- Fixes#2392.
- `ContainersService.logs(id:)` opened `stdio.log` and
`vminitd.log` eagerly, so either one missing failed the
whole request. Both are created by `RuntimeLinux` at
bootstrap, so a container that has never been started
has neither. And only `RuntimeLinux` writes
`vminitd.log`, so with another runtime plugin even
plain `container logs` failed.
- A missing log now reads as empty: it's opened as
`/dev/null`, with a debug log line. Any other failure
to open a log still throws.
Co-authored-by: Bryan Mosley <342731628+bryanmosley@users.noreply.github.com>
- Closes#457.
- A container can now declare additional DNS names for
a network attachment with a repeatable `alias` property
on `--network`, including subtree aliases that match
every name below a domain.
- With the default domain `test`, this container answers
to `gateway.test` by its name, to `api.test` by the exact
alias, and to `web.gateway.test`, `a.b.gateway.test`
and every other name below `gateway.test` by the
subtree alias. The motivating case is a gateway container
in front of a local Kubernetes cluster that answers for
`*.gateway.test`, with an ingress controller routing on
the `Host` header.
- An alias is an exact name, or a name with a leading
dot that matches every name below it. A name without
a dot gets the default domain, as container names do.
A subtree alias must be below a name the same
attachment owns, and exact names are unique across
all containers, so a container cannot claim another
container's namespace. The rules for one attachment
are checked when a container is created, again when
a stored container starts, and again by the network
helper when it registers the aliases. See
`docs/architecture/dns.md` for the design, the
invariants and the security considerations.
- Closes#2321.
- Removes image script and ORAS resource extension
point handling for container machine user setup.
- Replaces image script resource with hardcoded script.
- Adds more flexible user setup options to
`container machine`.
- Updates container machine documentation to clearly
identify convenience-isolation tradeoffs.
- Skips the rootfs when the container was created with
`--read-only`, and skips block mounts whose options
include `ro`.
- Keeps trimming the remaining targets after a failure,
then throws one error listing each failed path with its
underlying error.
- Fixes#815.
- Relocates the API server info received from the health check
XPC to a `server` property.
- Fixes the server `version` property in the health check result
to contain only the version; previously it included text that was
already in sibling properties.
- Adds properties for host, client, paths, and resources.
- Adds these properties to the output of `container system status`,
in a table or as JSON (`--format json`). Daemon-sourced fields
populate only when the API server responds, so the command
degrades gracefully to a "server not running" view when the
daemon is stopped. System configuration values are not repeated
here — `container system property ls` already reports them.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Each container runs in its own guest VM sized to
`--memory` with no swap, so the guest kernel's
stock `vm` sysctl defaults are hit far too easily:
- `vm.overcommit_memory=0` (heuristic overcommit)
rejects an oversized `mmap()` upfront whenever the
reservation exceeds the small, swap-less VM's free
RAM — even if the memory is never touched —
returning `ENOMEM`.
- `vm.max_map_count=65530` caps per-process
mapping count, which mapping-heavy applications
(e.g. Elasticsearch, many JVMs) can exceed.
- When container is not running, the runtime helper
traverses the container's root fs and writes it to the
specified tar archive or stdout.
- When the container is running, the helper performs
the same operation but wraps it in freeze/thaw
to ensure data integrity for the resulting archive.
- Closes#2001.
- Handle "container exists" error gracefully instead
of failing, when trying to start the buildkit container.
- Move build tests to parallel suites, while the builder
lifecycle tests remain serial. Parallel builds don't
use the fixture lock that deletes and restarts the
builder and runs a build block in isolation.
Closes https://github.com/apple/container/issues/1687
The default kernel archive is downloaded from a remote release URL
during first-run setup and via `container system kernel set
--recommended`. Previously, the archive contents were not verified after
download, so integrity depended on HTTPS and the release artifact
remaining unchanged.
This change adds digest verification for kernel archives. The
recommended/default kernel now has pinned digest metadata using an
algorithm-prefixed value such as `sha256:<hex>`. `container system
kernel set --tar` accepts `--digest`; remote tar URLs require it, and
local tar archives can also be verified before unpacking and
installation.
The system config also supports `kernel.digest`, and a custom
`kernel.url` must provide a digest for that archive.
- Closes#1812.
- The network plugin is the source of truth for the variant, if any,
that applies to the network. Resolving a missing variant configuration
option in the API server can create a situation where the variant the
runtime uses for interface selection is incorrect.
- Adds serial suites trait to tests to see whether it helps current CI
issues.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fixes a flaw in our interface strategy logic.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#1756.
- `RuntimeService.gracefulStopContainer(_:signal:timeout:)`
wraps the graceful-stop attempt in `do { … } catch {}`. The
empty catch silently discards any thrown error before falling
through to the unconditional `lc.stop()`. It is the only catch
in this file that does not log; every other one uses
`self.log.error(…, metadata: ["error": "\(error)"])`.
