This PR resolves#1343.
This PR depends on apple/container-builder-shim#72.
Do not create staging directory under build context, but pass
dockerignore file bytes to the container-builder-shim.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
[Why is this change needed?]
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#874.
- Image save now fails fast with a clear error when the requested
platform is not available locally.
- The message lists the platforms that ARE available so the user
knows what they can save.
When `container stats` runs in streaming mode, pressing Ctrl+C sends
SIGINT directly to the process before Swift can run the `defer` block
responsible for restoring the terminal. This leaves the alternate screen
buffer active and the cursor hidden after exit.
Fix this by wrapping the streaming loop in a `withThrowingTaskGroup`
that races the work against an `AsyncSignalHandler` for SIGINT and
SIGTERM. When a signal arrives, the group is cancelled through normal
Swift unwinding, allowing the `defer` to execute and restore the
terminal correctly. This follows the same pattern used in
`BuildCommand`.
`runStreaming`, `collectStats`, `printStatsTable`, and `clearScreen` are
promoted to static methods since none of them read instance state, which
is required to safely capture only the `containers` value in the task
closure under Swift 6 strict concurrency.
Fixes#1351
- Closes#1308.
- Applies dependency and code changes similar to
apple/containerization#578.
- Upgrades hawkeye to latest version.
- Update StderrLogHandler not to create a (non-Sendable) Swift time
formatter object for every log message.
This PR fixes#357, passing `SSH_AUTH_SOCK` env variable from current
terminal to the `SandboxService` so that the container can mount the
correct ssh auth socket. For that, it introduces `env` parameters to
`bootstrap` RPC of both `ContainersService` and `SandboxService`. This
parameter is used only for passing `SSH_AUTH_SOCK` now, but can be
extended to pass more runtime env variables.
This PR is a follow up PR of #1214.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Container run `--ssh` was inheriting `SSH_AUTH_SOCK` env variable from
launchd, not from current terminal.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
This change migrates plugin config format away from using JSON to use
TOML.
- Addresses the plugin portion of discussion #1336
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Context within https://github.com/apple/container/discussions/1336
> We're looking to improve the user experience and overall functionality
of setting defaults for container to better enable future use cases.
>
> Today container uses macOS's
[UserDefaults](https://developer.apple.com/documentation/foundation/userdefaults)
to configure settings needed at runtime. As mentioned in
https://github.com/apple/container/issues/608, UserDefaults may be
idiomatic for macOS, but they apply globally to all sessions and do not
handle representing complex, hierarchical data well. Additionally, we
currently have two ways of setting these defaults, either directly with
macOS's defaults command or through container system property.
>
> https://github.com/apple/container/issues/608 proposes moving to use
environment variables in place of UserDefaults. However, we do not
believe this is sufficient. Environment variables are not in a
consistent location, are not sourced from data, and also do not handle
representing complex, hierarchical data well.
As part of this migration to TOML for user settings we want to also move
plugin settings to use TOML so that we can have a singular file format
for `container` configurations.
## Testing
- [X] Tested locally
- [X] Added/updated tests
- [ ] Added/updated docs
- Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- Updates `actions/upload-pages-artifact` from 4 to 5
- Updates `softprops/action-gh-release` from 2 to 3
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The `ContainerResource` target uses `OrderedDictionary` (added in #1360)
but doesn't declare a dependency on `swift-collections` in
`Package.swift`, and the source files import the `Collections` umbrella
module instead of `OrderedCollections`. This causes build failures when
`OrderedDictionary` is used in public declarations, since the compiler
requires the specific submodule to be imported in that context.
- Add `swift-collections` dependency to the `ContainerResource` target
in `Package.swift`
- Change `import Collections` to `import OrderedCollections` in
`ApplicationError.swift` and `ResourceLabels.swift`
- Adds a color progress output mode (`--progress color`)
that renders ANSI-colored progress output with visual
differentiation between progress states.
- Like `ansi` mode, this feature requires a TTY.
- Closes#1366
- Part of #1404.
- COMPATIBILITY: Breaking change to client API. XPC protocol and
persistent data remain fully compatibile.
- Renames `ClientNetwork` to `NetworkClient`, aligning with
`ContainerClient`.
