## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
- CI build is failing because runners don't have an /etc/resolver
directory, causing the directory monitor to fail. This occurs while the
install-kernel make target is running, so it appears that kernel
download is failing when it's just that the API server is dying. Created
#1207 for the issue.
- Fixing the initial scan for the directory just moves the problem to
the filesystem watch loop, likely because we're not testing the result
of `open()` for errors.
- Right now the priority is getting CI running and PRs merged, so just
commenting out the realhost DNS server setup.
- Also seeing that under some conditions it can take quite a while for
launchd to start the helper for the default network (8 seconds or more).
With the 10 second health check timeout after API server registration,
this means that some CI runs can exhibit this failure mode. Added a
`--timeout` option to SystemStart and set a 60 second timeout for
install-kernel and integration Makefile targets.
- Fixed a bug where `--debug` was being placed in the wrong location in
the api server startup args.
- Disabled all network CLI tests due to container bootstrap errors when
trying to run the container immediately after creating the network. The
slow network helper launch could be the reason behind the failures that
drove us to serialize these tests. Filed #1206 for this issue.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
This is not intended to be used to support `--filter` or similar on the
CLIs list yet, it's solely to clean up our rather awkward use of
`ContainerClient.list()` today in the CLI. The list RPC simply returns
all of the containers we have created. Because of this, for a LOT of our
commands we filter to what we need client side, which feels like a
waste.. This change introduces a filter struct that we can provide an
array of container IDs, labels, and the status of the containers to
filter the `list()` output from.
This additionally, because it was killing (pun not intended) me and I
was already having to change this area for the `list()` additions,
changes container kill slightly to return an error if you try and kill a
container that doesn't exist.
`make test` occasionally fails with:
```
✘ Test testHostDNSReinitialize() recorded an issue at HostDNSResolverTest.swift:132:45: Expectation failed: (error →
Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory") as? (ContainerizationError → NSError)
✘ Suite HostDNSResolverTest failed after 0.119 seconds with 1 issue.
```
- Implemented the TODO at
ContainerAPIService/Client/Utility.swift:358 — warn the
user when a named volume is auto-created.
- This only triggers for named volumes (not anonymous
ones), matching Docker's behavior of informing users
about implicit resource creation.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Closes#1150.
- The problem seems to be that the selinux label attribute enforcement
doesn't play well with overlayfs.
- Solution is to set the `lsm` boot line argument. The new value
corresponds to what one would see in a Lima VM with Colima. The Kata
kernel we use doesn't provide any of those modules, so now if you run
`dmesg | grep -i lsm` in a container you will just see: `LSM:
initializing lsm=capability`
Send the hash of entire tar file in the first BuildTransfer packet to
prevent container-builder-shim from using stale cached contents.
This PR resolves#1143.
This PR relies on apple/container-builder-shim#64.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Current container-builder-shim uses only first few bytes of tar file as
checksum, which leads to the usage of stale cached contents if the
change of build context is not included in the first bytes of tar file.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
---------
Co-authored-by: Ronit Sabhaya <ronitsabhaya75@gmail.com>
Co-authored-by: J Logan <john_logan@apple.com>
Instead of logging errors, and then additionally throwing an error
stating what containers couldn't be stopped/killed/deleted, let's just
concatenate the errors and throw the single error.
Co-authored-by: saehejkang <saehej.kang@gmail.com>
Co-authored-by: Anthony DePasquale <anthony@depasquale.org>
- Bump `containerization` to `0.25.0`
- Updates for parameter changes on containerization
registry access API.
- Updates for change to containerization
`cleanUpOrphanedBlobs` function.
## Type of Change
- [x] Bug fix
## Motivation and Context
The PR labeler workflow has been failing for a while but it's difficult
to know how to fix it since the PR labeler workflow is run from main
(aka NOT the current PR branch) for security reasons. Example at
https://github.com/apple/container/actions/runs/21690229300/workflow
ClientContainer was honestly extremely awkward. It could only be created
by passing either a ContainerConfiguration, or a Snapshot that had to be
obtained from calling a static method on the type itself. The type also
did not store a connection, so every single method got a new xpc
connection to the APIServer. This change aims to rework this type to be
just a generic client, that is *not* a client for one specific
container, but for any.
- Rename to ContainerClient
- Have list() return [ContainerSnapshot]
- Create a connection in the constructor
- Change all the callsites to use the new API
- Small, somewhat related, change to logs API in the APIServer. Now that
we don't need to call get() to grab a client anymore which was typically
what did "does this container exist" logic and gave a nice error
message, I added a small check in the APIServer to see if the container
exists and return mostly the same error message.
- Closes#1122.
- Adds placeholder ManagedResource and unit tests. Nothing is using
these yet.
- Adds system-defined resource labels for owning plugin and resource
role. The system discriminates the builtin network using role "builtin".
