriver.Tagger, recorder graphdr

 				Size:          imageData.Size,

 			}

-			if err := recorder.Register(img, nil); err != nil {

+			if err := recorder.Register(customImageDescriptor{img}, nil); err != nil {

 				return nil, err

 			}

@@ -112,6 +112,11 @@ func (s *TagStore) ImageExport(names []string, outStream io.Writer) error {

 func (s *TagStore) exportImage(name, tempdir string) error {

 	for n := name; n != ""; {

+		img, err := s.LookupImage(n)

+		if err != nil || img == nil {

+			return fmt.Errorf("No such image %s", n)

+		}

+

 		// temporary directory

 		tmpImageDir := filepath.Join(tempdir, n)

 		if err := os.Mkdir(tmpImageDir, os.FileMode(0755)); err != nil {

@@ -128,19 +133,17 @@ func (s *TagStore) exportImage(name, tempdir string) error {

 			return err

 		}

-		// serialize json

-		json, err := os.Create(filepath.Join(tmpImageDir, "json"))

+		imageInspectRaw, err := json.Marshal(img)

 		if err != nil {

 			return err

 		}

-		img, err := s.LookupImage(n)

-		if err != nil || img == nil {

-			return fmt.Errorf("No such image %s", n)

-		}

-		imageInspectRaw, err := s.graph.RawJSON(img.ID)

+

+		// serialize json

+		json, err := os.Create(filepath.Join(tmpImageDir, "json"))

 		if err != nil {

 			return err

 		}

+

 		written, err := json.Write(imageInspectRaw)

 		if err != nil {

 			return err

@@ -31,6 +31,26 @@ import (

 	"github.com/vbatts/tar-split/tar/storage"

 )

+// v1Descriptor is a non-content-addressable image descriptor

+type v1Descriptor struct {

+	img *image.Image

+}

+

+// ID returns the image ID specified in the image structure.

+func (img v1Descriptor) ID() string {

+	return img.img.ID

+}

+

+// Parent returns the parent ID specified in the image structure.

+func (img v1Descriptor) Parent() string {

+	return img.img.Parent

+}

+

+// MarshalConfig renders the image structure into JSON.

+func (img v1Descriptor) MarshalConfig() ([]byte, error) {

+	return json.Marshal(img.img)

+}

+

 // The type is used to protect pulling or building related image

 // layers from deleteing when filtered by dangling=true

 // The key of layers is the images ID which is pulling or building

@@ -88,10 +108,12 @@ type Graph struct {

 // file names for ./graph/<ID>/

 const (

-	jsonFileName      = "json"

-	layersizeFileName = "layersize"

-	digestFileName    = "checksum"

-	tarDataFileName   = "tar-data.json.gz"

+	jsonFileName            = "json"

+	layersizeFileName       = "layersize"

+	digestFileName          = "checksum"

+	tarDataFileName         = "tar-data.json.gz"

+	v1CompatibilityFileName = "v1Compatibility"

+	parentFileName          = "parent"

 )

 var (

@@ -225,7 +247,7 @@ func (graph *Graph) Create(layerData io.Reader, containerID, containerImage, com

 		img.ContainerConfig = *containerConfig

 	}

-	if err := graph.Register(img, layerData); err != nil {

+	if err := graph.Register(v1Descriptor{img}, layerData); err != nil {

 		return nil, err

 	}

 	return img, nil

@@ -233,19 +255,26 @@ func (graph *Graph) Create(layerData io.Reader, containerID, containerImage, com

 // Register imports a pre-existing image into the graph.

 // Returns nil if the image is already registered.

-func (graph *Graph) Register(img *image.Image, layerData io.Reader) (err error) {

+func (graph *Graph) Register(im image.Descriptor, layerData io.Reader) (err error) {

+	imgID := im.ID()

-	if err := image.ValidateID(img.ID); err != nil {

+	if err := image.ValidateID(imgID); err != nil {

 		return err

 	}

 	// We need this entire operation to be atomic within the engine. Note that

 	// this doesn't mean Register is fully safe yet.

