- Closes#1517.
- Using URL for filesystem paths is bad practice. FilePath is safer and
more ergonomic.
- Sibling of #1480 (HostDNSResolver), same pattern.
This utilizes swift test `--skip-build` in combination with a single big
swift test compilation step. By doing this we reduce duplicated swift
compilation between unit and integration.
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Coverage GitHub action is taking too long, so hopefully reducing
duplicated work decreases time.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Discussion topic #1336.
- This change migrates away from using `UserDefaults`,
instead providing a TOML configuration mechanism for
user configurable settings. All existing system property
settings keys are supported in the new configuration
file. However, users will have to migrate any settings
they have configured in the `UserDefaults` into TOML
for these settings to take effect.
- Breaking changes:
* `container system property get` is removed in favor of
users directly utilizing `container system property list --format toml | jq<>`.
* `container system property set` is removed since the TOML
configuration is effectively immutable during the lifetime of the
`container` daemon. Uses can edit the TOML they have in their home
directory, however no changes will take effect until the daemon is
restarted via `container system stop && container system start`
* `container system property list --format table` is removed as
generating tabular format is non-trivial and the new TOML format is
intended to be human readable
This extends the github actions to by default run the coverage
generation targets. The targets will generate the coverage artifacts,
which will then be used by a seprate github action to comment on the PR
the coverage numbers.
This is a sanity check for testing information for new features and
refactors alike. It will allow reviewers to quickly identify if there
are major issues with new tests, or large changes to coverage percentage
that indicate a problem.
This improves the integration test suite speed by running all
integration tests in a single `swift test` invocation. We maintain the
one `@Suite` at a time behavior by introducing a new test trait that
uses a single mutex to limit inter-suite parallelism.
- Currently we need to use `pfctl` to create the packet filter rule for
container-to-host networking (`host.docker.internal`). This approach
unfortunately has a few limitations that require documentation.
- Part of #1404.
- Evolves API to use NetworkResource that conforms to ManagedResource.
- BREAKING CHANGE - compile time impact due to changes to Swift client
API signatures. No change to persistent data or API server XPC
protocols.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
`CLITest.run(arguments:stdin:currentDirectory:env:)` reads stdout to EOF
before stderr begins draining
(`Tests/CLITests/Utilities/CLITest.swift:182-183`). If a child process
writes more than a pipe-buffer's worth of data to stderr (~64 KB on
macOS), the child blocks in `write()` on stderr while we block in
`readDataToEndOfFile()` on stdout, and neither side makes progress until
`process.waitUntilExit()` returns. This is a latent deadlock that any
future test or CLI verbosity bump can trigger.
This PR drains both streams concurrently using `readabilityHandler`
closures backed by `Mutex<Data>` buffers. After
`process.waitUntilExit()` returns the handlers are cleared and
`readDataToEndOfFile()` flushes any bytes the kernel buffered between
the last handler invocation and exit. The error path also clears
handlers so a failed `process.run()` does not leak callbacks. `Mutex`
matches the locking primitive the file already uses for `commandSeq`.
Fixes#1456
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
`swift build --target CLITests` passes against the change. `make
swift-fmt-check` is clean. Behavior is unchanged for any test command
that previously fit within a single pipe buffer, so the existing
CLITests still exercise the helper end-to-end.
I did not add a new test that emits >64 KB to stderr because every
existing CLITest invocation goes through `executablePath` (the
`container` binary), and reproducing the deadlock requires a child that
emits a controllable amount on stderr. Happy to follow up with a small
refactor that extracts the drain into a static helper plus a regression
test that drives it via `/bin/sh` if that would be useful.
---------
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
- Fixes#1281. Supersedes #1306.
- When `-a` runs as a regular user (such as via
`brew install container`), two launchctl failures
bubble up as a non-zero exit and break Homebrew's
post-install:
- `bootout` against `system` requires root.
- `launchctl print` lists Mach endpoint names that
aren't loaded jobs, so `bootout` returns
`No such process` on them.
- Skip `system` when not root, and treat individual
`bootout` failures as non-fatal. Same fix applied to
the non-`-a` `xargs` pipeline.
Signed-off-by: Patrick Linnane <patrick@linnane.io>
-Resolves #1466.
- `container image push <ref>` previously produced no
standard output on success. Print the fully qualified
reference (`image.reference`) after the push completes
so callers can pipe the output into subsequent
commands.
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
- Don't prefix match localhost, use exact
match only.
- Only check default local domain if one is
defined.
- Use IPv4Address for private IP CIDR tests.
- A recent change moved the list and delete
network XPC calls within an availability check,
making them only available on macOS 26.
However, there are some code flows that rely
on being able to call `list` on the NetworksService,
including anything that uses `networkClient.builtin`.
- `container` does not officially support macOS 15
and as a result we do not have GitHub action runners
for validation on macOS 15. That said, we try to avoid
breaking compatibility on macOS 15 as much as
possible.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1450.
- If we require that bundle-packaged installs must populate a
Unix-structured `bin` and `libexec`, we don't need the code that
searches the app bundle install root. As it stands, we enumerate both
the app bundle and the Linux paths, meaning we're looking at the same
plugins (in different paths) twice.
Changes ssh socket path in container to
`/var/host-services/ssh-auth.sock` as the path `/run` (where the ssh
socket is mounted initially) is often mounted again by init systems, and
the ssh socket is hidden.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Makes ssh socket forwarding reliable.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
## Motivation and Context
This PR adds the legal attributions for the direct dependencies of
apple/container.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1439.
- May also address some cases of #1423.
- `_compressFile()` allocated a 1 MiB read buffer
per file but never freed it.