- This adds a single log line matching that convention, so
a failed graceful stop (and the resulting fall-through to a
forced VM shutdown) is more diagnosable. The intentional
fall-through to `lc.stop()` is unchanged.
- Instead of using force-unwrap to append to a list-valued
dictionary entry that should always exist, assign the value
with a default fallback and append to the (non-optional)
result.
- In `ProcessIO.swift`, the readability handlers for stdout and stderr
used `try!` when writing data to the output file handles. This would
cause crashes If the pipe is broken such that the force-try executes.
- Changed to handle a failed write similarly to an EOF.
- Closes#1750.
- Applies permission code used for the `--ssh` mount to all
host-to-container socket mounts.
- Adds a user option to the `doExec` test support function.
- Updates the `testRunCommandUnixSocketMount` to install `nc` in the
test container, and check the socket permission, and check the mounted
socket using `nc` as the guest user.
This also includes custom kernels for container machine. Its required
with nested virt as CONFIG_KVM needs to be enabled.
---------
Signed-off-by: michael_crosby <michael_crosby@apple.com>
Remove manually specified default value from help string since
ArgumentParser already appends it automatically from the property's
default value.
Signed-off-by: Charlie Le <charlie_le@apple.com>
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
`container` runs each workload in an ephemeral VM, so there's no
built-in way to keep a persistent Linux environment you can log into and
work in. `container machine` adds one.
A container machine is a lightweight, persistent, and integrated Linux
environments that feel like an extension of your Mac, created from
standard OCI images with a familiar UX. The login user matches your host
account with passwordless `sudo`, your home directory is mounted inside
the VM, and each machine keeps its filesystem and runs the image's own
init system (such as`systemd` or `openrc`).
```bash
container machine create alpine:3.22 --name my-machine
container machine run -n my-machine # interactive shell
container machine set -n my-machine cpus=4 memory=8G
```
Subcommands: `create`, `run`, `list` (`ls`), `inspect`, `set`,
`set-default`, `logs`, `stop`, `delete` (`rm`); `m` aliases `machine`.
Docs added to `docs/command-reference.md` (Machine Management) and
`docs/how-to.md` ("Use container machines").
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
Signed-off-by: Raj Aryan Singh <rajaryan_singh@apple.com>
Co-authored-by: Jaewon Hur <jaewon_hur@apple.com>
Co-authored-by: John Logan <john_logan@apple.com>
Co-authored-by: Michael Crosby <michael_crosby@apple.com>
Co-authored-by: Eric Ernst <eric_ernst@apple.com>
Co-authored-by: Danny Canter <danny_canter@apple.com>
- This PR changes the shape of the JSON
output for image resources to align closer with
`VolumeResource` and `NetworkResource`.
This includes adding `creationDate` in the
`configuration` section of the image output.
- This PR additionally cleans up some of the logic
around the `ImageResource` struct construction.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1647.
- `id` will become a system assigned (Docker-like) identifier
for the managed resource, and `configuration.name` is the
user-assigned name.
Today when we send a signal we don't wait for the container to exit, as
we don't know what signals the program will actually do anything with.
However, sigkill does not fit this mold, and we should wait for the
container to exit (or be removed for --rm containers).
Normalize JSON output for network and volume resources. (#1624)
- Reworks both JSON output presets to use sorted keys, ISO timestamps.
`compact` is used for `ls` output, and `pretty` is used for `inspect`.
- Extracts non-DRY option configuration into presets.
- Closes#1623.
- Closes#1625.
- For now, the ImageResource compliance happens
at the CLI level. We will work on pushing that into or
closer to the APIServer at a later time.
## Testing
- [x] Tested locally
---------
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1526 and #1527.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This PR fixes `system df` to report actual on-disk allocated bytes
(content blobs + snapshots) instead of summing per-image snapshot sizes.
Orphaned blobs are now included as reclaimable, and storage shared
across tags is no longer double counted. Also consolidates three
identical `calculateDirectorySize` implementations into a shared
`FileManager.allocatedSize(of:)` extension.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Refactor network model types: replace `NetworkState` enum and
phase-based NetworkStatus with a flat `NetworkStatus` struct.
- Simplify API server ↔ plugin protocol: plugin `status()` returns
runtime status only, API server owns configuration.
- `NetworksService` `list()`/`create()` now return `NetworkResource`
directly.
- Remove lifecycle phase checks and state machine guards throughout CLI
and API server.
- `variant` is plugin-specific, it's not a required property. This PR
replaces `NetworkPluginInfo` with a `plugin` name property on
`NetworkConfiguration` and an `options` list similar to that for
volumes.
- Moved `variant` to the option list.