-	graph.imageMutex.Lock(img.ID)

-	defer graph.imageMutex.Unlock(img.ID)

+	graph.imageMutex.Lock(imgID)

+	defer graph.imageMutex.Unlock(imgID)

+

+	return graph.register(im, layerData)

+}

+

+func (graph *Graph) register(im image.Descriptor, layerData io.Reader) (err error) {

+	imgID := im.ID()

 	// Skip register if image is already registered

-	if graph.Exists(img.ID) {

+	if graph.Exists(imgID) {

 		return nil

 	}

@@ -255,14 +284,14 @@ func (graph *Graph) Register(img *image.Image, layerData io.Reader) (err error)

 		// If any error occurs, remove the new dir from the driver.

 		// Don't check for errors since the dir might not have been created.

 		if err != nil {

-			graph.driver.Remove(img.ID)

+			graph.driver.Remove(imgID)

 		}

 	}()

 	// Ensure that the image root does not exist on the filesystem

 	// when it is not registered in the graph.

 	// This is common when you switch from one graph driver to another

-	if err := os.RemoveAll(graph.imageRoot(img.ID)); err != nil && !os.IsNotExist(err) {

+	if err := os.RemoveAll(graph.imageRoot(imgID)); err != nil && !os.IsNotExist(err) {

 		return err

 	}

@@ -270,7 +299,7 @@ func (graph *Graph) Register(img *image.Image, layerData io.Reader) (err error)

 	// (the graph is the source of truth).

 	// Ignore errors, since we don't know if the driver correctly returns ErrNotExist.

 	// (FIXME: make that mandatory for drivers).

-	graph.driver.Remove(img.ID)

+	graph.driver.Remove(imgID)

 	tmp, err := graph.mktemp()

 	defer os.RemoveAll(tmp)

@@ -278,26 +307,32 @@ func (graph *Graph) Register(img *image.Image, layerData io.Reader) (err error)

 		return fmt.Errorf("mktemp failed: %s", err)

 	}

+	parent := im.Parent()

+

 	// Create root filesystem in the driver

-	if err := createRootFilesystemInDriver(graph, img); err != nil {

+	if err := createRootFilesystemInDriver(graph, imgID, parent, layerData); err != nil {

 		return err

 	}

 	// Apply the diff/layer

-	if err := graph.storeImage(img, layerData, tmp); err != nil {

+	config, err := im.MarshalConfig()

+	if err != nil {

+		return err

+	}

+	if err := graph.storeImage(imgID, parent, config, layerData, tmp); err != nil {

 		return err

 	}

 	// Commit

-	if err := os.Rename(tmp, graph.imageRoot(img.ID)); err != nil {

+	if err := os.Rename(tmp, graph.imageRoot(imgID)); err != nil {

 		return err

 	}

-	graph.idIndex.Add(img.ID)

+	graph.idIndex.Add(imgID)

 	return nil

 }

-func createRootFilesystemInDriver(graph *Graph, img *image.Image) error {

-	if err := graph.driver.Create(img.ID, img.Parent); err != nil {

-		return fmt.Errorf("Driver %s failed to create image rootfs %s: %s", graph.driver, img.ID, err)

+func createRootFilesystemInDriver(graph *Graph, id, parent string, layerData io.Reader) error {

+	if err := graph.driver.Create(id, parent); err != nil {

+		return fmt.Errorf("Driver %s failed to create image rootfs %s: %s", graph.driver, id, err)

 	}

 	return nil

 }

@@ -480,6 +515,21 @@ func (graph *Graph) loadImage(id string) (*image.Image, error) {

 	if err := dec.Decode(img); err != nil {

 		return nil, err

 	}

+

+	if img.ID == "" {

+		img.ID = id

+	}

+

+	if img.Parent == "" && img.ParentID != "" && img.ParentID.Validate() == nil {

+		img.Parent = img.ParentID.Hex()

+	}

+

+	// compatibilityID for parent

+	parent, err := ioutil.ReadFile(filepath.Join(root, parentFileName))

+	if err == nil && len(parent) > 0 {

+		img.Parent = string(parent)

+	}

+

 	if err := image.ValidateID(img.ID); err != nil {

 		return nil, err

 	}

@@ -513,11 +563,14 @@ func (graph *Graph) saveSize(root string, size int64) error {

 	return nil

 }

-// SetDigest sets the digest for the image layer to the provided value.

