`container run` and `container create` infer os, arch, and runtime
from the image's OCI index, or manifest + config.
Runtime defaults to `container-runtime-<os>` unless `--runtime` is set.
Adds an `imagePlatforms` images service route and bumps
containerization to 0.53.0.
- Fixes#1876.
- Encode forwarded process signals as signal
names instead of integer XPC values.
- Preserve Darwin-to-Linux signal semantics for
foreground signal forwarding.
- Add coverage for the kill request payload and
forwarded INT, TERM, WINCH, USR1, and USR2
mappings.
- `BuildFSSync.read()` and `info()` resolved a
requested path, checked that the result was
inside the build context, and then opened the
original path. A symlink replaced between the
check and the open was followed to its new
target, which could be outside the context.
-This change opens each requested file by
walking its path one component at a time from
a directory descriptor pinned on the context
root, using `FileDescriptorOps` from
`containerization`. Symlinks are followed only
when the target is relative and stays beneath
the context root. The metadata and the content
returned to the builder both come from the
same open descriptor.
- Behavior change: a symlink with an absolute
target is now rejected by `read()` and `info()`,
even when the target is inside the context.
Relative symlinks that stay inside the context
still work. `walk()`-based transfers are unchanged.
- Dependency: Requires `containerization` 0.50.0
for its `FileDescriptorOps` API enhancements.
This change updates the library from 0.52.0
to 0.52.1.
- Closes#2374.
- `container logs -f` exits when its initial read
finds an empty log. Skip the empty initial read
without returning, so follow mode can wait for
new output.
- Keep the full-file read to preserve existing
output before following.
- Add a regression test for output appended to
an initially empty log.
- Leave container machine logs unchanged
because it has a separate implementation and
this issue concerns container logs.
- Fixes#2392.
- `ContainersService.logs(id:)` opened `stdio.log` and
`vminitd.log` eagerly, so either one missing failed the
whole request. Both are created by `RuntimeLinux` at
bootstrap, so a container that has never been started
has neither. And only `RuntimeLinux` writes
`vminitd.log`, so with another runtime plugin even
plain `container logs` failed.
- A missing log now reads as empty: it's opened as
`/dev/null`, with a debug log line. Any other failure
to open a log still throws.
Co-authored-by: Bryan Mosley <342731628+bryanmosley@users.noreply.github.com>
- Updates actions/upload-artifact from 7.0.1 to 7.0.2
- Updates actions/download-artifact from 8.0.1 to 8.0.2
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Closes#457.
- A container can now declare additional DNS names for
a network attachment with a repeatable `alias` property
on `--network`, including subtree aliases that match
every name below a domain.
- With the default domain `test`, this container answers
to `gateway.test` by its name, to `api.test` by the exact
alias, and to `web.gateway.test`, `a.b.gateway.test`
and every other name below `gateway.test` by the
subtree alias. The motivating case is a gateway container
in front of a local Kubernetes cluster that answers for
`*.gateway.test`, with an ingress controller routing on
the `Host` header.
- An alias is an exact name, or a name with a leading
dot that matches every name below it. A name without
a dot gets the default domain, as container names do.
A subtree alias must be below a name the same
attachment owns, and exact names are unique across
all containers, so a container cannot claim another
container's namespace. The rules for one attachment
are checked when a container is created, again when
a stored container starts, and again by the network
helper when it registers the aliases. See
`docs/architecture/dns.md` for the design, the
invariants and the security considerations.
- The k8s load-image CLI command will issue a
ctr image tag command in the guest to make
the fully qualified name of an image available
when the image has a short name (such as
when building and testing locally). The ordering
of fully qualified name and source image name
was backwards, causing the command to
silently fail.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- `launchctl list` does not work as expected in the sandbox.
- Probe with `launchctl print <domain>/<label>` instead,
which launchd does allow a sandboxed process, and key
off exit codes: 0 means registered, 113 (ENOSERVICE)
means not registered, and anything else is an error rather
than being mistranslated into a negative.
- The probe is advisory in `system status`, so an indeterminate
answer falls through to the XPC health check, whose success
is authoritative.
Signed-off-by: Renlord Yang <renlord@apple.com>
- Fixes#2149.
- `container image list` currently fails completely when
one image record references an unreadable or missing
content blob. Healthy images are not rendered, and
structured output such as JSON and YAML is unavailable.
- This PR resolves each image independently:
- healthy images remain visible;
- unreadable images are reported as warnings;
- warnings are written to stderr;
- structured stdout remains valid;
- the command exits non-zero after rendering a
partial listing, so automation can detect it.
- Closes#2321.
- Removes image script and ORAS resource extension
point handling for container machine user setup.
- Replaces image script resource with hardcoded script.
- Adds more flexible user setup options to
`container machine`.
- Updates container machine documentation to clearly
identify convenience-isolation tradeoffs.
Mike Drob