fixes#165
`init` depends on `vminitd/bin/vminitd`, `vminitd/bin/vmexec`, and
`bin/cctl`
`integration` depends on `bin/containerization-integration`
`bin/*` get generated via `make containerization`
Because we were installing rosetta directly in the constructor for
VZVirtualMachineInstance, and we'd prefer to not have the constructor
async as it pollutes so much more, we had devised this gnarly callback
approach for the install that is a bit of an eyesore. This changes focus
is on moving the install flow to a method that is already async so we
can piggyback off of it, and removing the install logic from the config
-> VZConfig conversion. Now the install will occur during start() if
rosetta is not installed.
This gets rid of some design decisions that I was not fond of. This
changes the process start for both execs and the init process to happen
internally in the object, as well as makes it so that all exec
functionalities can happen on the container object itself. This allows
us to get rid of the `if request.id == containerID` branches in the
rpcs, and handle this entirely in the object itself using its internal
state.
The existing integration tests should stress this just fine I believe.
This PR fixes compilation warnings observed in:
```
swift -v --version
Apple Swift version 6.2-dev (LLVM 5fbc818cf26c90b, Swift 2e1897356956e43)
Target: arm64-apple-macosx26.0
/Users/Dmitry/Library/Developer/Toolchains/swift-6.2-DEVELOPMENT-SNAPSHOT-2025-06-17-a.xctoolchain/usr/bin/swift-frontend --version
Apple Swift version 6.2-dev (LLVM 5fbc818cf26c90b, Swift 2e1897356956e43)
Target: arm64-apple-macosx26.0
Build config: +assertions
```
Currently, when a user runs `make cross-prep`, we install the latest
version of Swift. This requires installing the latest version of Static
Linux SDK, which we should update as a new version is released.
# Refactor GitHub Actions Workflow: Containerization Build
## 🛠 Summary
This PR introduces several important improvements and cleanups to the
build-containerization-template GitHub Actions workflow for better
maintainability, correctness, and readability.
### 🔧 Changes Made
#### 1. ✅ Fix invalid conditional syntax
- **!= is not supported in expressions** with **if**: in GitHub Actions.
- Only logical operators like !, &&, || are valid.
#### 2. ✅ Globalized environment variables
- Moved CURRENT_SDK and DEVELOPER_DIR to the job-level env: block to:
- Avoid redundancy across steps
- Make the workflow more maintainable
### 3. ✅ Replaced `secrets.GITHUB_TOKEN` with `github.token`
- Prefer github.token for GitHub-provided auth token to improve clarity
and scoping.
@katiewasnothere
This PR resolves the following error for new users:
```
% make cross-prep
Installing Swiftly...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 8549k 100 8549k 0 0 14.7M 0 --:--:-- --:--:-- --:--:-- 14.8M
installer: Package name is
installer: Installing at base path /Users/Dmitry
installer: The install was successful.
Welcome to swiftly, the Swift toolchain manager for Linux and macOS!
Please read the following information carefully before proceeding with the installation. If you
wish to customize the steps performed during the installation process, refer to 'swiftly init -h'
for configuration options.
Swiftly installs files into the following locations:
/Users/Dmitry/.swiftly - Directory for configuration files
/Users/Dmitry/.swiftly/bin - Links to the binaries of the active toolchain
/Users/Dmitry/Library/Developer/Toolchains - Directory hosting installed toolchains
These locations can be changed by setting the environment variables
SWIFTLY_HOME_DIR, SWIFTLY_BIN_DIR, and SWIFTLY_TOOLCHAINS_DIR before running 'swiftly init' again.
For your convenience, swiftly will also attempt to modify your shell's profile file to make
installed items available in your environment upon login. This can be suppressed with the
'--no-modify-profile' option.
Proceed? (Y/n):
Installing swiftly in /Users/Dmitry/.swiftly/bin/swiftly...
Error: The file “swiftly” couldn’t be opened because there is no such file.
make[1]: *** [swiftly] Error 1
make: *** [cross-prep] Error 2
```
There was a bug where the `www-authenticate` header in the HTTP response
from a registry would not be parsed accurately.
Specifically, if the header value had more than one `<space>` character,
the entire header would be ignored. This PR fixes this bug and adds unit
test to detect this in the future.
Fixes https://github.com/apple/container/issues/240
And most likely fixes https://github.com/apple/container/issues/237
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Make sure we always set TERM for containers that ask for a tty. Right
now this handling was spread around in a bunch of spots, but I'd wager
setting it for the client on the host via LinuxContainer/Process is more
sane and already what we do for a lot of the other fields.
Continue the allocations journey for anything that is in the codepaths
for pulling images. This time there's a couple spots in archive and ext4
we can get rid of some copies.
## Summary
The vminitd service was using `process.env.contains("HOME")` which
checks for exact string match rather than environment variables starting
with "HOME=".
