Send the hash of entire tar file in the first BuildTransfer packet to
prevent container-builder-shim from using stale cached contents.
This PR resolves#1143.
This PR relies on apple/container-builder-shim#64.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Current container-builder-shim uses only first few bytes of tar file as
checksum, which leads to the usage of stale cached contents if the
change of build context is not included in the first bytes of tar file.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
---------
Co-authored-by: Ronit Sabhaya <ronitsabhaya75@gmail.com>
Co-authored-by: J Logan <john_logan@apple.com>
- Closes#1122.
- Adds placeholder ManagedResource and unit tests. Nothing is using
these yet.
- Adds system-defined resource labels for owning plugin and resource
role. The system discriminates the builtin network using role "builtin".
- Adds builtin role when creating builtin network at startup, and
ensures that a preexisting network with ID "default" gets updated with
the role label.
- Replace all network ID checks for "default" with the builtin role
check.
- Adds "builder" role to builder VM.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Role and owner labels should make cross-cutting resource policy easier
to implement.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Closes#461.
- Extract core types into ContainerResources target.
- Extract ContainerNetworkServiceClient from ContainerNetworkService.
- Relocate sandbox client from ContainerClient to
ContainerSandboxServiceClient.
- Relocate ContainerClient to ContainerAPIServiceClient.
- Common structure from services and clients under Source/Services.
Updated project hierarchy:
```
Sources/CAuditToken - audit token access wrapper
Sources/CLI - CLI executable
Sources/ContainerBuild - builder
Sources/ContainerCommands - CLI command implementations
Sources/ContainerLog - logging helpers
Sources/ContainerPersistence - persistent data and system property helpers
Sources/ContainerPlugin - plugin system
Sources/ContainerResource - resource (container, image, volume, network) types
Sources/ContainerVersion - version helpers
Sources/ContainerXPC - XPC helpers
Sources/CVersion - injected project version
Sources/DNSServer - container DNS resolver
Sources/Helpers - service executables
Sources/Services/*/Client - service clients
Sources/Services/*/Server - service implementations
Sources/SocketForwarder - port forwarding
Sources/TerminalProgress - progress bar
```
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [x] Breaking change
- [ ] Documentation update
## Motivation and Context
The ContainerClient library was a bit of a grab bag. This refactor
applies a more sensible project and library structure for resource data
types, services, and clients.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Fixes#883.
Changes `BuildImageResolver` to use `fetch()` instead of `pull()`.
`fetch()` checks the cache first and only pulls if needed, preventing
incorrect progress events (e.g., "1/1 KB" metadata checks) on cached
images that caused the progress bar width calculation to produce
negative/weird padding counts, triggering "Fatal error: Negative count
not allowed" crashes during rebuilds.
- Closes#710.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fetching images during builds currently show just a 0.0s timer, and no
other info making builds appear hung. This adds a realtime download
progress bar with info, when pulling base images during builds.
<img width="1133" height="640" alt="Screenshot 2025-11-04 at 2 54 33 PM"
src="https://github.com/user-attachments/assets/200d8485-a956-4ce1-bbfe-d7406bd85774"
/>
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
Closes#782#99
If a Dockerfile can't be found in the context dir, check for the common
alternative Containerfile. This does not implement .containerignore
also, solely Containerfile for now. This also funnily enough fixes us
not checking for the Dockerfile IN the context directory.. woops.
## Type of Change
- [x] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
This PR updates the protos to match the recent changes in
https://github.com/apple/container-builder-shim/pull/15.
This PR additionally adds the builder shim version as a variable in
Package.swift. This allows us to be consistent with the builder tag used
for the builder shim image and when building protobuf files.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
`BuildFSSync.walk` relied on an implementation detail to skip traversing
the path ".", relative to the build context dir.
Specifically, it assumed that:
- `URL.parentOf()` would return false when the parent argument was
relative.
- `URL.path(percentEncoded: false)` would preserve the relativity of an
input path.
These assumptions held on earlier macOS releases, so the context
directory silently remained untouched.
In some versions of macOS , `URL.path(percentEncoded: false)` always
returns an absolute path, regardless of how the URL was created. Because
of this change, `URL.parentOf()` now returns true for ".", and
BuildFSSync.walk begins descending into the context directory—something
it was never meant to do.
This solution:
- Remove the hidden dependency on `URL.parentOf()` for context‑directory
detection.
- Add an explicit check for "." inside BuildFSSync.walk and bail out
early.
Replace fragile calls to `URL.path(percentEncoded: false`) with the
stable, documented `URL.relativePath`, which preserves relativity when
the original path was relative.
jwhur