Ensure two containers cannot use the same DNS hostname. (#490)

- Closes #150, #394.
- Introduces `AttachmentConfiguration` type so that we can add key-value
options to `--network` in the future.
- Eliminates redundant `ContainersService.Item` type.
- Since we now ensure at ContainersService that hostnames will not
conflict, the network helper IP allocator now simply provides the
existing IP if for an allocation on an existing hostname, which should
handle (in an eventually consistent way) the case where a container
fails to deallocate an IP on shutdown.

Sources/ContainerClient/Core/ContainerConfiguration.swift

@@ -14,6 +14,7 @@
 // limitations under the License.
 //===----------------------------------------------------------------------===//
 
+import ContainerNetworkService
 import ContainerizationOCI
 
 public struct ContainerConfiguration: Sendable, Codable {
@@ -32,13 +33,11 @@ public struct ContainerConfiguration: Sendable, Codable {
     /// System controls for the container.
     public var sysctls: [String: String] = [:]
     /// The networks the container will be added to.
-    public var networks: [String] = []
+    public var networks: [AttachmentConfiguration] = []
     /// The DNS configuration for the container.
     public var dns: DNSConfiguration? = nil
     /// Whether to enable rosetta x86-64 translation for the container.
     public var rosetta: Bool = false
-    /// The hostname for the container.
-    public var hostname: String? = nil
     /// Initial or main process of the container.
     public var initProcess: ProcessConfiguration
     /// Platform for the container
@@ -61,7 +60,6 @@ public struct ContainerConfiguration: Sendable, Codable {
         case networks
         case dns
         case rosetta
-        case hostname
         case initProcess
         case platform
         case resources
@@ -81,10 +79,21 @@ public struct ContainerConfiguration: Sendable, Codable {
         publishedSockets = try container.decodeIfPresent([PublishSocket].self, forKey: .publishedSockets) ?? []
         labels = try container.decodeIfPresent([String: String].self, forKey: .labels) ?? [:]
         sysctls = try container.decodeIfPresent([String: String].self, forKey: .sysctls) ?? [:]
-        networks = try container.decodeIfPresent([String].self, forKey: .networks) ?? []
+
+        // NOTE: migrates [String] to [AttachmentConfiguration]; remove [String] support in a later release
+        if container.contains(.networks) {
+            do {
+                networks = try container.decode([AttachmentConfiguration].self, forKey: .networks)
+            } catch {
+                let networkIds = try container.decode([String].self, forKey: .networks)
+                networks = try Utility.getAttachmentConfigurations(containerId: id, networkIds: networkIds)
+            }
+        } else {
+            networks = []
+        }
+
         dns = try container.decodeIfPresent(DNSConfiguration.self, forKey: .dns)
         rosetta = try container.decodeIfPresent(Bool.self, forKey: .rosetta) ?? false
-        hostname = try container.decodeIfPresent(String.self, forKey: .hostname)
         initProcess = try container.decode(ProcessConfiguration.self, forKey: .initProcess)
         platform = try container.decodeIfPresent(ContainerizationOCI.Platform.self, forKey: .platform) ?? .current
         resources = try container.decodeIfPresent(Resources.self, forKey: .resources) ?? .init()

Sources/ContainerClient/Utility.swift

@@ -137,7 +137,6 @@ public struct Utility {
 
         var config = ContainerConfiguration(id: id, image: description, process: pc)
         config.platform = requestedPlatform
-        config.hostname = id
 
         config.resources = try Parser.resources(
             cpus: resource.cpus,
@@ -177,23 +176,12 @@ public struct Utility {
 
         config.virtualization = management.virtualization
 
-        if management.networks.isEmpty {
-            config.networks = [ClientNetwork.defaultNetworkName]
-        } else {
-            // networks may only be specified for macOS 26+
-            guard #available(macOS 26, *) else {
-                throw ContainerizationError(.invalidArgument, message: "non-default network configuration requires macOS 26 or newer")
+        config.networks = try getAttachmentConfigurations(containerId: config.id, networkIds: management.networks)
+        for attachmentConfiguration in config.networks {
+            let network: NetworkState = try await ClientNetwork.get(id: attachmentConfiguration.network)
+            guard case .running(_, _) = network else {
+                throw ContainerizationError(.invalidState, message: "network \(attachmentConfiguration.network) is not running")
             }
-            config.networks = management.networks
-        }
-
-        var networkStatuses: [NetworkStatus] = []
-        for networkName in config.networks {
-            let network: NetworkState = try await ClientNetwork.get(id: networkName)
-            guard case .running(_, let networkStatus) = network else {
-                throw ContainerizationError(.invalidState, message: "network \(networkName) is not running")
-            }
-            networkStatuses.append(networkStatus)
         }
 
         if management.dnsDisabled {
@@ -223,6 +211,39 @@ public struct Utility {
         return (config, kernel)
     }
 
+    static func getAttachmentConfigurations(containerId: String, networkIds: [String]) throws -> [AttachmentConfiguration] {
+        // make an FQDN for the first interface
+        let fqdn: String?
+        if !containerId.contains(".") {
+            // add default domain if it exists, and container ID is unqualified
+            if let dnsDomain = DefaultsStore.getOptional(key: .defaultDNSDomain) {
+                fqdn = "\(containerId).\(dnsDomain)."
+            } else {
+                fqdn = nil
+            }
+        } else {
+            // use container ID directly if fully qualified
+            fqdn = "\(containerId)."
+        }
+
+        guard networkIds.isEmpty else {
+            // networks may only be specified for macOS 26+
+            guard #available(macOS 26, *) else {
+                throw ContainerizationError(.invalidArgument, message: "non-default network configuration requires macOS 26 or newer")
+            }
+
+            // attach the first network using the fqdn, and the rest using just the container ID
+            return networkIds.enumerated().map { item in
+                guard item.offset == 0 else {
+                    return AttachmentConfiguration(network: item.element, options: AttachmentOptions(hostname: containerId))
+                }
+                return AttachmentConfiguration(network: item.element, options: AttachmentOptions(hostname: fqdn ?? containerId))
+            }
+        }
+        // if no networks specified, attach to the default network
+        return [AttachmentConfiguration(network: ClientNetwork.defaultNetworkName, options: AttachmentOptions(hostname: fqdn ?? containerId))]
+    }
+
     private static func getKernel(management: Flags.Management) async throws -> Kernel {
         // For the image itself we'll take the user input and try with it as we can do userspace
         // emulation for x86, but for the kernel we need it to match the hosts architecture.