Since environment variables are stored as `"KEY=value"` strings, the
condition was always false, causing vminitd to always override custom
HOME values even when explicitly provided by the client.
## Changes
- Updates the logic in `vminitd/Sources/vminitd/Server+GRPC.swift` to
use `contains(where: { $0.hasPrefix("HOME=") })` to properly detect
existing HOME environment variables
- Adds regression test `testProcessCustomHomeEnvvar()` to verify that
custom HOME environment variables are preserved when provided by the
client
## Testing
The fix has been tested with the new integration test that:
- Sets a custom HOME environment variable (`HOME=/tmp/custom/home`)
- Runs a shell command that outputs the HOME variable on the container
runtime
- Verifies the custom HOME value is preserved and not overwritten with
the default
## Environment
- macOS: 26.0 (25A5279m)
- Hardware: M4 Pro
- Xcode: 26 beta
- Swift: 6.2-dev
Fixes#135
The digest is calculated based on written json data, but JSONEncoder
doesn't preserve order bby default, so the digest is not consistent.
Signed-off-by: Alexey <makhov.alex@gmail.com>
## Changes
### README.md
- Fixed grammatical error: "when a process is ran" → "when a process is
run"
- Fixed plural form: "for instruction on" → "for instructions on"
### kernel/README.md
- Fixed numbering sequence: "4. Run `make`" → "3. Run `make`" in build
instructions
### Sources/Containerization/LinuxContainer.swift
- Fixed grammatical error in comment: "The container has ran" → "The
container has run"
We were doing intermediate step copies to Data objects both for push and
pull. We only need the data for the lifetime of the singular writes to
update the state of the checksums and to write to disk somewhere, so we
can use a view into the buffer from the http client to satisfy this.
We were using a := assignment for BUILD_BIN_DIR which evaluates any
variables immediately. Our make release logic sets the envvar and then
invokes `all` but at that point the value of BUILD_BIN_DIR has already
been determined.
We should return our own error type always for our methods. This wraps
all of the public methods on the process to return a more full featured
error than the rpcerrors we get today.
Building Swift-Syntax can be time-consuming, but this issue has been
resolved in the latest version by using a prebuilt binary. This
improvement enhances CI build times and the overall quality of the
package.
I’ve kept the version at 600 for compatibility reasons, but it might be
possible to start from 601 as well.
Please let me know.
Thanks
This change adds a new private method `waitIoComplete` on the
`LinuxProcess` type.
This method is called internally when the user calls `wait` for a
process - and it tries to give the IO streams some time to clear their
buffers.
Internally, this method sets up an `AsyncStream` down which an item is
sent when the vsock connection for either stdout/stderr is terminated.
We get this termination signal when the readability handler for the
associated fd fires with a no available data.
Inside the guest - once we are done relaying the IO from the process
into the socket connection, we close the socket fd which triggers the
above.
All this logic is wrapped around a timeout of 3 seconds, just to ensure
the method does not block forever.
---------
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
- FileTimestamps constructor that actually let you provide values was
not public, so it wasn't possible to pass in values other than nil. This
change makes the other constructor and the underlying fields public.
- Rename EXT4+Format to EXT4+Formatter
- Rename EXT4+Export to EXT4Reader+Export
- Make the superblock publicly accessible in the reader like the docs
for the product states.
These truthfully should be up to users to maintain, as trying to add
everyones editor of choice config directories here isn't ideal.
This additionally adds a section in contributing on the new stance.
Fixes#103 (and should fix
https://github.com/apple/container/issues/108)
Today we only parse if the username field of the runtime spec is set,
but this misses if someone just supplied the integer uid and gid fields
only.
When we were testing the repo, we added authentication to most of the
registry tests so that we could access private images. Now that the
images are public, this PR removes the use of REGISTRY_TOKEN and
REGISTRY_USERNAME in tests that no longer require authenticating.
Note: REGISTRY_TOKEN, REGISTRY_USERNAME, and REGISTRY_HOST are still
required in the CI to push images and for a few registry tests. So the
env variables are not completely removed. The variables are only used in
the test tool cctl and in our swift tests.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
We require signed commits as of yesterday, and it'd be nice to have this
in writing somewhere to avoid contributors getting blindsided when
github has a scary x on the merge button.
- Corrected the typo in the method name (`Extened` → `Extended`)
- Updated all references to reflect the corrected spelling
- Introduced a `@available(*, deprecated)` alias for the original method
to maintain backward compatibility, as it was part of the public API
This PR ensures that we enter a lock inside the `@SendableProperty`
implementation as soon as we access a computed property. Additionally,
it mirrors the access level of the original property. Both changes are
required for [improved
accuracy](https://github.com/apple/container/pull/144) of progress
updates in container. Additionally, it should resolve
https://github.com/apple/containerization/issues/60 that occurs on
certain configurations.
Please tag as 0.1.1 after merging.
Elijah Wright