- Closes#1005.
- Adapt everything to use MACAddress type from containerization 0.20.0.
- Allocate MAC addresses for every container so that we have
deterministic IPv6 link local addresses.
- Add AAAA handling to ContainerDNSHandler.
- NOTE: Only works on Tahoe. On Sequoia, we don't have a good way to set
or determine the IPv6 network prefix when networks are created, so we
can't infer the IPv6 link local addresses for AAAA responses and we
instead return `NODATA`.
- Closes#461.
- Extract core types into ContainerResources target.
- Extract ContainerNetworkServiceClient from ContainerNetworkService.
- Relocate sandbox client from ContainerClient to
ContainerSandboxServiceClient.
- Relocate ContainerClient to ContainerAPIServiceClient.
- Common structure from services and clients under Source/Services.
Updated project hierarchy:
```
Sources/CAuditToken - audit token access wrapper
Sources/CLI - CLI executable
Sources/ContainerBuild - builder
Sources/ContainerCommands - CLI command implementations
Sources/ContainerLog - logging helpers
Sources/ContainerPersistence - persistent data and system property helpers
Sources/ContainerPlugin - plugin system
Sources/ContainerResource - resource (container, image, volume, network) types
Sources/ContainerVersion - version helpers
Sources/ContainerXPC - XPC helpers
Sources/CVersion - injected project version
Sources/DNSServer - container DNS resolver
Sources/Helpers - service executables
Sources/Services/*/Client - service clients
Sources/Services/*/Server - service implementations
Sources/SocketForwarder - port forwarding
Sources/TerminalProgress - progress bar
```
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [x] Breaking change
- [ ] Documentation update
## Motivation and Context
The ContainerClient library was a bit of a grab bag. This refactor
applies a more sensible project and library structure for resource data
types, services, and clients.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Part of work for #460.
- Enable set/get of IPv6 network prefix in ReservedVmnetNetwork.
- Show IPv6 prefix in `network list` full output.
- Option for setting IPv6 prefix when creating a network.
- System property for default IPv6 prefix.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
See #460.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
- Part of work for #460.
- With CZ release 0.17.0, the IP and CIDR address
types changed from String to IPv4Address and
CIDRv4, respectively. This PR applies the corresponding
adaptations to container.
- Refactor the `volume prune` command to follow a client-side approach.
The `volumeDiskUsage` is calculated in the service file, so it made
sense to leave that there.
- Relates to the discussion from #914
- Fixes#901.
## Type of Change
- [x] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Previously `container image prune` called `ImageStore.prune()` (renamed
to `cleanupOrphanedBlobs()` in cz 0.15.0) which only removed orphaned
content blobs and never actually removed images.
This PR fixes that behavior so `container image prune` removes dangling
images by default, and with `-a` removes all unused images, not just
dangling ones.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#884.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This PR implements the `container system df` command to display disk
usage statistics for images, containers, and volumes, along with their
total count, active count, size, and reclaimable space for each resource
type.
Active resources are determined by container mount references and
running state, while reclaimable space is calculated from inactive or
stopped resources.
Example output:
```
~/container ❯ container system df
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 4 3 4.42 GB 516.5 MB (11%)
Containers 4 2 2.69 GB 1.51 GB (56%)
Local Volumes 3 2 208.5 MB 66.2 MB (32%)
```
I'll have some follow-on PRs that will add `-v/--verbose` flag for
detailed per-resource information, `--filter` flag for filtering output
by resource type, and a `--debug` flag for debug statistics like block
usage, clone counts etc.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Closes#824
This implements statistics gathering across the various components, but
ultimately this is for implementing a new CLI command: `container
stats`. This shows memory usage, cpu usage, network and block i/o and
the number of processes in the container. The new command can inspect
stats for 1-N containers and by default continuously updates in a `top`
like stream.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- In Alpine Linux containers (commonly used as Docker base images),
standard DNS resolution is provided by **musl**, a lightweight C
standard library (libc). Musl implements DNS lookups via
`getaddrinfo()`, which queries AAAA (IPv6) records first.
- Problem: DNS did not work correctly **inside containers**. Any
system command attempting to resolve hostnames
(e.g., `ping dynamodb-admin`) **failed** when the DNS server
responded NXDOMAIN for AAAA records, even if A (IPv4) records
existed. Explicitly forcing IPv4 (`ping -4dynamodb-admin`) worked
correctly, showing the issue is specific to musl’s IPv6-first behavior.
- Consequence: In IPv4-only environments, Alpine-based containers
cannot resolve hostnames using standard tools or libraries.
Applications relying on `getaddrinfo()` fail with ENOTFOUND,
breaking networking and inter-container communication.
- Root cause: Following RFC 8305 / RFC 6724, musl treats NXDOMAIN
for AAAA as “hostname does not exist” and does not fallback to A
(IPv4) records.
- Fix: The Apple Container DNS engine now behaves as follows:
* If an **A record exists**, AAAA queries return **NOERROR with empty
answer (NODATA)**.
* If neither **A nor AAAA** exist, NXDOMAIN is returned.
This ensures that Alpine-based containers in IPv4-only networks can
correctly resolve hostnames inside containers without modifying
container images or application code.
- Closes#752.
- Currently, there is no way to specify a custom MAC address for a
container's network interface and the MAC address is auto-generated by
the system.
- Use Cases
- **Network Testing**: Developers testing network-dependent applications
that need predictable MAC addresses
- **License Management**: Running containerized software with MAC-based
license keys
- **Network Automation**: Scripts and tools that expect specific MAC
addresses for configuration
- **Debugging**: Consistent MAC addresses across container restarts for
easier troubleshooting
- Closes#508.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Adds a `container volume prune` command that removes volumes with no
container references and reports the amount of disk space reclaimed.
This helps users clean up unused volumes and easily reclaim disk space.
Also updates the `volume delete` documentation to clarify and highlight
how the `--all` flag works.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Part of #653.
- No need for `defaultCommand` since ContainerService startup will write
a new launchd plist with the `start` subcommand included.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Allows us to add commands to support post-installation, migration, etc.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#615.
Improves project organization. Separates service so it can be tested and
used separately from the executable target. No functional changes.
- Closes#557.
- Breaking change: removes `.upToNextOption` for labels on volumes as
this is not what is done for containers, and it forces the argument to
precede the options if a label is supplied, which is non-intuitive.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [x] Breaking change
- [x] Documentation update
## Motivation and Context
Consistent features and UX across managed resources.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
Define a `UnpackStrategy` function type in the `SnapshotStore` to give
more control over how an image is unpacked.
Previously, we were creating a 512 GB sparse block file for the initial
file system of a container, which is overkill.
With this change, the vminit image is unpacked to a smaller block file,
while container images are unpacked to the 512 GB block
Follows the same pattern as
https://github.com/apple/container/blob/main/Sources/Helpers/RuntimeLinux/RuntimeLinuxHelper.swift#L71
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
See discussion below for example. For multiple network interfaces in a
single container we'll want to integrate against a containerization that
includes apple/containerization#156.
The change bumps the containerization dependency to 0.2.0 and addresses
the breaking API changes.
```console
% container network
OVERVIEW: Manage container networks
USAGE: container network <subcommand>
OPTIONS:
--version Show the version.
-h, --help Show help information.
SUBCOMMANDS:
create Create a new network
delete, rm Delete one or more networks
list, ls List networks
inspect Display information about one or more networks
See 'container help network <subcommand>' for detailed help.
```
J Logan