- Closes#1547.
- A negative progress value (e.g. from a race in progress events) would
produce a negative barLength and crash inside String(repeating:count:).
Wrap the computed length in max(0, ...) and add a regression test that
calls set(size: -10) and exercises draw(state:detail:).
- Closes#1581.
- This adds stop signal support to the cli. The priority is:
1. If an explicit stop signal is passed on the cli use this.
2. If not, check if there is a stop signal in the image config.
3. Finally, use the default (TERM).
- Replace `URL` with `FilePath` in `container copy` (#1557).
In addition, make `copyIn`/`copyOut` API to use `String` for path as we
need to preserve the trailing slash to the `LinuxContainer.copy`---i.e.,
this trailing slash is used in `LinuxContainer.copy` to determine copy
behavior.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
Adds the `container copy` (aliased as `cp`) command to copy files
between a running container and the local filesystem.
I saw [#1023](https://github.com/apple/container/pull/1023) and the
feedback from @dcantah — the previous attempt relied on tar being
installed inside the container.
This implementation takes the recommended approach:
file transfers go through the guest agent via the existing
`copyIn`/`copyOut` methods on the core `Containerization`, with no
dependency on container tooling.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
---------
Co-authored-by: jwhur <57657645+JaewonHur@users.noreply.github.com>
- Closes#1565.
- `runtime-config.toml` suggested the config
pertains to just the runtime (managing container
workloads) aspect of the system.
- Also renames `ADDR` columns to `IP` in
`container ls` and `container builder status`.
- Closes#1566.
- Currently on `system start` we only remove the read-only user config
if the user config file exists. This means that changes to the config
are processed properly on restart, but a removal is ignored, and the old
read-only settings linger.
- Closes#1533
- This PR aligns `volume list --format json` date
encoding with volume inspect by using ISO-8601
instead of the default numeric reference-date
format.
- This change adds two types to support opaque runtime
data passing through the APIServer:
- RuntimeConfiguration `data`
- RuntimeLinuxData type
- LinuxRuntimeData defines runtime specific information.
With this change, it will support `variant` only. The
optional RuntimeConfiguration `data` field encodes
runtime specific data to pass through the APIServer.
It is decoded as needed by the runtime.
- The idea is to eventually move all runtime specific data
into the `data` field so that the APIServer is only aware
of generic container information.
- Closes#1318.
- Closes#1378.
- Reduces the complexity and coupling for IP allocation.
- Runtimes connect to networks for the life of the running container.
The runtime shuts down on connection loss.
- Networks automatically deallocate a runtime's IP address and hostname
record on connection loss.
- Removes AllocatedAttachment as this is no longer necessary. The
`bootstrap()` XPC now takes a `NetworkBootstrapInfo` array which
parallels the attachments in the bundle config and provides the network
plugin attributes needed to create VM network interface configurations.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Simplify IP allocation and make deallocation more reliable.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- This adds support for reading configurations from
a three layer hierarchy:
1. User provided TOML
2. Install root TOML
3. Code defaults
- We add some code to support plugin configurations
via the ConfigurationLoader. Each plugin can provide
a struct with an accompanying id that gets used to
parse the scoped section of the TOML.
- Closes#1521.
- Using URL for filesystem paths is bad practice. FilePath is safer and
more ergonomic.
- Same pattern as #1480 (HostDNSResolver) and #1518 (PacketFilter).
- Part of #1318.
- Part of #1378.
- Removes network plugin `deallocate()`, and allocate takes an
`XPCServerSession` that registers an `onDisconnect` handler that
performs deallocation.
- ContainerService now tracks `networkSessions` for allocations.
- Part of #1318.
- Part of #1378.
- `RouteHandler` now accepts an additional `XPCServerSession` which
include a disconnect handler.
- `XPCServer` configures a session for each client connection and passes
it to every route handler.
- `XPCServer.route(fn:)` can be used to wrap existing route handlers
that don't care about sessions.
- `XPCClient` adds functions to support client-side session handling.
- Update all existing routes.
- Closes#1520.
- Using URL for filesystem paths is bad practice. FilePath is safer and
more ergonomic.
- Same pattern as #1480 (HostDNSResolver) and #1518 (PacketFilter).
