lee/container
1
0
Fork 0
mirror of https://github.com/apple/container.git synced 2026-09-24 00:25:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ensure two containers cannot use the same DNS hostname. (#490)

Browse Source 
- Closes #150, #394.
- Introduces `AttachmentConfiguration` type so that we can add key-value
options to `--network` in the future.
- Eliminates redundant `ContainersService.Item` type.
- Since we now ensure at ContainersService that hostnames will not
conflict, the network helper IP allocator now simply provides the
existing IP if for an allocation on an existing hostname, which should
handle (in an eventually consistent way) the case where a container
fails to deallocate an IP on shutdown.
This commit is contained in:
J Logan
2025-08-13 18:18:19 -07:00
committed by GitHub
parent d2eb350393
commit a8dbf294f6
11 changed files with 171 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Sources/ContainerClient/Utility.swift
+38 -17
View File
@@ -137,7 +137,6 @@ public struct Utility {
var config = ContainerConfiguration(id: id, image: description, process: pc)
config.platform = requestedPlatform
config.hostname = id
config.resources = try Parser.resources(
cpus: resource.cpus,
@@ -177,23 +176,12 @@ public struct Utility {
config.virtualization = management.virtualization
if management.networks.isEmpty {
config.networks = [ClientNetwork.defaultNetworkName]
} else {
// networks may only be specified for macOS 26+
guard #available(macOS 26, *) else {
throw ContainerizationError(.invalidArgument, message: "non-default network configuration requires macOS 26 or newer")
config.networks = try getAttachmentConfigurations(containerId: config.id, networkIds: management.networks)
for attachmentConfiguration in config.networks {
let network: NetworkState = try await ClientNetwork.get(id: attachmentConfiguration.network)
guard case .running(_, _) = network else {
throw ContainerizationError(.invalidState, message: "network \(attachmentConfiguration.network) is not running")
}
config.networks = management.networks
}
var networkStatuses: [NetworkStatus] = []
for networkName in config.networks {
let network: NetworkState = try await ClientNetwork.get(id: networkName)
guard case .running(_, let networkStatus) = network else {
throw ContainerizationError(.invalidState, message: "network \(networkName) is not running")
}
networkStatuses.append(networkStatus)
}
if management.dnsDisabled {
@@ -223,6 +211,39 @@ public struct Utility {
return (config, kernel)
}
static func getAttachmentConfigurations(containerId: String, networkIds: [String]) throws -> [AttachmentConfiguration] {
// make an FQDN for the first interface
let fqdn: String?
if !containerId.contains(".") {
// add default domain if it exists, and container ID is unqualified
if let dnsDomain = DefaultsStore.getOptional(key: .defaultDNSDomain) {
fqdn = "\(containerId).\(dnsDomain)."
} else {
fqdn = nil
}
} else {
// use container ID directly if fully qualified
fqdn = "\(containerId)."
}
guard networkIds.isEmpty else {
// networks may only be specified for macOS 26+
guard #available(macOS 26, *) else {
throw ContainerizationError(.invalidArgument, message: "non-default network configuration requires macOS 26 or newer")
}
// attach the first network using the fqdn, and the rest using just the container ID
return networkIds.enumerated().map { item in
guard item.offset == 0 else {
return AttachmentConfiguration(network: item.element, options: AttachmentOptions(hostname: containerId))
}
return AttachmentConfiguration(network: item.element, options: AttachmentOptions(hostname: fqdn ?? containerId))
}
}
// if no networks specified, attach to the default network
return [AttachmentConfiguration(network: ClientNetwork.defaultNetworkName, options: AttachmentOptions(hostname: fqdn ?? containerId))]
}
private static func getKernel(management: Flags.Management) async throws -> Kernel {
// For the image itself we'll take the user input and try with it as we can do userspace
// emulation for x86, but for the kernel we need it to match the hosts architecture.