Common subcommands for all defaults.
- Closes#384.
- Replaces `registry default` and `system dns default` subcommands with
`system property`.
- Users can use `system property ls` to see details about each supported
default value.
- `system property set` implements reasonable validation for all
properties.
- NOTE: Probing of the registry for `registry default set` was removed,
which means users will find out about a botched setting when pulling or
pushing.
- Updates docs.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [x] Breaking change
- [x] Documentation update
## Motivation and Context
See #384.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fixes https://github.com/apple/container/issues/588. This PR changes the
archiver compression file enumeration to use the
[enumerator(atPath:)](https://developer.apple.com/documentation/foundation/filemanager/enumerator(atpath:))
version. This version returns relative paths instead of full file paths
from the filesystem. /tmp is symlinked to /private/tmp and some swift
packages will handle that path differently. While a call to Foundation's
`URL.resolvingSymlinksInPath()` will return "/tmp", a call to
`FileManager.enumerator(at:)` will return "/private/tmp". This
difference causes a container image build to fail when the user is using
a path under /tmp or other special case paths as the context directory.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] New feature
## Description
Add option to force kernel setting and tests for CLI `kernel set`.
Related to https://github.com/apple/container/pull/575.
## Motivation and Context
This PR adds additional tests to ensure that we can set kernels from
local files, remote tar files, and local tar files. A new option `force`
is added to the `kernel set` subcommand which will overwrite an existing
kernel with the same name if one exists to make testing easier. The
tests ensure that a container can be started with the newly set kernel
and resets to the default recommended kernel when complete.
## Testing
- [x] Tested locally
- [x] Added/updated tests
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] Bug fix
## Description
Resolves#565. Relative paths in type=bind mounts now resolve to
absolute paths instead of being validated as volume names. Added some
tests generated using gen AI for this scenario.
- Fixes#231.
- Extends #313 (@dcantah) so that all of `container create`, `container
run`, `container build`, `container image pull`, and `container image
save` accept the three options.
- `container build` now processes comma-separated lists for
`--platform`, `--arch`, and `--os`. It first checks `--platform`,
assembling the union of all platform values. If that set is non-empty,
the builder builds the values in the set. Otherwise, the set consists of
all combinations of the specified architecture and os values, finally
defaulting to `linux` and the host architecture if no options are
provided.
- All other commands work accept a single platform, preferring the
`--platform` option over `--arch` and `--os` when both are specified.
`--os` defaults to `linux`, and `--arch` defaults to the host
architecture.
- Clarify help messages and present the args in consistent order, with
platform first since it takes precedence if present.
- Deduplicate redundant platform options for `container build`.
Today force deleting (if a container is running then stop()'ing first)
is handled entirely in the cli, which is brittle. The CLI doesn't know
if the container was started with --rm so it would have to do a weird
timeout + list dance to check if the containers gone after stopping.
This change remedies this by just having the daemon take in a `force`
boolean to the delete rpc. If this is provided and the container is
running then we'll stop first, and then cleanup. We can additionally not
cleanup if --rm was provided as the daemon has the data to determine if
a container asked for autoRemove.
Add `--ssh` flag to forward the host's SSH agent socket into the
container, so we can use SSH authentication for things like cloning
private repos, and also updates the socket path every time the container
starts to handle socket path changes like reboot/re-login.
Closes#498
- Closes#150, #394.
- Introduces `AttachmentConfiguration` type so that we can add key-value
options to `--network` in the future.
- Eliminates redundant `ContainersService.Item` type.
- Since we now ensure at ContainersService that hostnames will not
conflict, the network helper IP allocator now simply provides the
existing IP if for an allocation on an existing hostname, which should
handle (in an eventually consistent way) the case where a container
fails to deallocate an IP on shutdown.
This PR defines the snapshotter protocol
```swift
///Mount a snapshot and all its previous layers
func prepare(_ snapshot: Snapshot) async throws -> Snapshot
/// Commit a snapshot, making it permanent.
func commit(_ snapshot: Snapshot) async throws -> Snapshot
/// Remove a snapshot from snapshot store
func remove(_ snapshot: Snapshot) async throws
```
It updates executors to work with this new protocol
- Sets up API server as source of truth for installation root, similarly
to what was done for the data root. `system start` establishes the
install root, setting the environment variable `CONTAINER_INSTALL_ROOT`
when launching the API server.
- The API server propagates the environment variable when launching
helpers, and returns the install root to the CLI via the health check
XPC.
- Includes several fixes for detecting plugins that use app bundle
layout.
- Part of #384.
- Rename to reflect that these are not just client defaults.
- Relocate so callers don't need the heavyweight coupling to
ContainerClient to access the type.
Closes#339.
This change adds named volume support to container, providing volume
management CLI commands - `create, delete, list and inspect`. The
implementation uses EXT4 block-based persistent storage with a new
`VolumesService` actor for thread-safe operations, integrates seamlessly
with the existing container mount system through a new `.volume`
filesystem type, and provides atomic volume operations with XPC-based
API communication. Volumes are stored in isolated directories with
configurable sizes (default 512GB) and include proper cleanup and
container usage tracking for safe deletion.
Example Usage:
```
# Create a volume
container volume create mydata
# Use volume in container
container run -v mydata:/data alpine
# List volumes
container volume list
# Inspect volume details
container volume inspect mydata
# Clean up
container volume rm mydata
```
Fixes#212
This PR:
- adds a `package func resolved()` on `ClientImage` that makes use of
the new `com.apple.containerization.index.indirect` annotation to
identify and resolve wrapper indices created by Containerization;
- replace the digest displayed in `container image list` with the one of
the resolved manifest;
- use the resolved manifest for `container image inspect` if the index
is a wrapper.