This adds a swift Decoder that decodes from a swift-configuration
ConfigSnapshot, and adds the ability to modify how select types are
decoded within the
ConfigSnapshotDecoder. This is something that JSONEncoder already does
with URLs specifically, however this enables users to configure this
behavior for any arbitrary type regardless of existing Codable
conformance.
The decoder will help us expand on top of (pr:
https://github.com/apple/container/pull/1425), which switches user
configuration to TOML. With this PR we will be able to provide a multi
layered TOML if desired, allowing container to ship a default TOML
instead of encoding them in code constants.
- Closes#1517.
- Using URL for filesystem paths is bad practice. FilePath is safer and
more ergonomic.
- Sibling of #1480 (HostDNSResolver), same pattern.
- Discussion topic #1336.
- This change migrates away from using `UserDefaults`,
instead providing a TOML configuration mechanism for
user configurable settings. All existing system property
settings keys are supported in the new configuration
file. However, users will have to migrate any settings
they have configured in the `UserDefaults` into TOML
for these settings to take effect.
- Breaking changes:
* `container system property get` is removed in favor of
users directly utilizing `container system property list --format toml | jq<>`.
* `container system property set` is removed since the TOML
configuration is effectively immutable during the lifetime of the
`container` daemon. Uses can edit the TOML they have in their home
directory, however no changes will take effect until the daemon is
restarted via `container system stop && container system start`
* `container system property list --format table` is removed as
generating tabular format is non-trivial and the new TOML format is
intended to be human readable
- Part of #1404.
- Evolves API to use NetworkResource that conforms to ManagedResource.
- BREAKING CHANGE - compile time impact due to changes to Swift client
API signatures. No change to persistent data or API server XPC
protocols.
-Resolves #1466.
- `container image push <ref>` previously produced no
standard output on success. Print the fully qualified
reference (`image.reference`) after the push completes
so callers can pipe the output into subsequent
commands.
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
- Don't prefix match localhost, use exact
match only.
- Only check default local domain if one is
defined.
- Use IPv4Address for private IP CIDR tests.
- A recent change moved the list and delete
network XPC calls within an availability check,
making them only available on macOS 26.
However, there are some code flows that rely
on being able to call `list` on the NetworksService,
including anything that uses `networkClient.builtin`.
- `container` does not officially support macOS 15
and as a result we do not have GitHub action runners
for validation on macOS 15. That said, we try to avoid
breaking compatibility on macOS 15 as much as
possible.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1450.
- If we require that bundle-packaged installs must populate a
Unix-structured `bin` and `libexec`, we don't need the code that
searches the app bundle install root. As it stands, we enumerate both
the app bundle and the Linux paths, meaning we're looking at the same
plugins (in different paths) twice.
Changes ssh socket path in container to
`/var/host-services/ssh-auth.sock` as the path `/run` (where the ssh
socket is mounted initially) is often mounted again by init systems, and
the ssh socket is hidden.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Makes ssh socket forwarding reliable.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#1439.
- May also address some cases of #1423.
- `_compressFile()` allocated a 1 MiB read buffer
per file but never freed it.
- It also treated InputStream.read() errors (-1) the
same as EOF (0), silently swallowing errors such
as TCC access denials under /Users/, which could
result in unexpected archive contents.
This changes the semantics around `ReservedVmnetNetwork` and
`AllocationOnlyVmnetNetwork` to only create ipv4/6 subnets for networks
when the values are explicitly passed in the `NetworkConfiguration`.
Previously if the values in the `NetworkConfiguration` were not present
it would attempt to source them via `DefaultsStore`.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
The change solves an issue that caused `container network create <name>`
to fail when `UserDefaults` was set to a value that is identical to the
hard coded default ("192.168.64.1/24"/"fd00::/64"). It would fail
because a network with these parameters would already exist, and thus
could not be reserved.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#1433.
- Renames `env` parameter to `dynamicEnv` to differentiate these
special-case environment variables from the standard container
environment.
- Use `[String: String]` instead of `[String: String]?`.
- Default to `[:]` when an down-revision client calls bootstrap without
supplying `dynamicEnv`.
This PR resolves#1343.
This PR depends on apple/container-builder-shim#72.
Do not create staging directory under build context, but pass
dockerignore file bytes to the container-builder-shim.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
[Why is this change needed?]
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#874.
- Image save now fails fast with a clear error when the requested
platform is not available locally.
- The message lists the platforms that ARE available so the user
knows what they can save.
Erwan Legrand