-func (graph *Graph) SetDigest(id string, dgst digest.Digest) error {

+// SetLayerDigest sets the digest for the image layer to the provided value.

+func (graph *Graph) SetLayerDigest(id string, dgst digest.Digest) error {

 	graph.imageMutex.Lock(id)

 	defer graph.imageMutex.Unlock(id)

+	return graph.setLayerDigest(id, dgst)

+}

+func (graph *Graph) setLayerDigest(id string, dgst digest.Digest) error {

 	root := graph.imageRoot(id)

 	if err := ioutil.WriteFile(filepath.Join(root, digestFileName), []byte(dgst.String()), 0600); err != nil {

 		return fmt.Errorf("Error storing digest in %s/%s: %s", root, digestFileName, err)

@@ -525,11 +578,15 @@ func (graph *Graph) SetDigest(id string, dgst digest.Digest) error {

 	return nil

 }

-// GetDigest gets the digest for the provide image layer id.

-func (graph *Graph) GetDigest(id string) (digest.Digest, error) {

+// GetLayerDigest gets the digest for the provide image layer id.

+func (graph *Graph) GetLayerDigest(id string) (digest.Digest, error) {

 	graph.imageMutex.Lock(id)

 	defer graph.imageMutex.Unlock(id)

+	return graph.getLayerDigest(id)

+}

+

+func (graph *Graph) getLayerDigest(id string) (digest.Digest, error) {

 	root := graph.imageRoot(id)

 	cs, err := ioutil.ReadFile(filepath.Join(root, digestFileName))

 	if err != nil {

@@ -541,6 +598,76 @@ func (graph *Graph) GetDigest(id string) (digest.Digest, error) {

 	return digest.ParseDigest(string(cs))

 }

+// SetV1CompatibilityConfig stores the v1Compatibility JSON data associated

+// with the image in the manifest to the disk

+func (graph *Graph) SetV1CompatibilityConfig(id string, data []byte) error {

+	graph.imageMutex.Lock(id)

+	defer graph.imageMutex.Unlock(id)

+

+	return graph.setV1CompatibilityConfig(id, data)

+}

+func (graph *Graph) setV1CompatibilityConfig(id string, data []byte) error {

+	root := graph.imageRoot(id)

+	return ioutil.WriteFile(filepath.Join(root, v1CompatibilityFileName), data, 0600)

+}

+

+// GetV1CompatibilityConfig reads the v1Compatibility JSON data for the image

+// from the disk

+func (graph *Graph) GetV1CompatibilityConfig(id string) ([]byte, error) {

+	graph.imageMutex.Lock(id)

+	defer graph.imageMutex.Unlock(id)

+

+	return graph.getV1CompatibilityConfig(id)

+}

+

+func (graph *Graph) getV1CompatibilityConfig(id string) ([]byte, error) {

+	root := graph.imageRoot(id)

+	return ioutil.ReadFile(filepath.Join(root, v1CompatibilityFileName))

+}

+

+// GenerateV1CompatibilityChain makes sure v1Compatibility JSON data exists

+// for the image. If it doesn't it generates and stores it for the image and

+// all of it's parents based on the image config JSON.

+func (graph *Graph) GenerateV1CompatibilityChain(id string) ([]byte, error) {

+	graph.imageMutex.Lock(id)

+	defer graph.imageMutex.Unlock(id)

+

+	if v1config, err := graph.getV1CompatibilityConfig(id); err == nil {

+		return v1config, nil

+	}

+

+	// generate new, store it to disk

+	img, err := graph.Get(id)

+	if err != nil {

+		return nil, err

+	}

+

+	digestPrefix := string(digest.Canonical) + ":"

+	img.ID = strings.TrimPrefix(img.ID, digestPrefix)

