After the container is stopped it's a bit odd how we don't allow the
object to be restarted. If someone wanted to continuously rerun the same
container they'd need to make a new object every time even though all
guest state is blown away on stop() so it's a clean slate.
This change makes it so that you can create+start again after stop
(although create stands out like a sore thumb now as stop -> create is
just strange).
A ContainerManager is a type that handles more of the required resource
needed to create and run a container.
---------
Signed-off-by: crosbymichael <michael_crosby@apple.com>
This is a fairly large reworking, but it gets rid of something that has
plagued this since release which is the properties needing to be locked
to be Sendable compliant. This was somewhat of a copout because we
mostly know there's not a great deal of ways to have misused the setup
today, but alas we'd need to either mark the type as `@unchecked` or
just find a different route for setting the configuration. This change:
Exposes the underlying Configuration type that today only housed things
that aren't on the OCI spec. I'd love to just expose the OCI spec, but
we don't (and possibly never will) support everything on the spec, so
exposing it to be freely modified would be a bit odd. Now everything
related to the container is configured on this type, and the same goes
for execs.
Closes#206
Much like we have support for supplying DNS configurations and writing
out /etc/resolv.conf, this adds a way to write out /etc/hosts for a
given container.
This allows the user the ability to raise an EOF for the containers
stdin. Today there's no way to close stdin so something as simple as
"cat" and relying on EOF to move the process forward doesn't work
Creates a new Unpacker protocol that defines a single method
```
func unpack(_ image: Image, for platform: Platform, at path: URL, progress: ProgressHandler?) async throws -> Mount
```
This change also removes the `unpack(...)` method from the Image type.
Before
```
let mount = try await image.unpack(for: platform, at: path)
```
After
```
let unpacker = EXT4Unpacker(blockSizeInBytes: 2.gib())
let mount = try await unpacker.unpack(image, for: platform, at: path)
```
---------
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Make sure we always set TERM for containers that ask for a tty. Right
now this handling was spread around in a bunch of spots, but I'd wager
setting it for the client on the host via LinuxContainer/Process is more
sane and already what we do for a lot of the other fields.
## Summary
The vminitd service was using `process.env.contains("HOME")` which
checks for exact string match rather than environment variables starting
with "HOME=".
Since environment variables are stored as `"KEY=value"` strings, the
condition was always false, causing vminitd to always override custom
HOME values even when explicitly provided by the client.
## Changes
- Updates the logic in `vminitd/Sources/vminitd/Server+GRPC.swift` to
use `contains(where: { $0.hasPrefix("HOME=") })` to properly detect
existing HOME environment variables
- Adds regression test `testProcessCustomHomeEnvvar()` to verify that
custom HOME environment variables are preserved when provided by the
client
## Testing
The fix has been tested with the new integration test that:
- Sets a custom HOME environment variable (`HOME=/tmp/custom/home`)
- Runs a shell command that outputs the HOME variable on the container
runtime
- Verifies the custom HOME value is preserved and not overwritten with
the default
## Environment
- macOS: 26.0 (25A5279m)
- Hardware: M4 Pro
- Xcode: 26 beta
- Swift: 6.2-dev
Fixes#135
This change adds a new private method `waitIoComplete` on the
`LinuxProcess` type.
This method is called internally when the user calls `wait` for a
process - and it tries to give the IO streams some time to clear their
buffers.
Internally, this method sets up an `AsyncStream` down which an item is
sent when the vsock connection for either stdout/stderr is terminated.
We get this termination signal when the readability handler for the
associated fd fires with a no available data.
Inside the guest - once we are done relaying the IO from the process
into the socket connection, we close the socket fd which triggers the
above.
All this logic is wrapped around a timeout of 3 seconds, just to ensure
the method does not block forever.
---------
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Fixes#103 (and should fix
https://github.com/apple/container/issues/108)
Today we only parse if the username field of the runtime spec is set,
but this misses if someone just supplied the integer uid and gid fields
only.
When we were testing the repo, we added authentication to most of the
registry tests so that we could access private images. Now that the
images are public, this PR removes the use of REGISTRY_TOKEN and
REGISTRY_USERNAME in tests that no longer require authenticating.
Note: REGISTRY_TOKEN, REGISTRY_USERNAME, and REGISTRY_HOST are still
required in the CI to push images and for a few registry tests. So the
env variables are not completely removed. The variables are only used in
the test tool cctl and in our swift tests.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Fixes#85
The virtualization bool on LinuxContainer mostly just forwards to
VZVirtualMachineInstance which today would silently take your boolean
and do nothing if the underlying platform doesn't have support for it.
This is (to me) arguably worse than erroring, as it gives the client a
false security that the setting is on, and they should have virt
capabilities in the container/guest now.
This change makes it so that we throw a ContainerizationError for this
case, with a code of .unsupported so it's checkable by a user if they
want more information on the "why".
Danny Canter