- Closes#752.
- Currently, there is no way to specify a custom MAC address for a
container's network interface and the MAC address is auto-generated by
the system.
- Use Cases
- **Network Testing**: Developers testing network-dependent applications
that need predictable MAC addresses
- **License Management**: Running containerized software with MAC-based
license keys
- **Network Automation**: Scripts and tools that expect specific MAC
addresses for configuration
- **Debugging**: Consistent MAC addresses across container restarts for
easier troubleshooting
- Closes#508.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Adds a `container volume prune` command that removes volumes with no
container references and reports the amount of disk space reclaimed.
This helps users clean up unused volumes and easily reclaim disk space.
Also updates the `volume delete` documentation to clarify and highlight
how the `--all` flag works.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Closes#690.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Named volumes are now implicitly created when referenced in container
commands. So, if `myvolume` doesn't exist and you run `container run -v
myvolume:/data alpine`, it is automatically created.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
Closes#691
Any envvars that had equal signs in the value would be ommitted today.
This change brings it much more in line with docker's behavior/parser
and adds unit tests to verify this is the case.
- Makes ProcessIO more generally available.
- `Application.handleProcess(processIO:process:)` becomes
`processIO.handleProcess(process:log:)`.
## Motivation and Context
This code shouldn't be in the CLI, it should be part of ContainerClient.
- Part of #515.
- Add titles to option groups for container subcommands.
- Order option groups and container subcommand options alphabetically.
- Use `container-id` and `container-ids` consistently as argument names.
- Shorten long valueNames to avoid option column overflow in help output
where possible.
- Replace customShort and customLong with short, long, and shortAndLong
where possible.
- Always place global options and arguments after alphabetized
command-specific options.
- Rename RunCommand to ContainerRun and relocate it.
- Rename Executable to ContainerCLI.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [x] Breaking change (if you're depending on `RunCommand`, renamed).
- [ ] Documentation update
## Motivation and Context
See #385.
## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
After the large reworks, I'm not as worried about having this timeout
anymore. Prior to the reworks stop was signaled via an async event sent
to the daemon as stop was performed directly on the given runtime-helper
instance. If anything errored during that it was common for things to
explode, but now that stop is:
client -> APIServer -> runtime-helper instance
and the logic for stop has been improved quite a bit, in addition to
stop no longer holding a lock during it's operation, I'm not sure we
need this. In the future it'd also be nice to support no timeout (the
timeout until we send SIGKILL, not response timeout) in which case we'd
have to have an extra bit of logic here to skip the response timeout in
that scenario anyways.
Common subcommands for all defaults.
- Closes#384.
- Replaces `registry default` and `system dns default` subcommands with
`system property`.
- Users can use `system property ls` to see details about each supported
default value.
- `system property set` implements reasonable validation for all
properties.
- NOTE: Probing of the registry for `registry default set` was removed,
which means users will find out about a botched setting when pulling or
pushing.
- Updates docs.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [x] Breaking change
- [x] Documentation update
## Motivation and Context
See #384.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fixes https://github.com/apple/container/issues/588. This PR changes the
archiver compression file enumeration to use the
[enumerator(atPath:)](https://developer.apple.com/documentation/foundation/filemanager/enumerator(atpath:))
version. This version returns relative paths instead of full file paths
from the filesystem. /tmp is symlinked to /private/tmp and some swift
packages will handle that path differently. While a call to Foundation's
`URL.resolvingSymlinksInPath()` will return "/tmp", a call to
`FileManager.enumerator(at:)` will return "/private/tmp". This
difference causes a container image build to fail when the user is using
a path under /tmp or other special case paths as the context directory.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] New feature
## Description
Add option to force kernel setting and tests for CLI `kernel set`.
Related to https://github.com/apple/container/pull/575.
## Motivation and Context
This PR adds additional tests to ensure that we can set kernels from
local files, remote tar files, and local tar files. A new option `force`
is added to the `kernel set` subcommand which will overwrite an existing
kernel with the same name if one exists to make testing easier. The
tests ensure that a container can be started with the newly set kernel
and resets to the default recommended kernel when complete.
## Testing
- [x] Tested locally
- [x] Added/updated tests
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] Bug fix
## Description
Resolves#565. Relative paths in type=bind mounts now resolve to
absolute paths instead of being validated as volume names. Added some
tests generated using gen AI for this scenario.
- Fixes#231.
- Extends #313 (@dcantah) so that all of `container create`, `container
run`, `container build`, `container image pull`, and `container image
save` accept the three options.
- `container build` now processes comma-separated lists for
`--platform`, `--arch`, and `--os`. It first checks `--platform`,
assembling the union of all platform values. If that set is non-empty,
the builder builds the values in the set. Otherwise, the set consists of
all combinations of the specified architecture and os values, finally
defaulting to `linux` and the host architecture if no options are
provided.
- All other commands work accept a single platform, preferring the
`--platform` option over `--arch` and `--os` when both are specified.
`--os` defaults to `linux`, and `--arch` defaults to the host
architecture.
- Clarify help messages and present the args in consistent order, with
platform first since it takes precedence if present.
- Deduplicate redundant platform options for `container build`.
Today force deleting (if a container is running then stop()'ing first)
is handled entirely in the cli, which is brittle. The CLI doesn't know
if the container was started with --rm so it would have to do a weird
timeout + list dance to check if the containers gone after stopping.