+

+	if img.Parent != "" {

+		parentConfig, err := graph.GenerateV1CompatibilityChain(img.Parent)

+		if err != nil {

+			return nil, err

+		}

+		var parent struct{ ID string }

+		err = json.Unmarshal(parentConfig, &parent)

+		if err != nil {

+			return nil, err

+		}

+		img.Parent = parent.ID

+	}

+

+	json, err := json.Marshal(img)

+	if err != nil {

+		return nil, err

+	}

+	if err := graph.setV1CompatibilityConfig(id, json); err != nil {

+		return nil, err

+	}

+	return json, nil

+}

+

 // RawJSON returns the JSON representation for an image as a byte array.

 func (graph *Graph) RawJSON(id string) ([]byte, error) {

 	root := graph.imageRoot(id)

@@ -560,29 +687,38 @@ func jsonPath(root string) string {

 // storeImage stores file system layer data for the given image to the

 // graph's storage driver. Image metadata is stored in a file

 // at the specified root directory.

-func (graph *Graph) storeImage(img *image.Image, layerData io.Reader, root string) (err error) {

+func (graph *Graph) storeImage(id, parent string, config []byte, layerData io.Reader, root string) (err error) {

+	var size int64

 	// Store the layer. If layerData is not nil, unpack it into the new layer

 	if layerData != nil {

-		if err := graph.disassembleAndApplyTarLayer(img, layerData, root); err != nil {

+		if size, err = graph.disassembleAndApplyTarLayer(id, parent, layerData, root); err != nil {

 			return err

 		}

 	}

-	if err := graph.saveSize(root, img.Size); err != nil {

+	if err := graph.saveSize(root, size); err != nil {

 		return err

 	}

-	f, err := os.OpenFile(jsonPath(root), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(0600))

-	if err != nil {

+	if err := ioutil.WriteFile(jsonPath(root), config, 0600); err != nil {

 		return err

 	}

-	defer f.Close()

+	// If image is pointing to a parent via CompatibilityID write the reference to disk

+	img, err := image.NewImgJSON(config)

+	if err != nil {

+		return err

+	}

-	return json.NewEncoder(f).Encode(img)

+	if img.ParentID.Validate() == nil && parent != img.ParentID.Hex() {

+		if err := ioutil.WriteFile(filepath.Join(root, parentFileName), []byte(parent), 0600); err != nil {

+			return err

+		}

+	}

+	return nil

 }

-func (graph *Graph) disassembleAndApplyTarLayer(img *image.Image, layerData io.Reader, root string) (err error) {

+func (graph *Graph) disassembleAndApplyTarLayer(id, parent string, layerData io.Reader, root string) (size int64, err error) {

 	var ar io.Reader

 	if graph.tarSplitDisabled {

@@ -591,7 +727,7 @@ func (graph *Graph) disassembleAndApplyTarLayer(img *image.Image, layerData io.R

 		// this is saving the tar-split metadata

 		mf, err := os.OpenFile(filepath.Join(root, tarDataFileName), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(0600))

 		if err != nil {

-			return err

+			return 0, err

 		}

 		mfz := gzip.NewWriter(mf)

@@ -601,24 +737,24 @@ func (graph *Graph) disassembleAndApplyTarLayer(img *image.Image, layerData io.R

 		inflatedLayerData, err := archive.DecompressStream(layerData)

 		if err != nil {

-			return err

+			return 0, err

 		}

 		// we're passing nil here for the file putter, because the ApplyDiff will

 		// handle the extraction of the archive

 		rdr, err := asm.NewInputTarStream(inflatedLayerData, metaPacker, nil)

 		if err != nil {

-			return err

+			return 0, err

 		}

 		ar = archive.Reader(rdr)

 	}

-	if img.Size, err = graph.driver.ApplyDiff(img.ID, img.Parent, ar); err != nil {

-		return err

+	if size, err = graph.driver.ApplyDiff(id, parent, ar); err != nil {

+		return 0, err

 	}

-	return nil

+	return

 }

 func (graph *Graph) assembleTarLayer(img *image.Image) (io.ReadCloser, error) {

@@ -73,7 +73,7 @@ func TestInterruptedRegister(t *testing.T) {

 		Created: time.Now(),

 	}

 	w.CloseWithError(errors.New("But I'm not a tarball!")) // (Nobody's perfect, darling)

