This PR fixes several races with the `stop()` and `shutdown()` methods
by moving all state transitions inside a lock.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
[Why is this change needed?]
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Makes ProcessIO more generally available.
- `Application.handleProcess(processIO:process:)` becomes
`processIO.handleProcess(process:log:)`.
## Motivation and Context
This code shouldn't be in the CLI, it should be part of ContainerClient.
- Initial work for #642. CLI commands will configure this log handler so
that they write warnings and errors to stderr, and only proper output
will go to stdout.
- Facilitates #507. The `--debug` option can set the logging level
appropriately, and CLI commands can just use `log.debug()`.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
Closes https://github.com/apple/container/issues/638. This PR adds a
warning in the README for the documentation links to help newcomers find
the correct documentation based on the version of `container` they are
running.
## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Part of #515.
- Order options alphabetically.
- Use consistent descriptions for platform, os, arch.
- Add os/arch options to push.
- Rename ImageRemove to ImageDelete since delete is the primary command
and rm is the alias.
## Motivation and Context
Clear, consistent presentation of command help.
- Part of #653.
- No need for `defaultCommand` since ContainerService startup will write
a new launchd plist with the `start` subcommand included.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Allows us to add commands to support post-installation, migration, etc.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Part of #515.
- Add titles to option groups for container subcommands.
- Order option groups and container subcommand options alphabetically.
- Use `container-id` and `container-ids` consistently as argument names.
- Shorten long valueNames to avoid option column overflow in help output
where possible.
- Replace customShort and customLong with short, long, and shortAndLong
where possible.
- Always place global options and arguments after alphabetized
command-specific options.
- Rename RunCommand to ContainerRun and relocate it.
- Rename Executable to ContainerCLI.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [x] Breaking change (if you're depending on `RunCommand`, renamed).
- [ ] Documentation update
## Motivation and Context
See #385.
## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
After the large reworks, I'm not as worried about having this timeout
anymore. Prior to the reworks stop was signaled via an async event sent
to the daemon as stop was performed directly on the given runtime-helper
instance. If anything errored during that it was common for things to
explode, but now that stop is:
client -> APIServer -> runtime-helper instance
and the logic for stop has been improved quite a bit, in addition to
stop no longer holding a lock during it's operation, I'm not sure we
need this. In the future it'd also be nice to support no timeout (the
timeout until we send SIGKILL, not response timeout) in which case we'd
have to have an extra bit of logic here to skip the response timeout in
that scenario anyways.
Today if you do system stop twice (or if you forgot the server isn't
running) you get bombarded with annoying (and confusing) XPC interrupted
messages. We should skip the container stop and list dance if we can't
talk to the APIServer with a simple ping.
For the default Linux runtime plugin we shouldn't have RunAtLoad on as
it causes the process to be spawned the second we register it with
launchd. This means that for a `container create` we'll have the runtime
plugin process running afterwards. We already register a mach service
for the plugin so on the first rpc it will spawn the process anyways
which is plenty.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Plugins technically exist, but to add shortcuts or to do existing things
with functions in `container` requires calling a compiled binary. This
pull request aims to remove that hurdle and instability by exposing
commands as a new `ContainerCommands ` target.
Simply import `ContainerCommands` and you can access almost
any command as if it were a native part of the binary. This makes
plugin development significantly easier.
Closes#609.
Common subcommands for all defaults.
- Closes#384.
- Replaces `registry default` and `system dns default` subcommands with
`system property`.
- Users can use `system property ls` to see details about each supported
default value.
- `system property set` implements reasonable validation for all
properties.
- NOTE: Probing of the registry for `registry default set` was removed,
which means users will find out about a botched setting when pulling or
pushing.
- Updates docs.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [x] Breaking change
- [x] Documentation update
## Motivation and Context
See #384.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fixes https://github.com/apple/container/issues/588. This PR changes the
archiver compression file enumeration to use the
[enumerator(atPath:)](https://developer.apple.com/documentation/foundation/filemanager/enumerator(atpath:))
version. This version returns relative paths instead of full file paths
from the filesystem. /tmp is symlinked to /private/tmp and some swift
packages will handle that path differently. While a call to Foundation's
`URL.resolvingSymlinksInPath()` will return "/tmp", a call to
`FileManager.enumerator(at:)` will return "/private/tmp". This
difference causes a container image build to fail when the user is using
a path under /tmp or other special case paths as the context directory.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#615.
Improves project organization. Separates service so it can be tested and
used separately from the executable target. No functional changes.
- Closes#557.
