From 7da25e142ebdc1871cb08e7f97b9751503eadc2a Mon Sep 17 00:00:00 2001
From: Danny Canter <danny_canter@apple.com>
Date: Mon, 2 Feb 2026 13:35:02 -0800
Subject: [PATCH] Deps: Bump Containerization to 0.24.0 (#1127)

Brings in some rlimit bumps/adjustments
---
 Package.resolved                              |  6 ++--
 Package.swift                                 |  2 +-
 .../Server/SandboxService.swift               | 29 +++++++++++++------
 3 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/Package.resolved b/Package.resolved
index 7fdf8455..66761de3 100644
--- a/Package.resolved
+++ b/Package.resolved
@@ -1,5 +1,5 @@
 {
-  "originHash" : "d365630cbc06f2576b1aeeb963f7d7029cda9c57fc39d4df121349db2517d332",
+  "originHash" : "b5e7886cffebc763ebcce883e1b62740a6d38a8166d53a28fe1635148c5e4c12",
   "pins" : [
     {
       "identity" : "async-http-client",
@@ -15,8 +15,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/apple/containerization.git",
       "state" : {
-        "revision" : "3a0b79d7fb982fa6518d95e3a172dbfee5d8e634",
-        "version" : "0.23.2"
+        "revision" : "92b02fc497953d2d59d29af425d29a1d8a783f1c",
+        "version" : "0.24.0"
       }
     },
     {
diff --git a/Package.swift b/Package.swift
index 6e940016..2e590bc7 100644
--- a/Package.swift
+++ b/Package.swift
@@ -23,7 +23,7 @@ import PackageDescription
 let releaseVersion = ProcessInfo.processInfo.environment["RELEASE_VERSION"] ?? "0.0.0"
 let gitCommit = ProcessInfo.processInfo.environment["GIT_COMMIT"] ?? "unspecified"
 let builderShimVersion = "0.7.0"
-let scVersion = "0.23.2"
+let scVersion = "0.24.0"
 
 let package = Package(
     name: "container",
diff --git a/Sources/Services/ContainerSandboxService/Server/SandboxService.swift b/Sources/Services/ContainerSandboxService/Server/SandboxService.swift
index 1d15c661..8b110d4e 100644
--- a/Sources/Services/ContainerSandboxService/Server/SandboxService.swift
+++ b/Sources/Services/ContainerSandboxService/Server/SandboxService.swift
@@ -681,8 +681,11 @@ public actor SandboxService {
         }
 
         let containerInfo = try self.getContainer()
-
-        let czConfig = self.configureProcessConfig(config: processInfo.config, stdio: processInfo.io, containerConfig: containerInfo.config)
+        let czConfig = try self.configureProcessConfig(
+            config: processInfo.config,
+            stdio: processInfo.io,
+            containerConfig: containerInfo.config
+        )
 
         let process = try await container.exec(id, configuration: czConfig)
         try self.setUnderlyingProcess(id, process)
@@ -861,7 +864,7 @@ public actor SandboxService {
                 searchDomains: dns.searchDomains, options: dns.options)
         }
 
-        Self.configureInitialProcess(czConfig: &czConfig, config: config)
+        try Self.configureInitialProcess(czConfig: &czConfig, config: config)
     }
 
     private func getDefaultNameservers(attachmentConfigurations: [AttachmentConfiguration]) async throws -> [String] {
@@ -880,7 +883,7 @@ public actor SandboxService {
     private static func configureInitialProcess(
         czConfig: inout LinuxContainer.Configuration,
         config: ContainerConfiguration
-    ) {
+    ) throws {
         let process = config.initProcess
 
         czConfig.process.arguments = [process.executable] + process.arguments
@@ -894,8 +897,12 @@ public actor SandboxService {
 
         czConfig.process.terminal = process.terminal
         czConfig.process.workingDirectory = process.workingDirectory
-        czConfig.process.rlimits = process.rlimits.map {
-            .init(type: $0.limit, hard: $0.hard, soft: $0.soft)
+        try czConfig.process.rlimits = process.rlimits.map {
+            LinuxRLimit(
+                kind: try LinuxRLimit.Kind($0.limit),
+                hard: $0.hard,
+                soft: $0.soft
+            )
         }
         switch process.user {
         case .raw(let name):
@@ -918,7 +925,7 @@ public actor SandboxService {
     }
 
     private nonisolated func configureProcessConfig(config: ProcessConfiguration, stdio: [FileHandle?], containerConfig: ContainerConfiguration)
-        -> LinuxProcessConfiguration
+        throws -> LinuxProcessConfiguration
     {
         var proc = LinuxProcessConfiguration()
         proc.stdin = stdio[0]
@@ -936,8 +943,12 @@ public actor SandboxService {
 
         proc.terminal = config.terminal
         proc.workingDirectory = config.workingDirectory
-        proc.rlimits = config.rlimits.map {
-            .init(type: $0.limit, hard: $0.hard, soft: $0.soft)
+        try proc.rlimits = config.rlimits.map {
+            LinuxRLimit(
+                kind: try LinuxRLimit.Kind($0.limit),
+                hard: $0.hard,
+                soft: $0.soft
+            )
         }
         switch config.user {
         case .raw(let name):