-	graph.Register(image, badArchive)

+	graph.Register(v1Descriptor{image}, badArchive)

 	if _, err := graph.Get(image.ID); err == nil {

 		t.Fatal("Image should not exist after Register is interrupted")

 	}

@@ -82,7 +82,7 @@ func TestInterruptedRegister(t *testing.T) {

 	if err != nil {

 		t.Fatal(err)

 	}

-	if err := graph.Register(image, goodArchive); err != nil {

+	if err := graph.Register(v1Descriptor{image}, goodArchive); err != nil {

 		t.Fatal(err)

 	}

 }

@@ -130,7 +130,7 @@ func TestRegister(t *testing.T) {

 		Comment: "testing",

 		Created: time.Now(),

 	}

-	err = graph.Register(image, archive)

+	err = graph.Register(v1Descriptor{image}, archive)

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -212,7 +212,7 @@ func TestDelete(t *testing.T) {

 		t.Fatal(err)

 	}

 	// Test delete twice (pull -> rm -> pull -> rm)

-	if err := graph.Register(img1, archive); err != nil {

+	if err := graph.Register(v1Descriptor{img1}, archive); err != nil {

 		t.Fatal(err)

 	}

 	if err := graph.Delete(img1.ID); err != nil {

@@ -246,9 +246,19 @@ func TestByParent(t *testing.T) {

 		Created: time.Now(),

 		Parent:  parentImage.ID,

 	}

-	_ = graph.Register(parentImage, archive1)

-	_ = graph.Register(childImage1, archive2)

-	_ = graph.Register(childImage2, archive3)

+

+	err := graph.Register(v1Descriptor{parentImage}, archive1)

+	if err != nil {

+		t.Fatal(err)

+	}

+	err = graph.Register(v1Descriptor{childImage1}, archive2)

+	if err != nil {

+		t.Fatal(err)

+	}

+	err = graph.Register(v1Descriptor{childImage2}, archive3)

+	if err != nil {

+		t.Fatal(err)

+	}

 	byParent := graph.ByParent()

 	numChildren := len(byParent[parentImage.ID])

@@ -122,7 +122,7 @@ func (s *TagStore) recursiveLoad(address, tmpImageDir string) error {

 				}

 			}

 		}

-		if err := s.graph.Register(img, layer); err != nil {

+		if err := s.graph.Register(v1Descriptor{img}, layer); err != nil {

 			return err

 		}

 	}

@@ -127,7 +127,7 @@ func (p *v1Puller) pullRepository(askedTag string) error {

 	defer func() {

 		p.graph.Release(sessionID, imgIDs...)

 	}()

-	for _, image := range repoData.ImgList {

+	for _, imgData := range repoData.ImgList {

 		downloadImage := func(img *registry.ImgData) {

 			if askedTag != "" && img.Tag != askedTag {

 				errors <- nil

@@ -140,6 +140,11 @@ func (p *v1Puller) pullRepository(askedTag string) error {

 				return

 			}

+			if err := image.ValidateID(img.ID); err != nil {

+				errors <- err

+				return

+			}

+

 			// ensure no two downloads of the same image happen at the same time

 			poolKey := "img:" + img.ID

 			broadcaster, found := p.poolAdd("pull", poolKey)

@@ -197,7 +202,7 @@ func (p *v1Puller) pullRepository(askedTag string) error {

 			errors <- nil

 		}

-		go downloadImage(image)

+		go downloadImage(imgData)

 	}

 	var lastError error

@@ -317,7 +322,7 @@ func (p *v1Puller) pullImage(out io.Writer, imgID, endpoint string) (layersDownl

 				layersDownloaded = true

 				defer layer.Close()

-				err = p.graph.Register(img,

+				err = p.graph.Register(v1Descriptor{img},

 					progressreader.New(progressreader.Config{

 						In:        layer,

 						Out:       broadcaster,

@@ -1,10 +1,12 @@

 package graph

 import (

+	"errors"

