- Fixes: #992
- Port validation previously rejected valid configurations
when the same port number was used for different
protocols (TCP and UDP). For example:
`-p 1024:1024/udp -p 1024:1024/tcp`
Although this is a valid and common use case, the
validation logic treated it as a conflict.
To fix this, I updated the validation key to include the protocol name.
The validation now checks for overlapping port numbers only within the
same protocol, rather than across all protocols.
This change enables binding the same port number for both TCP and UDP,
aligning the validation behavior with real-world networking
requirements.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Fixes#833.
Currently, when stopping and immediately restarting a container, it would fail with the error:
`“container expected to be in created state, got: shuttingDown”` and then be automatically deleted.
The `SandboxService` process waits five seconds before exiting after shutdown. During this interval, a rapid restart could reconnect to the still-terminating process in the `shuttingDown` state, triggering a state validation error.
This fix forcefully terminates the `SandboxService` process with `SIGKILL` upon container exit, instead of waiting five seconds. The bootstrap now defensively checks for and cleans up any stale services before registering new ones, preventing reconnections to processes in the `shuttingDown` state.
- Part of work for #460.
- Enable set/get of IPv6 network prefix in ReservedVmnetNetwork.
- Show IPv6 prefix in `network list` full output.
- Option for setting IPv6 prefix when creating a network.
- System property for default IPv6 prefix.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
See #460.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
This is a fix for
[issue#956](https://github.com/apple/container/issues/956)
`FileManager.default.contents(atPath:)` returns `nil` for named pipes
(FIFOs)
and process substitutions like `/dev/fd/XX` because:
1. It expects regular files with a known size
2. Named pipes are stream-based and block until data arrives
## Solution
Use `FileHandle(forReadingFrom:)` instead, which:
- Properly handles blocking I/O
- Works with named pipes, process substitutions, and regular files
(mentioned in the
[doc](https://developer.apple.com/documentation/foundation/filehandle))
Co-authored-by: Bortniak Volodymyr <Bortnyak@users.noreply.github.com>
- Part of work for #460.
- With CZ release 0.17.0, the IP and CIDR address
types changed from String to IPv4Address and
CIDRv4, respectively. This PR applies the corresponding
adaptations to container.
- Updates to `image prune` for consistency with how
other `prune` commands are done. Added missing
test cases as well for the command
- Relates to the discussion from #914
Fixes#949
Typically if one fd is a tty, it's common for all 3 of stdio to be the
same, but that is not always the case. In our case we were using our
Terminal type from Containerization to comb through err/out/in and give
us a type backed by one of the 3 if -t was supplied. It happens that
stderr is the first we check, so our Terminal() is backed by fd 2. This
change modifies things so that we always initialize our Terminal if
asked for with fd 0, and out/err are backed by their corresponding
correct fd number.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Refactor the `volume prune` command to follow a client-side approach.
The `volumeDiskUsage` is calculated in the service file, so it made
sense to leave that there.
- Relates to the discussion from #914
- The `ProgressBar#adjustFormattedSize` function currently expects a
decimal dot when adding the additional ".0" to the size. This, however,
breaks when a region with a non-dot decimal separator is used.
- 0.16.1 changes an ext4 superblock setting that might have been causing
problems.
- #877 fixed an issue where the cache and sync settings for block
filesystems weren't being passed down to the VZ virtual machine
configuration. The default sync value getting passed down is `full`,
which reduces I/O performance. Relax this to use `fsync` for now.
## Type of Change
- [*] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
May address problems reported in #877.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Fixes#925.
- When the API service enumerates creation dates, the configuration
value from the network helper is used instead of the persistent config
value, so the creation date winds up being the current time. The short
term fix is for the API server to return NetworkState values that
combine the API server's persistent network config with the network
status returned from the helper.
- The longer term refinement could be to define a uniform model for
resources where each resource type has Metadata (id/Identifiable,
creationDate, labels), and type-specific configuration and state/status.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
See above.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#794
- TCP port forwarding currently fails for server-first protocols (SMTP,
FTP, SSH, PostgreSQL) because the backend connection is only established
when the client sends data.
- Fixes#901.
## Type of Change
- [x] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Previously `container image prune` called `ImageStore.prune()` (renamed
to `cleanupOrphanedBlobs()` in cz 0.15.0) which only removed orphaned
content blobs and never actually removed images.
This PR fixes that behavior so `container image prune` removes dangling
images by default, and with `-a` removes all unused images, not just
dangling ones.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
Resolves a build error in Xcode:
> Build input file cannot be found: '.../CAuditToken.o'. Did you forget
to declare this file as an output of a script phase or custom build rule
which produces it?
- Closes#884.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This PR implements the `container system df` command to display disk
usage statistics for images, containers, and volumes, along with their
total count, active count, size, and reclaimable space for each resource
type.
Active resources are determined by container mount references and
running state, while reclaimable space is calculated from inactive or
stopped resources.
Example output:
```
~/container ❯ container system df
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 4 3 4.42 GB 516.5 MB (11%)
Containers 4 2 2.69 GB 1.51 GB (56%)
Local Volumes 3 2 208.5 MB 66.2 MB (32%)
```
I'll have some follow-on PRs that will add `-v/--verbose` flag for
detailed per-resource information, `--filter` flag for filtering output
by resource type, and a `--debug` flag for debug statistics like block
usage, clone counts etc.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- When a user performs an `su` the effective UID changes but the bootstrap
mach port does not, so that if container is running as `alice` from a
GUI login session, it's possible to `su bob` and continue running
container. While this doesn't pose a significant security risk as it's
necessary for Alice to know Bob's password and manually enter it with
`su`, this change closes the loophole by validating that client UID from
the caller's audit token matches that of the API server.