0.5.0 introduces a new way to configure the containers and execs. This
is now done all upfront at constructor time in a callback style. I'm
very happy with the config improvements, but because IO can only be
setup at constructor time this makes it so that we need to supply IO at
creation time of the VM or exec, which isn't the end of the world. All
that really changes is `boostrap()` and `createProcess()` now take in IO
instead of slightly later in `process.start()`
I want to access the different variants of an image in my app, which
information is only available in the ImageDetail. Although the function
ClientImage.details() -> ImageDetail and its return type are already
public, its properties aren’t, which prevents access to this
information.
Changed `SandboxSnapshot` initializer from `package init()` to `public
init()` to enable external package consumers to create and use
`SandboxSnapshot` instances in their custom Sandbox plugins.
The `SandboxSnapshot` is used for `container list` functionality
* Closes#148.
* Storing the default nameserver in the bundle config means that DNS
won't work if the container stops and then restarts later when the
subnet address has changed.
See discussion below for example. For multiple network interfaces in a
single container we'll want to integrate against a containerization that
includes apple/containerization#156.
The change bumps the containerization dependency to 0.2.0 and addresses
the breaking API changes.
```console
% container network
OVERVIEW: Manage container networks
USAGE: container network <subcommand>
OPTIONS:
--version Show the version.
-h, --help Show help information.
SUBCOMMANDS:
create Create a new network
delete, rm Delete one or more networks
list, ls List networks
inspect Display information about one or more networks
See 'container help network <subcommand>' for detailed help.
```
This PR resolves a race condition when removing a container immediately
after stopping it, caused by the `stop` command returning before the
container fully transitions to the stopped state (#130).
**Changes:**
- Enhanced `TestCLIRmRace.swift` with robust test logic and helper
methods (`containerExists`, `safeRemove`).
- Improved error handling to distinguish race conditions from successful
removals.
- Added exponential backoff retry logic for cleanup operations.
- Updated `CLITest.swift` with missing `doRemove` method.
- Fixed `BuilderStart.swift` to handle `.stopping` case.
- Improved error messages with container ID for better debugging.
**Testing:**
- ✅ All tests pass (`make test`, `make integration`).
- ✅ Verified on macOS 26.
- ✅ Race condition test validates success and failure scenarios.
- ✅ Code formatted (`make fmt`).
Hopefully, this will pass the integration tests on GitHub.
Signed-off-by: ramsyana <47033578+ramsyana@users.noreply.github.com>
This PR updates the protos to match the recent changes in
https://github.com/apple/container-builder-shim/pull/15.
This PR additionally adds the builder shim version as a variable in
Package.swift. This allows us to be consistent with the builder tag used
for the builder shim image and when building protobuf files.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Closes https://github.com/apple/container/issues/126
This PR additionally removes the ability to set
`disable-progress-updates` for `container create` calls while we
investigate why output get jumbled there.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
This change updates the UX when we install required dependencies at
first launch
### Fresh install - respond `y` to prompt
```
➜ bin/container system start
Verifying apiserver is running...
Installing base container filesystem...
No default kernel configured.
Install the recommended default kernel from [https://github.com/kata-containers/kata-containers/releases/download/3.17.0/kata-static-3.17.0-arm64.tar.xz]? [Y/n]: y
Installing kernel...
```
### Fresh install - respond `n` to prompt and then run the provided
command
```
➜ bin/container system start
Verifying apiserver is running...
Installing base container filesystem...
No default kernel configured.
Install the recommended default kernel from [https://github.com/kata-containers/kata-containers/releases/download/3.17.0/kata-static-3.17.0-arm64.tar.xz]? [Y/n]: n
Please use the `container system kernel set --recommended` command to configure the default kernel
➜ bin/container system kernel set --recommended
Installing the recommended kernel from https://github.com/kata-containers/kata-containers/releases/download/3.17.0/kata-static-3.17.0-arm64.tar.xz...
```
### Fresh install - respond `n` to prompt and then run a container
```
➜ bin/container system start
Verifying apiserver is running...
Installing base container filesystem...
No default kernel configured.
Install the recommended default kernel from [https://github.com/kata-containers/kata-containers/releases/download/3.17.0/kata-static-3.17.0-arm64.tar.xz]? [Y/n]: n
Please use the `container system kernel set --recommended` command to configure the default kernel
➜ bin/container run alpine uname
Error: notFound: "Default kernel not configured for architecture arm64. Please use the `container system kernel set` command to configure it
```
---------
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Its a bit weird to have to pass `--http` when pulling / pushing images
if we are trying to do so from a local registry
This PR adds a `RequestScheme` enum type which tries to detect if the
connection to the registry should be over http or https. This auto
detection is the default behavior and can be overridden by passing the
`--scheme http/https` flag to the `run` ,`pull`, `push` `login` and
`registry default` command
The auto detection works by looking at the hostname / IP. HTTP is used
in the following cases
- If the hostname starts with `localhost` or is `127.x.x.x`
- if the host looks like an IP from the private address space
- If the host ends with the current default dns domain name
Also in this PR:
- Removing some used CLI flag groups and TODOs
- Better error messages when registry credentials are not found for a
host
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
J Logan