 	"fmt"

 	"io"

 	"io/ioutil"

 	"os"

+	"sync"

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/distribution"

@@ -73,7 +75,8 @@ func (p *v2Puller) pullV2Repository(tag string) (err error) {

 	}

-	broadcaster, found := p.poolAdd("pull", taggedName)

+	poolKey := "v2:" + taggedName

+	broadcaster, found := p.poolAdd("pull", poolKey)

 	broadcaster.Add(p.config.OutStream)

 	if found {

 		// Another pull of the same repository is already taking place; just wait for it to finish

@@ -83,7 +86,7 @@ func (p *v2Puller) pullV2Repository(tag string) (err error) {

 	// This must use a closure so it captures the value of err when the

 	// function returns, not when the 'defer' is evaluated.

 	defer func() {

-		p.poolRemoveWithError("pull", taggedName, err)

+		p.poolRemoveWithError("pull", poolKey, err)

 	}()

 	var layersDownloaded bool

@@ -104,7 +107,8 @@ func (p *v2Puller) pullV2Repository(tag string) (err error) {

 // downloadInfo is used to pass information from download to extractor

 type downloadInfo struct {

-	img         *image.Image

+	img         contentAddressableDescriptor

+	imgIndex    int

 	tmpFile     *os.File

 	digest      digest.Digest

 	layer       distribution.ReadSeekCloser

@@ -114,12 +118,66 @@ type downloadInfo struct {

 	broadcaster *broadcaster.Buffered

 }

+// contentAddressableDescriptor is used to pass image data from a manifest to the

+// graph.

+type contentAddressableDescriptor struct {

+	id              string

+	parent          string

+	strongID        digest.Digest

+	compatibilityID string

+	config          []byte

+	v1Compatibility []byte

+}

+

+func newContentAddressableImage(v1Compatibility []byte, blobSum digest.Digest, parent digest.Digest) (contentAddressableDescriptor, error) {

+	img := contentAddressableDescriptor{

+		v1Compatibility: v1Compatibility,

+	}

+

+	var err error

+	img.config, err = image.MakeImageConfig(v1Compatibility, blobSum, parent)

+	if err != nil {

+		return img, err

+	}

+	img.strongID, err = image.StrongID(img.config)

+	if err != nil {

+		return img, err

+	}

+

+	unmarshalledConfig, err := image.NewImgJSON(v1Compatibility)

+	if err != nil {

+		return img, err

+	}

+

+	img.compatibilityID = unmarshalledConfig.ID

+	img.id = img.strongID.Hex()

+

+	return img, nil

+}

+

+// ID returns the actual ID to be used for the downloaded image. This may be

+// a computed ID.

+func (img contentAddressableDescriptor) ID() string {

+	return img.id

+}

+

+// Parent returns the parent ID to be used for the image. This may be a

+// computed ID.

+func (img contentAddressableDescriptor) Parent() string {

+	return img.parent

+}

+

+// MarshalConfig renders the image structure into JSON.

+func (img contentAddressableDescriptor) MarshalConfig() ([]byte, error) {

+	return img.config, nil

+}

+

 type errVerification struct{}

 func (errVerification) Error() string { return "verification failed" }

 func (p *v2Puller) download(di *downloadInfo) {

-	logrus.Debugf("pulling blob %q to %s", di.digest, di.img.ID)

+	logrus.Debugf("pulling blob %q to %s", di.digest, di.img.id)

 	blobs := p.repo.Blobs(context.Background())

@@ -151,12 +209,12 @@ func (p *v2Puller) download(di *downloadInfo) {

 		Formatter: p.sf,

 		Size:      di.size,

 		NewLines:  false,

-		ID:        stringid.TruncateID(di.img.ID),

+		ID:        stringid.TruncateID(di.img.id),

 		Action:    "Downloading",

 	})

 	io.Copy(di.tmpFile, reader)

-	di.broadcaster.Write(p.sf.FormatProgress(stringid.TruncateID(di.img.ID), "Verifying Checksum", nil))