This change remedies this by just having the daemon take in a `force`
boolean to the delete rpc. If this is provided and the container is
running then we'll stop first, and then cleanup. We can additionally not
cleanup if --rm was provided as the daemon has the data to determine if
a container asked for autoRemove.
Add `--ssh` flag to forward the host's SSH agent socket into the
container, so we can use SSH authentication for things like cloning
private repos, and also updates the socket path every time the container
starts to handle socket path changes like reboot/re-login.
Closes#498
- Closes#150, #394.
- Introduces `AttachmentConfiguration` type so that we can add key-value
options to `--network` in the future.
- Eliminates redundant `ContainersService.Item` type.
- Since we now ensure at ContainersService that hostnames will not
conflict, the network helper IP allocator now simply provides the
existing IP if for an allocation on an existing hostname, which should
handle (in an eventually consistent way) the case where a container
fails to deallocate an IP on shutdown.
This PR defines the snapshotter protocol
```swift
///Mount a snapshot and all its previous layers
func prepare(_ snapshot: Snapshot) async throws -> Snapshot
/// Commit a snapshot, making it permanent.
func commit(_ snapshot: Snapshot) async throws -> Snapshot
/// Remove a snapshot from snapshot store
func remove(_ snapshot: Snapshot) async throws
```
It updates executors to work with this new protocol
- Sets up API server as source of truth for installation root, similarly
to what was done for the data root. `system start` establishes the
install root, setting the environment variable `CONTAINER_INSTALL_ROOT`
when launching the API server.
- The API server propagates the environment variable when launching
helpers, and returns the install root to the CLI via the health check
XPC.
- Includes several fixes for detecting plugins that use app bundle
layout.
- Part of #384.
- Rename to reflect that these are not just client defaults.
- Relocate so callers don't need the heavyweight coupling to
ContainerClient to access the type.
Closes#339.
This change adds named volume support to container, providing volume
management CLI commands - `create, delete, list and inspect`. The
implementation uses EXT4 block-based persistent storage with a new
`VolumesService` actor for thread-safe operations, integrates seamlessly
with the existing container mount system through a new `.volume`
filesystem type, and provides atomic volume operations with XPC-based
API communication. Volumes are stored in isolated directories with
configurable sizes (default 512GB) and include proper cleanup and
container usage tracking for safe deletion.
Example Usage:
```
# Create a volume
container volume create mydata
# Use volume in container
container run -v mydata:/data alpine
# List volumes
container volume list
# Inspect volume details
container volume inspect mydata
# Clean up
container volume rm mydata
```
Fixes#212
This PR:
- adds a `package func resolved()` on `ClientImage` that makes use of
the new `com.apple.containerization.index.indirect` annotation to
identify and resolve wrapper indices created by Containerization;
- replace the digest displayed in `container image list` with the one of
the resolved manifest;
- use the resolved manifest for `container image inspect` if the index
is a wrapper.
0.5.0 introduces a new way to configure the containers and execs. This
is now done all upfront at constructor time in a callback style. I'm
very happy with the config improvements, but because IO can only be
setup at constructor time this makes it so that we need to supply IO at
creation time of the VM or exec, which isn't the end of the world. All
that really changes is `boostrap()` and `createProcess()` now take in IO
instead of slightly later in `process.start()`
I want to access the different variants of an image in my app, which
information is only available in the ImageDetail. Although the function
ClientImage.details() -> ImageDetail and its return type are already
public, its properties aren’t, which prevents access to this
information.
Changed `SandboxSnapshot` initializer from `package init()` to `public
init()` to enable external package consumers to create and use
`SandboxSnapshot` instances in their custom Sandbox plugins.
The `SandboxSnapshot` is used for `container list` functionality
* Closes#148.
* Storing the default nameserver in the bundle config means that DNS
won't work if the container stops and then restarts later when the
subnet address has changed.
See discussion below for example. For multiple network interfaces in a
single container we'll want to integrate against a containerization that
includes apple/containerization#156.
The change bumps the containerization dependency to 0.2.0 and addresses
the breaking API changes.
```console
% container network
OVERVIEW: Manage container networks
USAGE: container network <subcommand>
OPTIONS:
--version Show the version.
-h, --help Show help information.
SUBCOMMANDS:
create Create a new network
delete, rm Delete one or more networks
list, ls List networks
inspect Display information about one or more networks
See 'container help network <subcommand>' for detailed help.
```
This PR resolves a race condition when removing a container immediately
after stopping it, caused by the `stop` command returning before the
container fully transitions to the stopped state (#130).
**Changes:**
- Enhanced `TestCLIRmRace.swift` with robust test logic and helper
methods (`containerExists`, `safeRemove`).
- Improved error handling to distinguish race conditions from successful
removals.
- Added exponential backoff retry logic for cleanup operations.
- Updated `CLITest.swift` with missing `doRemove` method.
- Fixed `BuilderStart.swift` to handle `.stopping` case.
- Improved error messages with container ID for better debugging.
**Testing:**
- ✅ All tests pass (`make test`, `make integration`).
- ✅ Verified on macOS 26.
- ✅ Race condition test validates success and failure scenarios.
- ✅ Code formatted (`make fmt`).
Hopefully, this will pass the integration tests on GitHub.
Signed-off-by: ramsyana <47033578+ramsyana@users.noreply.github.com>
This PR updates the protos to match the recent changes in
https://github.com/apple/container-builder-shim/pull/15.
This PR additionally adds the builder shim version as a variable in
Package.swift. This allows us to be consistent with the builder tag used
for the builder shim image and when building protobuf files.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Saehej Kang