- Closes#457.
- A container can now declare additional DNS names for
a network attachment with a repeatable `alias` property
on `--network`, including subtree aliases that match
every name below a domain.
- With the default domain `test`, this container answers
to `gateway.test` by its name, to `api.test` by the exact
alias, and to `web.gateway.test`, `a.b.gateway.test`
and every other name below `gateway.test` by the
subtree alias. The motivating case is a gateway container
in front of a local Kubernetes cluster that answers for
`*.gateway.test`, with an ingress controller routing on
the `Host` header.
- An alias is an exact name, or a name with a leading
dot that matches every name below it. A name without
a dot gets the default domain, as container names do.
A subtree alias must be below a name the same
attachment owns, and exact names are unique across
all containers, so a container cannot claim another
container's namespace. The rules for one attachment
are checked when a container is created, again when
a stored container starts, and again by the network
helper when it registers the aliases. See
`docs/architecture/dns.md` for the design, the
invariants and the security considerations.
- The k8s load-image CLI command will issue a
ctr image tag command in the guest to make
the fully qualified name of an image available
when the image has a short name (such as
when building and testing locally). The ordering
of fully qualified name and source image name
was backwards, causing the command to
silently fail.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- `launchctl list` does not work as expected in the sandbox.
- Probe with `launchctl print <domain>/<label>` instead,
which launchd does allow a sandboxed process, and key
off exit codes: 0 means registered, 113 (ENOSERVICE)
means not registered, and anything else is an error rather
than being mistranslated into a negative.
- The probe is advisory in `system status`, so an indeterminate
answer falls through to the XPC health check, whose success
is authoritative.
Signed-off-by: Renlord Yang <renlord@apple.com>
- Fixes#2149.
- `container image list` currently fails completely when
one image record references an unreadable or missing
content blob. Healthy images are not rendered, and
structured output such as JSON and YAML is unavailable.
- This PR resolves each image independently:
- healthy images remain visible;
- unreadable images are reported as warnings;
- warnings are written to stderr;
- structured stdout remains valid;
- the command exits non-zero after rendering a
partial listing, so automation can detect it.
- Closes#2321.
- Removes image script and ORAS resource extension
point handling for container machine user setup.
- Replaces image script resource with hardcoded script.
- Adds more flexible user setup options to
`container machine`.
- Updates container machine documentation to clearly
identify convenience-isolation tradeoffs.
- Skips the rootfs when the container was created with
`--read-only`, and skips block mounts whose options
include `ro`.
- Keeps trimming the remaining targets after a failure,
then throws one error listing each failed path with its
underlying error.
- Fixes#815.
- Relocates the API server info received from the health check
XPC to a `server` property.
- Fixes the server `version` property in the health check result
to contain only the version; previously it included text that was
already in sibling properties.
- Adds properties for host, client, paths, and resources.
- Adds these properties to the output of `container system status`,
in a table or as JSON (`--format json`). Daemon-sourced fields
populate only when the API server responds, so the command
degrades gracefully to a "server not running" view when the
daemon is stopped. System configuration values are not repeated
here — `container system property ls` already reports them.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
J Logan