+	di.broadcaster.Write(p.sf.FormatProgress(stringid.TruncateID(di.img.id), "Verifying Checksum", nil))

 	if !verifier.Verified() {

 		err = fmt.Errorf("filesystem layer verification failed for digest %s", di.digest)

@@ -165,9 +223,9 @@ func (p *v2Puller) download(di *downloadInfo) {

 		return

 	}

-	di.broadcaster.Write(p.sf.FormatProgress(stringid.TruncateID(di.img.ID), "Download complete", nil))

+	di.broadcaster.Write(p.sf.FormatProgress(stringid.TruncateID(di.img.id), "Download complete", nil))

-	logrus.Debugf("Downloaded %s to tempfile %s", di.img.ID, di.tmpFile.Name())

+	logrus.Debugf("Downloaded %s to tempfile %s", di.img.id, di.tmpFile.Name())

 	di.layer = layerDownload

 	di.err <- nil

@@ -193,6 +251,17 @@ func (p *v2Puller) pullV2Tag(out io.Writer, tag, taggedName string) (verified bo

 		logrus.Printf("Image manifest for %s has been verified", taggedName)

 	}

+	// remove duplicate layers and check parent chain validity

+	err = fixManifestLayers(&manifest.Manifest)

+	if err != nil {

+		return false, err

+	}

+

+	imgs, err := p.getImageInfos(manifest.Manifest)

+	if err != nil {

+		return false, err

+	}

+

 	out.Write(p.sf.FormatStatus(tag, "Pulling from %s", p.repo.Name()))

 	var downloads []*downloadInfo

@@ -213,26 +282,32 @@ func (p *v2Puller) pullV2Tag(out io.Writer, tag, taggedName string) (verified bo

 	}()

 	for i := len(manifest.FSLayers) - 1; i >= 0; i-- {

-		img, err := image.NewImgJSON([]byte(manifest.History[i].V1Compatibility))

-		if err != nil {

-			logrus.Debugf("error getting image v1 json: %v", err)

-			return false, err

-		}

-		p.graph.Retain(p.sessionID, img.ID)

-		layerIDs = append(layerIDs, img.ID)

+		img := imgs[i]

+

+		p.graph.Retain(p.sessionID, img.id)

+		layerIDs = append(layerIDs, img.id)

+

+		p.graph.imageMutex.Lock(img.id)

 		// Check if exists

-		if p.graph.Exists(img.ID) {

-			logrus.Debugf("Image already exists: %s", img.ID)

-			out.Write(p.sf.FormatProgress(stringid.TruncateID(img.ID), "Already exists", nil))

+		if p.graph.Exists(img.id) {

+			if err := p.validateImageInGraph(img.id, imgs, i); err != nil {

+				p.graph.imageMutex.Unlock(img.id)

+				return false, fmt.Errorf("image validation failed: %v", err)

+			}

+			logrus.Debugf("Image already exists: %s", img.id)

+			p.graph.imageMutex.Unlock(img.id)

 			continue

 		}

-		out.Write(p.sf.FormatProgress(stringid.TruncateID(img.ID), "Pulling fs layer", nil))

+		p.graph.imageMutex.Unlock(img.id)

+

+		out.Write(p.sf.FormatProgress(stringid.TruncateID(img.id), "Pulling fs layer", nil))

 		d := &downloadInfo{

-			img:     img,

-			poolKey: "layer:" + img.ID,

-			digest:  manifest.FSLayers[i].BlobSum,

+			img:      img,

+			imgIndex: i,

+			poolKey:  "v2layer:" + img.id,

+			digest:   manifest.FSLayers[i].BlobSum,

 			// TODO: seems like this chan buffer solved hanging problem in go1.5,

 			// this can indicate some deeper problem that somehow we never take

 			// error from channel in loop below

@@ -274,26 +349,49 @@ func (p *v2Puller) pullV2Tag(out io.Writer, tag, taggedName string) (verified bo

 		}

 		d.tmpFile.Seek(0, 0)