- Client uses instance methods instead of utility functions, with an
`init(serviceIdentifier:)` for the XPC service name. The value is
currently unused.
Closes#1352
Containerization has had support for a bit, it was just never brought
over here. It's exposed on the CLI via the classic `--cap-add` and
`--cap-drop` UX.
- Closes#1359.
- Create a ResourceLabels type and extract the label validation from
NetworkConfiguration into the new type.
- Create a base AppError type that is compatible with structured logging
and delegates message presentation to the error receiver.
- Define LabelError over AppError for label validation.
- Slightly reworks NetworkConfiguration entity migration code in
NetworksService.
## Motivation and Context
This PR just simplifies some of the ExitWaiter helper functions on
SandboxService by moving the exitStatus check into the ExitWaiter class
itself.
## Testing
- [x] Tested locally
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Motivation and Context
This PR consolidates duplicated list-output formatting across the CLI
into shared rendering infrastructure.
Currently, each list command has its own copy of the same
json/quiet/table branching. This PR pulls that into shared rendering
infrastructure in `ContainerCommands`:
- `ListDisplayable` protocol for table + quiet output
- `renderJSON`, `renderTable`, `renderList` as pure functions that
return strings
- `emit()` as the single stdout boundary (no-ops on empty strings to
avoid blank-line regressions)
- `JSONOptions` so all JSON encoding goes through one path, including
volume inspect's pretty + ISO 8601 case
JSON encoding remains separate from display formatting: each command
still chooses its own JSON model, while `ListDisplayable` is used only
for table and quiet output. `ImageList` remains the intentional
exception for quiet mode so it can avoid unnecessary async work.
This change also replaces inline `JSONEncoder` usage with `renderJSON`,
removes the old `Codable+JSON.swift` helper, and moves `TableOutput` and
`ListFormat` into `ContainerCommands`. It also adds unit tests for the
shared rendering helpers and expands integration coverage for image,
network, and registry list formatting.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Closes#387.
- Override the swift-argument-parser `help` command
with a version that prints the reformatted help that
includes plugin information.
---------
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
`container stop` has an option `-t` for `Seconds to wait before killing
the containers` (see
[here](https://github.com/apple/container/blob/ce7736105747f48debb37ca1999b562b4bfae23c/Sources/ContainerCommands/Container/ContainerStop.swift#L39)).
This timeout is used to determine when the SandboxService should stop
waiting for the container to gracefully exit with `SIGTERM` (or another
provided signal) and send `SIGKILL`.
Today, we were setting the `SandboxService.stop` XPC call's timeout to
the value provided to `container stop -t` plus 1 second. This is
problematic in cases where the code flow to send SIGKILL to the
container then forcefully stop the VM does not complete within one
second of the SIGTERM timeout being hit. In those cases, we will return
that the XPC stop call failed due to hitting the timeout. In some cases
this may happen even though the container and VM have both been
successfully stopped.
This PR removes that XPC timeout for `SandboxService.stop` entirely. We
cannot reliably determine in the SandboxClient, which may be used by
third party runtime plugins to support additional container runtimes,
how long it may take for SIGKILL to kill the container and stop related
resources.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Clarified the `.plain` progress contract. This also
documents how `clearOnFinish` interacts with plain
output. Added test coverage for the current behavior.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
Adding help guide to bug report template to make it easier for users to
include relevant information
## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
- Adds a `plain` progress output mode (`--progress plain`)
that outputs newline-separated progress lines without
ANSI escape sequences. This is useful for CI environments,
piped output, and non-TTY contexts where ANSI cursor
control is not supported. Unlike `--progress ansi`, plain
mode works even when stderr is not a TTY.
- Closes#1365
- Related: #641, #808
Bumps the github-actions group with 2 updates:
- Updates `actions/configure-pages` from 5 to 6
- Updates `actions/deploy-pages` from 4 to 5
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Nothing uses this function, and it does not perform secure extraction.
Clients should instead use the `ArchiveReader` from the
ContainerizationArchive library.
- TestCLIStatus isn't in the integration test.
- Update the output to align with the current output.
- Follow up #1193
---------
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
- Closes#656.
- The SandboxService automatically sets the DNS server as part of
bootstrap if no server is given. Setting it in the container config
means that the builder will fail if the system restarts and the network
subnet changes.
- Part of #1295.