- It also treated InputStream.read() errors (-1) the
same as EOF (0), silently swallowing errors such
as TCC access denials under /Users/, which could
result in unexpected archive contents.
- Fixes single file mounts. Closes#1251.
- Adds journal modes to `EXT4.Formatter`.
- vminitd fix for client timeouts resulting in EBADF and other minor
improvements.
- Reenable block size for EXT4 formatter, and other fixes.
- Update vminit client and server to grpc-swift-2.
This changes the semantics around `ReservedVmnetNetwork` and
`AllocationOnlyVmnetNetwork` to only create ipv4/6 subnets for networks
when the values are explicitly passed in the `NetworkConfiguration`.
Previously if the values in the `NetworkConfiguration` were not present
it would attempt to source them via `DefaultsStore`.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
The change solves an issue that caused `container network create <name>`
to fail when `UserDefaults` was set to a value that is identical to the
hard coded default ("192.168.64.1/24"/"fd00::/64"). It would fail
because a network with these parameters would already exist, and thus
could not be reserved.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
This adds make targets that generate json, html, and plain text coverage
reports for unit tests, integration tests, and an aggregation of both
suites. These new targets can be run via `make coverage` (aggregate),
`make coverage-unit` (only unit tests), and `make coverage-integration`
(only integration tests).
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This provides developers a means to measure test coverage for new and
old features alike, to ensure that testing for aforementinoed features
is adequate.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#1433.
- Renames `env` parameter to `dynamicEnv` to differentiate these
special-case environment variables from the standard container
environment.
- Use `[String: String]` instead of `[String: String]?`.
- Default to `[:]` when an down-revision client calls bootstrap without
supplying `dynamicEnv`.
This PR resolves#1343.
This PR depends on apple/container-builder-shim#72.
Do not create staging directory under build context, but pass
dockerignore file bytes to the container-builder-shim.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
[Why is this change needed?]
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#874.
- Image save now fails fast with a clear error when the requested
platform is not available locally.
- The message lists the platforms that ARE available so the user
knows what they can save.
When `container stats` runs in streaming mode, pressing Ctrl+C sends
SIGINT directly to the process before Swift can run the `defer` block
responsible for restoring the terminal. This leaves the alternate screen
buffer active and the cursor hidden after exit.
Fix this by wrapping the streaming loop in a `withThrowingTaskGroup`
that races the work against an `AsyncSignalHandler` for SIGINT and
SIGTERM. When a signal arrives, the group is cancelled through normal
Swift unwinding, allowing the `defer` to execute and restore the
terminal correctly. This follows the same pattern used in
`BuildCommand`.
`runStreaming`, `collectStats`, `printStatsTable`, and `clearScreen` are
promoted to static methods since none of them read instance state, which
is required to safely capture only the `containers` value in the task
closure under Swift 6 strict concurrency.
Fixes#1351
- Closes#1308.
- Applies dependency and code changes similar to
apple/containerization#578.
- Upgrades hawkeye to latest version.
- Update StderrLogHandler not to create a (non-Sendable) Swift time
formatter object for every log message.
This PR fixes#357, passing `SSH_AUTH_SOCK` env variable from current
terminal to the `SandboxService` so that the container can mount the
correct ssh auth socket. For that, it introduces `env` parameters to
`bootstrap` RPC of both `ContainersService` and `SandboxService`. This
parameter is used only for passing `SSH_AUTH_SOCK` now, but can be
extended to pass more runtime env variables.
This PR is a follow up PR of #1214.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Container run `--ssh` was inheriting `SSH_AUTH_SOCK` env variable from
launchd, not from current terminal.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
This change migrates plugin config format away from using JSON to use
TOML.
- Addresses the plugin portion of discussion #1336
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Context within https://github.com/apple/container/discussions/1336
> We're looking to improve the user experience and overall functionality
of setting defaults for container to better enable future use cases.
>
> Today container uses macOS's
[UserDefaults](https://developer.apple.com/documentation/foundation/userdefaults)
to configure settings needed at runtime. As mentioned in
https://github.com/apple/container/issues/608, UserDefaults may be
idiomatic for macOS, but they apply globally to all sessions and do not
handle representing complex, hierarchical data well. Additionally, we
currently have two ways of setting these defaults, either directly with
macOS's defaults command or through container system property.
>
> https://github.com/apple/container/issues/608 proposes moving to use
environment variables in place of UserDefaults. However, we do not
believe this is sufficient. Environment variables are not in a
consistent location, are not sourced from data, and also do not handle
representing complex, hierarchical data well.
As part of this migration to TOML for user settings we want to also move
plugin settings to use TOML so that we can have a singular file format
for `container` configurations.
## Testing
- [X] Tested locally
- [X] Added/updated tests
- [ ] Added/updated docs
- Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- Updates `actions/upload-pages-artifact` from 4 to 5
- Updates `softprops/action-gh-release` from 2 to 3
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The `ContainerResource` target uses `OrderedDictionary` (added in #1360)
but doesn't declare a dependency on `swift-collections` in
`Package.swift`, and the source files import the `Collections` umbrella
module instead of `OrderedCollections`. This causes build failures when
`OrderedDictionary` is used in public declarations, since the compiler
requires the specific submodule to be imported in that context.
- Add `swift-collections` dependency to the `ContainerResource` target
in `Package.swift`
- Change `import Collections` to `import OrderedCollections` in
`ApplicationError.swift` and `ResourceLabels.swift`
- Adds a color progress output mode (`--progress color`)
that renders ANSI-colored progress output with visual
differentiation between progress states.
- Like `ansi` mode, this feature requires a TTY.
- Closes#1366
Chris George