-		reader := progressreader.New(progressreader.Config{

-			In:        d.tmpFile,

-			Out:       d.broadcaster,

-			Formatter: p.sf,

-			Size:      d.size,

-			NewLines:  false,

-			ID:        stringid.TruncateID(d.img.ID),

-			Action:    "Extracting",

-		})

-

-		err = p.graph.Register(d.img, reader)

-		if err != nil {

-			return false, err

-		}

+		err := func() error {

+			reader := progressreader.New(progressreader.Config{

+				In:        d.tmpFile,

+				Out:       d.broadcaster,

+				Formatter: p.sf,

+				Size:      d.size,

+				NewLines:  false,

+				ID:        stringid.TruncateID(d.img.id),

+				Action:    "Extracting",

+			})

+

+			p.graph.imageMutex.Lock(d.img.id)

+			defer p.graph.imageMutex.Unlock(d.img.id)

+

+			// Must recheck the data on disk if any exists.

+			// This protects against races where something

+			// else is written to the graph under this ID

+			// after attemptIDReuse.

+			if p.graph.Exists(d.img.id) {

+				if err := p.validateImageInGraph(d.img.id, imgs, d.imgIndex); err != nil {

+					return fmt.Errorf("image validation failed: %v", err)

+				}

+			}

+

+			if err := p.graph.register(d.img, reader); err != nil {

+				return err

+			}

+

+			if err := p.graph.setLayerDigest(d.img.id, d.digest); err != nil {

+				return err

+			}

+

+			if err := p.graph.setV1CompatibilityConfig(d.img.id, d.img.v1Compatibility); err != nil {

+				return err

+			}

-		if err := p.graph.SetDigest(d.img.ID, d.digest); err != nil {

+			return nil

+		}()

+		if err != nil {

 			return false, err

 		}

-		d.broadcaster.Write(p.sf.FormatProgress(stringid.TruncateID(d.img.ID), "Pull complete", nil))

+		d.broadcaster.Write(p.sf.FormatProgress(stringid.TruncateID(d.img.id), "Pull complete", nil))

 		d.broadcaster.Close()

 		tagUpdated = true

 	}

@@ -424,3 +522,217 @@ func (p *v2Puller) validateManifest(m *manifest.SignedManifest, tag string) (ver

 	}

 	return verified, nil

 }

+

+// fixManifestLayers removes repeated layers from the manifest and checks the

+// correctness of the parent chain.

+func fixManifestLayers(m *manifest.Manifest) error {

+	images := make([]*image.Image, len(m.FSLayers))

+	for i := range m.FSLayers {

+		img, err := image.NewImgJSON([]byte(m.History[i].V1Compatibility))

+		if err != nil {

+			return err

+		}

+		images[i] = img

+		if err := image.ValidateID(img.ID); err != nil {

+			return err

+		}

+	}

+

+	if images[len(images)-1].Parent != "" {

+		return errors.New("Invalid parent ID in the base layer of the image.")

+	}

+

+	// check general duplicates to error instead of a deadlock

+	idmap := make(map[string]struct{})

+

+	var lastID string

+	for _, img := range images {

+		// skip IDs that appear after each other, we handle those later

+		if _, exists := idmap[img.ID]; img.ID != lastID && exists {

+			return fmt.Errorf("ID %+v appears multiple times in manifest", img.ID)

+		}

+		lastID = img.ID

+		idmap[lastID] = struct{}{}

+	}

+

+	// backwards loop so that we keep the remaining indexes after removing items

+	for i := len(images) - 2; i >= 0; i-- {

+		if images[i].ID == images[i+1].ID { // repeated ID. remove and continue

+			m.FSLayers = append(m.FSLayers[:i], m.FSLayers[i+1:]...)

+			m.History = append(m.History[:i], m.History[i+1:]...)

+		} else if images[i].Parent != images[i+1].ID {

+			return fmt.Errorf("Invalid parent ID. Expected %v, got %v.", images[i+1].ID, images[i].Parent)

+		}

+	}

+

+	return nil

+}

+

+// getImageInfos returns an imageinfo struct for every image in the manifest.