- Adds builtin role when creating builtin network at startup, and
ensures that a preexisting network with ID "default" gets updated with
the role label.
- Replace all network ID checks for "default" with the builtin role
check.
- Adds "builder" role to builder VM.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Role and owner labels should make cross-cutting resource policy easier
to implement.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
## Summary
The `reload()` method in `PacketFilter.swift` references
`/sbin/reloadProcess` (the local variable name) instead of
`/sbin/pfctl`. This causes all DNS create and delete operations to fail:
```
Error: internalError: "pfctl reload exec failed: "Error Domain=NSCocoaErrorDomain Code=4 "The file "reloadProcess" doesn't exist.""
```
## Fix
One-line change: `/sbin/reloadProcess` → `/sbin/pfctl`
## Testing
Verified on macOS 26 (Tahoe) with Apple Silicon:
- `sudo container system dns create test.sdc.internal --localhost
203.0.113.1` succeeds without error
- Container can resolve and reach host services through the DNS redirect
- `DirectoryWatcher` opens file descriptors for monitoring
directories but never closes them, causing a file descriptor
leak.
- Adds `setCancelHandler` to properly close file descriptors
when the `DispatchSource` is cancelled.
Signed-off-by: Ronit Sabhaya <ronitsabhaya75@gmail.com>
- Closes#1113.
- This is the newest we can do until we address #767.
- Slight change to PacketFilter error handling so unit tests work more
reliably.
- Try making CLINetworkTests serialized to see if parallel execution is
causing flakes.
The old mtu default in containerization was 1280 to account for some
alpine/musl images that have issues with
1500. This changed in the last couple tags to be modifiable, but the new
default is the standard 1500. Ideally we eventually allow supplying the
mtu to be used when you create a network (or possibly a container
creation setting), but for now just default in here back to what CZ used
to use.
Updating the package dependency on apple/containerization to pick up bug fixes
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Co-authored-by: J Logan <john_logan@apple.com>
- ContainerResources shouldn't need to know anything about CLI stuff.
- Move ExpressibleByArgument protocol conformance to an extension in the
package where it's needed.
- Refer to #862
- Updated `SIZE` field to `FULL SIZE`, as it seemed more appropriate so
it does not get mixed up with the `descriptor size` field
- Closes#860
- Fixed#892.
- By contrast with `rm`, `prune` should display
the amount of reclaimed storage, so added code
to retrieve it.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
- Closes#977.
- Closes#1058.
- Prevents unexpected removal of containers on
bootstrapping and starting failures, by reorganizing
error handling for container `run`, `start`, and
`exec` so that error handling only unwinds that
which was done in the current scope.
- Relies on apple/containerization#495.
- Closes#1037.
- Adds a `--mode` flag that has `nat` and `hostOnly` options.
The host-only option selects the vmnet host-only mode,
where containers attached to the network can reach each
other and the host, but not external systems.
- Closes#346.
- This PR enables connecting host's localhost ports from
containers.
- It adds an option `--localhost <localhost>` to DNS
create command, after which the packets heading
ip address in container are redirected to localhost in
host machine. Packet filter rule is added and deleted
along with the creation and deletion of localhost domain.
- Services started from Terminal run in the `gui/$uid`
launchd domain. When `ensure-container-stopped.sh`
runs from a different context, `launchctl managername`
may return a different domain, causing the script to
check the wrong domain and miss running services.
I noticed this after upgrading `container` via Homebrew.
- Introduces a getopt option `-a` that allows booting out all
domains explicitly. Also adds `-h` for a usage message.
Signed-off-by: Patrick Linnane <patrick@linnane.io>
This change adds --dns parameter support to the build command, matching
the existing functionality in the run command. This allows users to
specify custom DNS nameservers (like Google DNS 8.8.8.8) when building
container images, which is essential when the host machine uses a local
DNS resolver (e.g., 127.0.0.2) that doesn't work inside containers.
Changes:
- Added --dns option to BuildCommand to accept DNS nameserver IP
addresses
- Modified build logic to detect DNS configuration changes and recreate
the builder container when DNS settings differ
- Passed DNS configuration to BuilderStart.start() method
- Updated builder container creation to use specified DNS nameservers or
fall back to network gateway
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This change adds --dns parameter support to the build command, matching
the existing functionality in the run command. This allows users to
specify custom DNS nameservers (like Google DNS 8.8.8.8) when building
container images, which is essential when the host machine uses a local
DNS resolver (e.g., 127.0.0.2) that doesn't work inside containers.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
---------
Co-authored-by: J Logan <sgtbakerrahulnet@yahoo.com>
- Fixed#1073
- Move the conditional check to the front; there's no need
to check for a default network after filtering.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
- Relates to #642.
- Each image carries it own error message (allows for different error
types per image)
- Stdout/stderr support
- Use of the new `StderrLogHandler`
J Logan