feat(image): support --change on import

cmd/nerdctl/image/image_import.go

@@ -45,6 +45,7 @@ func ImportCommand() *cobra.Command {
 
 	cmd.Flags().StringP("message", "m", "", "Set commit message for imported image")
 	cmd.Flags().String("platform", "", "Set platform for imported image (e.g., linux/amd64)")
+	cmd.Flags().StringArrayP("change", "c", nil, "Apply Dockerfile instruction to the created image")
 	return cmd
 }
 
@@ -61,6 +62,10 @@ func importOptions(cmd *cobra.Command, args []string) (types.ImageImportOptions,
 	if err != nil {
 		return types.ImageImportOptions{}, err
 	}
+	changes, err := cmd.Flags().GetStringArray("change")
+	if err != nil {
+		return types.ImageImportOptions{}, err
+	}
 	var reference string
 	if len(args) > 1 {
 		reference = args[1]
@@ -97,6 +102,7 @@ func importOptions(cmd *cobra.Command, args []string) (types.ImageImportOptions,
 		Reference: reference,
 		Message:   message,
 		Platform:  platform,
+		Changes:   changes,
 	}, nil
 }
 

cmd/nerdctl/image/image_import_linux_test.go

@@ -23,6 +23,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 
@@ -45,6 +46,20 @@ func minimalRootfsTar(t *testing.T) *bytes.Buffer {
 	return buf
 }
 
+// minimalImageArchiveTar returns a tar that looks like a standard image archive
+// (it carries a manifest.json), used to exercise the --change rejection path.
+func minimalImageArchiveTar(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	buf := new(bytes.Buffer)
+	tw := tar.NewWriter(buf)
+	content := []byte("[]")
+	assert.NilError(t, tw.WriteHeader(&tar.Header{Name: "manifest.json", Size: int64(len(content)), Mode: 0644}))
+	_, err := tw.Write(content)
+	assert.NilError(t, err)
+	assert.NilError(t, tw.Close())
+	return buf
+}
+
 func TestImageImportErrors(t *testing.T) {
 	nerdtest.Setup()
 
@@ -143,6 +158,55 @@ func TestImageImport(t *testing.T) {
 				}
 			},
 		},
+		{
+			Description: "image import with change",
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rmi", "-f", data.Identifier())
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("import",
+					"--change", `CMD ["echo","hi"]`,
+					"--change", "ENV FOO=bar",
+					"--change", "WORKDIR /srv",
+					"--change", "EXPOSE 8080",
+					"-", data.Identifier())
+				cmd.Feed(bytes.NewReader(minimalRootfsTar(t).Bytes()))
+				return cmd
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				identifier := data.Identifier() + ":latest"
+				return &test.Expected{
+					Output: expect.All(
+						func(stdout string, t tig.T) {
+							img := nerdtest.InspectImage(helpers, identifier)
+							assert.Assert(t, img.Config != nil)
+							assert.DeepEqual(t, img.Config.Cmd, []string{"echo", "hi"})
+							assert.Assert(t, slices.Contains(img.Config.Env, "FOO=bar"))
+							assert.Equal(t, img.Config.WorkingDir, "/srv")
+							_, ok := img.Config.ExposedPorts["8080/tcp"]
+							assert.Assert(t, ok)
+						},
+					),
+				}
+			},
+		},
+		{
+			Description: "image import --change rejected for a standard image archive",
+			// nerdctl-only: Docker's import treats any tarball as a rootfs and has
+			// no standard-image-archive rejection.
+			Require: require.Not(nerdtest.Docker),
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("import", "--change", `CMD ["echo"]`, "-", data.Identifier())
+				cmd.Feed(bytes.NewReader(minimalImageArchiveTar(t).Bytes()))
+				return cmd
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: expect.ExitCodeGenericFail,
+					Errors:   []error{errors.New("filesystem archive")},
+				}
+			},
+		},
 		{
 			Description: "image import with platform",
 			Cleanup: func(data test.Data, helpers test.Helpers) {

docs/command-reference.md

@@ -944,10 +944,9 @@ Usage: `nerdctl import [OPTIONS] file|URL|- [REPOSITORY[:TAG]]`
 Flags:
 
 - :whale: `-m, --message`: Set commit message for imported image
+- :whale: `-c, --change`: Apply a Dockerfile instruction to the created image, e.g. `--change 'CMD ["echo"]'`. Repeatable. Supported instructions: `CMD`, `ENTRYPOINT`, `ENV`, `EXPOSE`, `LABEL`, `USER`, `VOLUME`, `WORKDIR`, `STOPSIGNAL`.
 - :nerd_face: `--platform=(linux/amd64|linux/arm64|...)`: Set platform for the imported image
 
-Unimplemented `docker import` flags: `--change`
-
 ### :whale: nerdctl tag
 
 Create a tag TARGET\_IMAGE that refers to SOURCE\_IMAGE.

pkg/api/types/import_types.go

@@ -28,4 +28,7 @@ type ImageImportOptions struct {
 	Reference string
 	Message   string
 	Platform  string
+	// Changes holds Dockerfile-style instructions (--change) applied to the
+	// imported image's config, e.g. `CMD ["echo"]` or `ENV FOO=bar`.
+	Changes []string
 }

pkg/cmd/image/import.go

@@ -49,6 +49,12 @@ import (
 )
 
 func Import(ctx context.Context, client *containerd.Client, options types.ImageImportOptions) (string, error) {
+	// Validate --change before any layer work, so a syntactic error fails fast
+	// instead of after the (possibly large) layer is compressed and committed.
+	if err := applyChanges(&ocispec.ImageConfig{}, options.Changes); err != nil {
+		return "", err
+	}
+
 	prefix := options.Reference
 	if prefix == "" {
 		prefix = fmt.Sprintf("import-%s", time.Now().Format("2006-01-02"))
@@ -111,6 +117,12 @@ func ensureOCIArchive(ctx context.Context, client *containerd.Client, r io.ReadC
 
 	combined := io.NopCloser(io.MultiReader(buf, r))
 	if isStandardArchive {
+		// A standard image archive already carries its own config; --change only
+		// applies to a filesystem (rootfs) import, which builds a fresh config.
+		if len(options.Changes) > 0 {
+			r.Close()
+			return nil, func() {}, fmt.Errorf("--change is only supported when importing a filesystem archive, not a standard image archive")
+		}
 		return combined, func() { r.Close() }, nil
 	}
 
@@ -268,6 +280,11 @@ func buildImageConfig(diffID digest.Digest, options types.ImageImportOptions) ([
 		}},
 	}
 
+	// Apply any --change instructions to the fresh config.
+	if err := applyChanges(&imgConfig.Config, options.Changes); err != nil {
+		return nil, "", err
+	}
+
 	configJSON, err := json.Marshal(imgConfig)
 	if err != nil {
 		return nil, "", err