- Needed for #1342.
- If APP_ROOT is defined, remove everything but kernel from data
directory before starting integration test.
- Adds `--enable-kernel-install` for system start on integration test.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fixes#1354.
When `container build` completes the build phase, it enters an unpack
phase that runs outside the `withThrowingTaskGroup` containing the
signal handler. As a result, pressing Ctrl+C during unpacking has no
effect — the SIGINT is never caught and the process keeps running until
the unpack finishes.
Fix this by moving the unpack phase inside the existing build task, so
both build and unpack run within the same task group that hosts the
`AsyncSignalHandler`. The `Task.checkCancellation()` calls already
present in the unpack loop will now fire correctly when a signal is
received.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
This PR adds a feature passing resource directory for the plugins.
When a `resources` directory is detected under the plugin's
`installURL`, the path to `resources` directory is passed as an argument
(i.e., `--resources <path>`) to the plugin `start`.
Resource files are distributed and installed together with the
`container` binary.
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Plugin developers can convey resource files (e.g., shell scripts) under
the `resources` directory.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Build fails with:
> - note: closure captures reference to mutable var 'self' which is
accessible to code in the current task
> - error: passing closure as a 'sending' parameter risks causing data
races between code in the current task and concurrent execution of the
closure [#SendingClosureRisksDataRace]
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
Same as we'd done with kill.
```
➜ container git:(stop-kill-throw-error) ✗ ./bin/container stop foo bar baz
Warning! Running debug build. Performance may be degraded.
Error: internalError: "failed to stop container" (cause: "notFound: "container with ID baz not found"")
internalError: "failed to stop container" (cause: "notFound: "container with ID bar not found"")
internalError: "failed to stop container" (cause: "notFound: "container with ID foo not found"")
➜ container git:(stop-kill-throw-error) ✗ ./bin/container kill foo bar baz
Warning! Running debug build. Performance may be degraded.
Error: internalError: "failed to kill container" (cause: "notFound: "container with ID foo not found"")
internalError: "failed to kill container" (cause: "notFound: "container with ID bar not found"")
internalError: "failed to kill container" (cause: "notFound: "container with ID baz not found"")
➜ container git:(stop-kill-throw-error) ✗ ./bin/container delete foo bar baz
Warning! Running debug build. Performance may be degraded.
Error: internalError: "failed to delete container" (cause: "notFound: "container with ID foo not found"")
internalError: "failed to delete container" (cause: "notFound: "container with ID baz not found"")
internalError: "failed to delete container" (cause: "notFound: "container with ID bar not found"")
```
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
`TestCLIVersion` isn't in the integration test; we should include this.
And update the output to align with the real output.
Follow up #911
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
---------
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
- Closes#1268.
- The types we were using weren't very usable with Swift 6 structured
concurrency.
- Implements just the subset of records that we use.
- Use notImplemented instead of formatError for unknown record types.
- Use pure actor for LocalhostDNSHandler now that we have sendable
types.
- Use DNSName as key for table lookups in LocalhostDNSHandler and
HostTableResolver.
- Utilize dot-suffixed domain names everywhere in the lookup chain.
- Huge thanks to @manojmahapatra and @katiewasnothere for their
diligent and patient review :D
This PR adds an option in `ContainerCreateOption` to override the root
filesystem of container. When `ContainerCreateOption.rootFsOverride` is
set, container uses that as the root fs instead of the one cloned from
image snapshot.
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
[Why is this change needed?]
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
This reverts commit 50900938c4, restoring
the grpc-swift-1 based builder API while preserving build secrets and
hidden docker dir support added in a00ec5c.
Signed-off-by: Eric Ernst <eric_ernst@apple.com>
## Type of Change
- [x] Bug fix
- [ ] New feature
- [x] Breaking change
- [ ] Documentation update
## Motivation and Context
Adds backward-compatible JSON decoding/encoding fallback for
`Attachment` and `NetworkStatus` to prevent `keyNotFound` errors when
communicating with older `container-apiserver` versions.
Temporary fix but closes#1196
## Testing
Tests ✅ based on comment
[here](https://github.com/apple/container/issues/1196#issuecomment-3902754548)
---------
Co-authored-by: Ed Saipetch <ed@twentybelow.com>
J Logan