Michael Crosby
315341b625
add masked and readonly path support ( #795 )
...
Signed-off-by: michael_crosby <michael_crosby@apple.com >
2026-07-08 16:47:16 -04:00
Danny Canter
997d5a4b08
Actions: Add Linux build step ( #654 )
...
Related to https://github.com/apple/containerization/issues/606
To make sure the project (and many linux specific libraries) builds on
linux lets add a linux step to build for both musl and glibc. Eventually
this will run unit tests as well. This change needs a bit more libc
agnostic-ifying work to make sure things work for both libcs.
2026-04-07 15:13:12 -07:00
Danny Canter
83943ed715
vminitd: Make everything libc agnostic ( #655 )
...
Remove the last (as far as I can see..) of the musl specific imports we
had.
2026-04-06 18:34:48 -07:00
Yibo Zhuang
a59ed89421
vmexec: create working directory if it doesn't exist ( #591 )
...
This seems like standard OCI runtime behavior, which is to create the
working directory if it doesn't exist.
2026-03-19 22:24:25 -07:00
Danny Canter
a35b168888
LinuxContainer/LinuxPod: Add support for NoNewPrivileges ( #581 )
...
Basically just a direct mapping to the prctl/OCI spec field.
2026-03-14 11:23:22 -07:00
Danny Canter
284db2ffea
Capabilities: Make case insensitive ( #558 )
2026-02-25 05:43:04 -08:00
Danny Canter
b2f8351668
vmexec: Add missing rlimits ( #506 )
...
We were missing:
RLIMIT_LOCKS, RLIMIT_MSGQUEUE, RLIMIT_NICE, RLIMIT_RTPRIO,
RLIMIT_RTTIME, and RLIMIT_SIGPENDING
2026-02-02 13:53:15 -08:00
Danny Canter
0e91de6124
vmexec: Use FoundationEssentials ( #475 )
...
Start the journey to try and remove the 30MiB ICU blob in this binary...
2026-01-16 10:11:45 -08:00
박성근
cbc03d7040
Fix: resolve relative executable paths against workingDirectory in vmexec ( #473 )
...
- Fixes the root cause for apple/container#962 .
Signed-off-by: ParkSeongGeun <phd0801@naver.com >
2026-01-11 18:15:18 -08:00
Danny Canter
fc5399e77e
vmexec: Remove the logger setup ( #469 )
...
We can't write to stderr because it may be the containers stderr, so
this is mostly dead code. We should think about how to do logging from
here as there's a couple spots it'd be nice.
2026-01-05 13:48:43 -08:00
Kathryn Baldauf
ec2ee3e94d
Update license header on all files to include the current year ( #470 )
...
Related to https://github.com/apple/container/pull/1024
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2026-01-05 13:08:48 -08:00
Danny Canter
7962dae643
Add capabilities support ( #444 )
...
Closes https://github.com/apple/containerization/issues/442
This adds capabilities support to LinuxContainer via a new surface in
ContainerizationOS + some C wrappers.
2025-12-11 15:07:17 -05:00
RahulThennarasu
f31d2005b5
ManagedProcess: Capture vmexec stderr and convert to Containerization Error ( #411 )
...
Fixes #277
When vmexec fails, it logs to stderr and exits with code 1. Previously,
the error details were lost. This change captures stderr and converts it
into a proper ContainerizationError.
Signed-off-by: Rahul Thennarasu <rahulthennarasu07@gmail.com >
2025-11-19 23:56:09 -08:00
Dmitry Kovba
a829fdcdfd
Improve log and error messages ( #352 )
...
Improved log and error messages.
2025-10-27 09:21:54 -07:00
Dmitry Kovba
a405d88e6d
Throw an error for an empty array ( #349 )
...
Throw an error for an empty array before accessing the first element.
2025-10-24 11:19:25 -07:00
Kathryn Baldauf
e283e023ab
Use container's environment when starting the init process ( #329 )
...
Fixes an issue first described in
https://github.com/apple/container/issues/740 .
Previously the initial process of the container was using vminitd's
environment variables to find the target executable. This PR updates the
code to use the container's configured environment for the initial
process instead. The behavior of an exec in a container should be the
same as before.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-10-13 21:33:18 -07:00
J Logan
995a231348
Removes "all rights reserved" from license header. ( #309 )
2025-10-03 13:27:59 -07:00
Danny Canter
985dac83e5
vminitd: Proper pty setup / mount /dev/console ( #248 )
2025-08-12 20:03:27 -04:00
Danny Canter
c7763c76cf
vmexec: Set perms on stdio ( #174 )
...
We don't chown the container's stdio today.
2025-06-27 11:03:21 -04:00
Danny Canter
059ff4033f
Makefile: Revert recent reworking ( #177 )
...
Reverts f9198d6ff7
2025-06-26 19:31:46 -04:00
Michael Crosby
5d2d7a1bc3
update license header removing new line ( #99 )
...
Fixes #63
Signed-off-by: crosbymichael <michael_crosby@apple.com >
2025-06-12 09:57:35 -04:00
Aditya Ramani
0bd526053c
Add executable name to exec error ( #36 )
...
Signed-off-by: Aditya Ramani <a_ramani@apple.com >
2025-06-07 22:47:45 -07:00
Danny Canter
f49f668936
Updates to license headers ( #17 )
...
- Capitalize containerization.
- Wrap "All rights reserved" to a new line.
Signed-off-by: Danny Canter <danny_canter@apple.com >
2025-06-05 16:16:22 -07:00
+6
3407cc3f16
initial commit
...
Co-authored-by: Aditya Ramani <a_ramani@apple.com >
Co-authored-by: Agam Dua <agam_dua@apple.com >
Co-authored-by: Danny Canter <danny_canter@apple.com >
Co-authored-by: Dmitry Kovba <dkovba@apple.com >
Co-authored-by: Eric Ernst <eric_ernst@apple.com >
Co-authored-by: Evan Hazlett <ehazlett@apple.com >
Co-authored-by: Gilbert Song <gilbertsong@apple.com >
Co-authored-by: Hugh Bussell <hbussell@apple.com >
Co-authored-by: John Logan <john_logan@apple.com >
Co-authored-by: Kathryn Baldauf <k_baldauf@apple.com >
Co-authored-by: Madhu Venugopal <mvenugopal@apple.com >
Co-authored-by: Michael Crosby <michael_crosby@apple.com >
Co-authored-by: Sidhartha Mani <sidhartha_mani@apple.com >
Co-authored-by: Tanweer Noor <tnoor@apple.com >
Co-authored-by: Ximena Perez Diaz <xperez528@gmail.com >
Co-authored-by: Yibo Zhuang <yzhuang@apple.com >
2025-06-05 16:15:21 -07:00
Michael Crosby