While reviewing test coverage, I noticed a couple of minor issues:
- 0 is non-negative - allow for zero memory
- we should likely use lstat instead of stat for file info
- we should check for empty name parameter
---------
Signed-off-by: Eric Ernst <eric_ernst@apple.com>
A ContainerManager is a type that handles more of the required resource
needed to create and run a container.
---------
Signed-off-by: crosbymichael <michael_crosby@apple.com>
This is a fairly large reworking, but it gets rid of something that has
plagued this since release which is the properties needing to be locked
to be Sendable compliant. This was somewhat of a copout because we
mostly know there's not a great deal of ways to have misused the setup
today, but alas we'd need to either mark the type as `@unchecked` or
just find a different route for setting the configuration. This change:
Exposes the underlying Configuration type that today only housed things
that aren't on the OCI spec. I'd love to just expose the OCI spec, but
we don't (and possibly never will) support everything on the spec, so
exposing it to be freely modified would be a bit odd. Now everything
related to the container is configured on this type, and the same goes
for execs.
Closes#206
Much like we have support for supplying DNS configurations and writing
out /etc/resolv.conf, this adds a way to write out /etc/hosts for a
given container.
In general I believe it's clever to synthesize an index for
single-platform image manifest, but we still need a way to distinguish
it. Add a dedicated annotation is the slightest change I've come up
with, and it's also OCI compliant. With this change come in, we can work
around https://github.com/apple/container/issues/212 and imitate the
behavior of other runtime with `container`.
Note that since `cctl` is meant to be a dedicated tool for inspecting
the Containerization framework itself, I didn't apply the indirection
for it, and it will be as-is with the genuine storage.
- The `@SendableProperty` macro now checks for supported types to
prevent a misuse with unsupported types like structs, dictionaries, and
arrays
- The new `@SendablePropertyUnchecked` can be used with classes and
enums
This allows the user the ability to raise an EOF for the containers
stdin. Today there's no way to close stdin so something as simple as
"cat" and relying on EOF to move the process forward doesn't work
While this only supports AS, xcode's default will build all arches, so
this presents a bit nicer default for Archiving an xcode application
that utilizes containerization.
Fixes#179
Signed-off-by: crosbymichael <michael_crosby@apple.com>
Creates a new Unpacker protocol that defines a single method
```
func unpack(_ image: Image, for platform: Platform, at path: URL, progress: ProgressHandler?) async throws -> Mount
```
This change also removes the `unpack(...)` method from the Image type.
Before
```
let mount = try await image.unpack(for: platform, at: path)
```
After
```
let unpacker = EXT4Unpacker(blockSizeInBytes: 2.gib())
let mount = try await unpacker.unpack(image, for: platform, at: path)
```
---------
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Here we implement the mechanism for ensuring that `container` doesn't
set up two default routes on containers that connect to multiple
networks. We'll implement the policy in apple/container#243.
Because we were installing rosetta directly in the constructor for
VZVirtualMachineInstance, and we'd prefer to not have the constructor
async as it pollutes so much more, we had devised this gnarly callback
approach for the install that is a bit of an eyesore. This changes focus
is on moving the install flow to a method that is already async so we
can piggyback off of it, and removing the install logic from the config
-> VZConfig conversion. Now the install will occur during start() if
rosetta is not installed.
There was a bug where the `www-authenticate` header in the HTTP response
from a registry would not be parsed accurately.
Specifically, if the header value had more than one `<space>` character,
the entire header would be ignored. This PR fixes this bug and adds unit
test to detect this in the future.
Fixes https://github.com/apple/container/issues/240
And most likely fixes https://github.com/apple/container/issues/237
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Make sure we always set TERM for containers that ask for a tty. Right
now this handling was spread around in a bunch of spots, but I'd wager
setting it for the client on the host via LinuxContainer/Process is more
sane and already what we do for a lot of the other fields.
Continue the allocations journey for anything that is in the codepaths
for pulling images. This time there's a couple spots in archive and ext4
we can get rid of some copies.
## Summary
The vminitd service was using `process.env.contains("HOME")` which
checks for exact string match rather than environment variables starting
with "HOME=".
Since environment variables are stored as `"KEY=value"` strings, the
condition was always false, causing vminitd to always override custom
HOME values even when explicitly provided by the client.
## Changes
- Updates the logic in `vminitd/Sources/vminitd/Server+GRPC.swift` to
use `contains(where: { $0.hasPrefix("HOME=") })` to properly detect
existing HOME environment variables
- Adds regression test `testProcessCustomHomeEnvvar()` to verify that
custom HOME environment variables are preserved when provided by the
client
## Testing
The fix has been tested with the new integration test that:
- Sets a custom HOME environment variable (`HOME=/tmp/custom/home`)
- Runs a shell command that outputs the HOME variable on the container
runtime
- Verifies the custom HOME value is preserved and not overwritten with
the default
## Environment
- macOS: 26.0 (25A5279m)
- Hardware: M4 Pro
- Xcode: 26 beta
- Swift: 6.2-dev
Fixes#135
The digest is calculated based on written json data, but JSONEncoder
doesn't preserve order bby default, so the digest is not consistent.
Signed-off-by: Alexey <makhov.alex@gmail.com>
## Changes
### README.md
- Fixed grammatical error: "when a process is ran" → "when a process is
run"
- Fixed plural form: "for instruction on" → "for instructions on"
### kernel/README.md
- Fixed numbering sequence: "4. Run `make`" → "3. Run `make`" in build
instructions
### Sources/Containerization/LinuxContainer.swift
- Fixed grammatical error in comment: "The container has ran" → "The
container has run"
We were doing intermediate step copies to Data objects both for push and
pull. We only need the data for the lifetime of the singular writes to
update the state of the checksums and to write to disk somewhere, so we
can use a view into the buffer from the http client to satisfy this.
We should return our own error type always for our methods. This wraps
all of the public methods on the process to return a more full featured
error than the rpcerrors we get today.
This change adds a new private method `waitIoComplete` on the
`LinuxProcess` type.
This method is called internally when the user calls `wait` for a
process - and it tries to give the IO streams some time to clear their
buffers.
Internally, this method sets up an `AsyncStream` down which an item is
sent when the vsock connection for either stdout/stderr is terminated.
We get this termination signal when the readability handler for the
associated fd fires with a no available data.
Inside the guest - once we are done relaying the IO from the process
into the socket connection, we close the socket fd which triggers the
above.
All this logic is wrapped around a timeout of 3 seconds, just to ensure
the method does not block forever.
---------
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
- FileTimestamps constructor that actually let you provide values was
not public, so it wasn't possible to pass in values other than nil. This
change makes the other constructor and the underlying fields public.
- Rename EXT4+Format to EXT4+Formatter
- Rename EXT4+Export to EXT4Reader+Export
- Make the superblock publicly accessible in the reader like the docs
for the product states.
Eric Ernst