- Breaking change: removes `.upToNextOption` for labels on volumes as
this is not what is done for containers, and it forces the argument to
precede the options if a label is supplied, which is non-intuitive.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [x] Breaking change
- [x] Documentation update
## Motivation and Context
Consistent features and UX across managed resources.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
## Type of Change
- [x] Dependency update
## Motivation and Context
A change was made in container-builder-shim to support BuildKit's
default global args
https://github.com/apple/container-builder-shim/pull/44. A new tag of
container-builder-shim was made with this change and this PR updates to
that new tag for container-builder-shim.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#547.
- Reduce DNS test count, make tests more readable.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Painful to have to unset the default domain on a dev system to pass
local integration tests.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Closes#568.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
Uninstall script will fail with an informative message if the users
doesn't run `container system stop`, but including this step in the
upgrade process reinforces the need to do this. Upgrading without
restarting the service can lead to unexpected failures due to API or
persistent data incompatibility.
## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
Users frequently saw “failed to find plugin …” when the system services
weren’t running; the message didn’t explain the root cause or where
plugins are looked up. No change to plugin execution flow; only error
messaging and path discovery hints are improved for a better UX.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Description
Correct signal semantics for plugins: Container binary currently execs
into plugin binaries. If the parent CLI keeps SIGINT/SIGTERM handlers
installed, it can intercept/alter signal behavior intended for the
plugin (e.g., preventing graceful shutdown in foreground workflows).
## Motivation and Context
During the development of a plugin (docker compose compatibility
plugin), I encountered a major issues where CTRL-C (SIGTERM) was not
being sent to my plugin. CLI plugins, especially those that have long
running tasks need a way to handle signals from the OS. Current, we exec
into plugin binaries. If the parent CLI keeps SIGINT/SIGTERM handlers
installed, it can intercept/alter signal behavior intended for the
plugin (e.g., preventing graceful shutdown in foreground workflows).
### What we changed:
- Signals handed back to plugins:
- DefaultCommand resets SIGINT/SIGTERM to defaults immediately before
exec’ing the plugin.
- Rationale: since exec replaces the process image, signals should be
delivered to (and handled by) the plugin without parent interference.
- Non‑plugin commands remain unaffected by this change.
- Compatibility: No change to plugin ABI or exec flow.
### Alternatives considered:
- Supervising child instead of exec: central forwarding of signals from
parent to plugin. Rejected for now to avoid changing process tree/stdio
semantics; resetting to defaults before exec preserves current model
while fixing signal interference.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
## Type of Change
- [x] Process update
## Description
Remove description field in PR template
## Motivation and Context
I think having separate `Description` and `Motivation and Context`
sections have been redundant in recent usage of the PR template. This PR
removes the `Description` section. Ideally the PR title should cover the
same content previously in the `Description` section.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] Bug fix
## Description
Allow kernel set with tar to use relative paths to tar file. Fixes
https://github.com/apple/container/issues/573.
## Motivation and Context
`absoluteString` will prefix a scheme to the file path that looks like
"file://". This will cause file manager to fail to find the file at the
file path even if it exists. Change to instead just get the `path` of
the file, which does not add a scheme prefix.
## Testing
- [x] Tested locally
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] New feature
## Description
Add option to force kernel setting and tests for CLI `kernel set`.
Related to https://github.com/apple/container/pull/575.
## Motivation and Context
This PR adds additional tests to ensure that we can set kernels from
local files, remote tar files, and local tar files. A new option `force`
is added to the `kernel set` subcommand which will overwrite an existing
kernel with the same name if one exists to make testing easier. The
tests ensure that a container can be started with the newly set kernel
and resets to the default recommended kernel when complete.
## Testing
- [x] Tested locally
- [x] Added/updated tests
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] Bug fix
## Description
This PR checks if the found entry in the archive for the requested
kernel path is a symlink, and if so, follows the symlink. I've opened a
separate issue to track creating tests for kernel downloading here
https://github.com/apple/container/issues/574 and will create a
follow-up PR for those.
## Motivation and Context
This PR fixes an issue reported in
https://github.com/apple/container/issues/475 where installing a kernel
from a tar archive does not follow symlinks in the archive.
## Testing
- [x] Tested locally
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] Bug fix
## Description
Resolves#565. Relative paths in type=bind mounts now resolve to
absolute paths instead of being validated as volume names. Added some
tests generated using gen AI for this scenario.
This PR improves the user experience when using the uninstall script to
include usage output when an incorrect number of options are provided to
the script.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Dmitry Kovba