Closes#824
This implements statistics gathering across the various components, but
ultimately this is for implementing a new CLI command: `container
stats`. This shows memory usage, cpu usage, network and block i/o and
the number of processes in the container. The new command can inspect
stats for 1-N containers and by default continuously updates in a `top`
like stream.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Fixes#883.
Changes `BuildImageResolver` to use `fetch()` instead of `pull()`.
`fetch()` checks the cache first and only pulls if needed, preventing
incorrect progress events (e.g., "1/1 KB" metadata checks) on cached
images that caused the progress bar width calculation to produce
negative/weird padding counts, triggering "Fatal error: Negative count
not allowed" crashes during rebuilds.
- Lock-free UDP proxy forwarding by puttng front and back end on the
same thread.
- Cleans up some Swift language awkwardness in the proxies.
## Type of Change
- [ ] Bug fix
- [x] New feature (optimization)
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Proxies worked but could be made lock-free.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#710.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fetching images during builds currently show just a 0.0s timer, and no
other info making builds appear hung. This adds a realtime download
progress bar with info, when pulling base images during builds.
<img width="1133" height="640" alt="Screenshot 2025-11-04 at 2 54 33 PM"
src="https://github.com/user-attachments/assets/200d8485-a956-4ce1-bbfe-d7406bd85774"
/>
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- #859 added the traversal necessary to load the app bundle but forgot
to resolve symlinks. This fix adds the resolution, making it possible to
get default system properties from an app bundle Info.plist even if the
user invokes a command from, for example, `/usr/local/bin/container`
which is a symlink to the actual install path of the bundle.
- Also fixes bugs where an incorrect executable path was supplied in
some calls.
- Breaking change: `CommandLine.executablePathUrl` extension moved from
ContainerPlugin to ContainerVersion.
`container` automatically enables Rosetta for amd64 containers. This
change allows Rosetta to be enabled for arm64 containers by passing the
`--rosetta` flag. This allows native containers to benefit from being
able to execute the occasional amd64 executable in niche situations,
e.g., containers used for cross-compilation.
Resolves#391.
I considered adding a warning for passing `--rosetta` when it is not
necessary, but there wasn't obvious infrastructure for conveying the
- Addresses slow cross-platform builds from #68.
- The shim wasn't doing everything needed to ensure the use of Rosetta for
`container build`. The new shim adds an `--enable-qemu` option that
controls whether `buildkit-qemu-emulator-x86_64 is available; when it is
not available, buildkitd will attempt to build natively, meaning Rosetta
will execute amd64 binaries.
Currently, when `FileDownloader.downloadFile()` encounters an error
during `client.execute()` (e.g., XPC connection interruption or network
timeout), the `HTTPClient` instance is deallocated without calling
`shutdown()`, resulting in a crash:
`AsyncHTTPClient/HTTPClient.swift:187: Fatal error: Client not shut down
before the deinit.`
This caused to a control flow issue when attempting to download the
default kernel during `container system start` and, under certain
conditions (e.g., network latency), encountering the timeout error
`HTTPClientError.connectTimeout`.
To address this, `client.execute()` is now wrapped in a do/catch to
ensure `shutdown()` is always called on both success and error paths.
Also I've added an explicit timeout configuration (30s connect, no read
timeout) to better accommodate large file downloads.
- In Alpine Linux containers (commonly used as Docker base images),
standard DNS resolution is provided by **musl**, a lightweight C
standard library (libc). Musl implements DNS lookups via
`getaddrinfo()`, which queries AAAA (IPv6) records first.
- Problem: DNS did not work correctly **inside containers**. Any
system command attempting to resolve hostnames
(e.g., `ping dynamodb-admin`) **failed** when the DNS server
responded NXDOMAIN for AAAA records, even if A (IPv4) records
existed. Explicitly forcing IPv4 (`ping -4dynamodb-admin`) worked
correctly, showing the issue is specific to musl’s IPv6-first behavior.
- Consequence: In IPv4-only environments, Alpine-based containers
cannot resolve hostnames using standard tools or libraries.
Applications relying on `getaddrinfo()` fail with ENOTFOUND,
breaking networking and inter-container communication.
- Root cause: Following RFC 8305 / RFC 6724, musl treats NXDOMAIN
for AAAA as “hostname does not exist” and does not fallback to A
(IPv4) records.
- Fix: The Apple Container DNS engine now behaves as follows:
* If an **A record exists**, AAAA queries return **NOERROR with empty
answer (NODATA)**.
* If neither **A nor AAAA** exist, NXDOMAIN is returned.
This ensures that Alpine-based containers in IPv4-only networks can
correctly resolve hostnames inside containers without modifying
container images or application code.
- Closes#752.
- Currently, there is no way to specify a custom MAC address for a
container's network interface and the MAC address is auto-generated by
the system.
- Use Cases
- **Network Testing**: Developers testing network-dependent applications
that need predictable MAC addresses
- **License Management**: Running containerized software with MAC-based
license keys
- **Network Automation**: Scripts and tools that expect specific MAC
addresses for configuration
- **Debugging**: Consistent MAC addresses across container restarts for
easier troubleshooting
Kathryn Baldauf