- Fixes: #992
- Port validation previously rejected valid configurations
when the same port number was used for different
protocols (TCP and UDP). For example:
`-p 1024:1024/udp -p 1024:1024/tcp`
Although this is a valid and common use case, the
validation logic treated it as a conflict.
To fix this, I updated the validation key to include the protocol name.
The validation now checks for overlapping port numbers only within the
same protocol, rather than across all protocols.
This change enables binding the same port number for both TCP and UDP,
aligning the validation behavior with real-world networking
requirements.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
This is a fix for
[issue#956](https://github.com/apple/container/issues/956)
`FileManager.default.contents(atPath:)` returns `nil` for named pipes
(FIFOs)
and process substitutions like `/dev/fd/XX` because:
1. It expects regular files with a known size
2. Named pipes are stream-based and block until data arrives
## Solution
Use `FileHandle(forReadingFrom:)` instead, which:
- Properly handles blocking I/O
- Works with named pipes, process substitutions, and regular files
(mentioned in the
[doc](https://developer.apple.com/documentation/foundation/filehandle))
Co-authored-by: Bortniak Volodymyr <Bortnyak@users.noreply.github.com>
- Fixes issue #923
- I fixed a race condition in `ConnectHandler.swift` where
an asynchronous network connection could complete
after the handler had already been removed from the
pipeline.
- This prevents the EXC_BREAKPOINT crash in
container-runtime-linux that occurred when kinc
(Kubernetes in Container) created rapid connections.
- The actual fix was inadvertently applied in #957, so this
PR contains only the test code.
- Part of work for #460.
- With CZ release 0.17.0, the IP and CIDR address
types changed from String to IPv4Address and
CIDRv4, respectively. This PR applies the corresponding
adaptations to container.
- Updates to `image prune` for consistency with how
other `prune` commands are done. Added missing
test cases as well for the command
- Relates to the discussion from #914
- Refactor the `volume prune` command to follow a client-side approach.
The `volumeDiskUsage` is calculated in the service file, so it made
sense to leave that there.
- Relates to the discussion from #914
- Fixes#943.
- Use images other than alpine:3.20 for image concurrency test so as not
to interfere with tests using that image.
- Rename test files to match suite names.
- Closes#884.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This PR implements the `container system df` command to display disk
usage statistics for images, containers, and volumes, along with their
total count, active count, size, and reclaimable space for each resource
type.
Active resources are determined by container mount references and
running state, while reclaimable space is calculated from inactive or
stopped resources.
Example output:
```
~/container ❯ container system df
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 4 3 4.42 GB 516.5 MB (11%)
Containers 4 2 2.69 GB 1.51 GB (56%)
Local Volumes 3 2 208.5 MB 66.2 MB (32%)
```
I'll have some follow-on PRs that will add `-v/--verbose` flag for
detailed per-resource information, `--filter` flag for filtering output
by resource type, and a `--debug` flag for debug statistics like block
usage, clone counts etc.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Seems `run` was changed to return a data blob variant of stdout, which
made the function have a tuple of size 4 instead of 3 now. The stats
tests still used the old 3 wide variant which broke the build.
Closes#824
This implements statistics gathering across the various components, but
ultimately this is for implementing a new CLI command: `container
stats`. This shows memory usage, cpu usage, network and block i/o and
the number of processes in the container. The new command can inspect
stats for 1-N containers and by default continuously updates in a `top`
like stream.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
When working on test cases for #827 and #734 the following issues
occurred
1. There was no support to pass in `Data` for `stdin` (input pipe added
+ new argument for the data)
2. Pipes were getting blocked during the `try process.run()` and
`process.waitUntilExit()` (order of operations were fixed)
3. We need the binary data for directly piping the `stdout` data to
`stdin`, and converting the data to a `string`, returns `""` (added a
new value to the tuple)
I opened a new PR here for this as I did not want to bloat the other PRs
with so many updates. At first I thought of creating a new function
named `runStdinStdout`, but that seemed redundant as it pretty much was
going to do the same thing as `run`.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
---------
Co-authored-by: J Logan <john_logan@apple.com>
- In Alpine Linux containers (commonly used as Docker base images),
standard DNS resolution is provided by **musl**, a lightweight C
standard library (libc). Musl implements DNS lookups via
`getaddrinfo()`, which queries AAAA (IPv6) records first.
- Problem: DNS did not work correctly **inside containers**. Any
system command attempting to resolve hostnames
(e.g., `ping dynamodb-admin`) **failed** when the DNS server
responded NXDOMAIN for AAAA records, even if A (IPv4) records
existed. Explicitly forcing IPv4 (`ping -4dynamodb-admin`) worked
correctly, showing the issue is specific to musl’s IPv6-first behavior.
- Consequence: In IPv4-only environments, Alpine-based containers
cannot resolve hostnames using standard tools or libraries.
Applications relying on `getaddrinfo()` fail with ENOTFOUND,
breaking networking and inter-container communication.
- Root cause: Following RFC 8305 / RFC 6724, musl treats NXDOMAIN
for AAAA as “hostname does not exist” and does not fallback to A
(IPv4) records.
- Fix: The Apple Container DNS engine now behaves as follows:
* If an **A record exists**, AAAA queries return **NOERROR with empty
answer (NODATA)**.
* If neither **A nor AAAA** exist, NXDOMAIN is returned.
This ensures that Alpine-based containers in IPv4-only networks can
correctly resolve hostnames inside containers without modifying
container images or application code.
- Fixes#736.
- BuildKit returns nil ref for Dockerfiles containing only metadata
(`ENV/ARG/LABEL`) directives without filesystem operations
(`RUN/COPY/ADD`). Previously, this caused builds to fail with "no build
directives" error.
- Builder-shim 0.6.3 [fixes this](https://github.com/apple/container-builder-shim/pull/47) by
creating a minimal marker layer when ref is nil but image config is
valid, satisfying OCI manifest requirements.
- Also, added some tests for this behavior.
- Closes#752.
- Currently, there is no way to specify a custom MAC address for a
container's network interface and the MAC address is auto-generated by
the system.
- Use Cases
- **Network Testing**: Developers testing network-dependent applications
that need predictable MAC addresses
- **License Management**: Running containerized software with MAC-based
license keys
- **Network Automation**: Scripts and tools that expect specific MAC
addresses for configuration
- **Debugging**: Consistent MAC addresses across container restarts for
easier troubleshooting
Closes#782#99
If a Dockerfile can't be found in the context dir, check for the common
alternative Containerfile. This does not implement .containerignore
also, solely Containerfile for now. This also funnily enough fixes us
not checking for the Dockerfile IN the context directory.. woops.
## Type of Change
- [x] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Closes#508.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Adds a `container volume prune` command that removes volumes with no
container references and reports the amount of disk space reclaimed.
This helps users clean up unused volumes and easily reclaim disk space.
Also updates the `volume delete` documentation to clarify and highlight
how the `--all` flag works.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
Fixes#772
Today it fails in bootstrap the second go around, and we also have an
error handler that automatically cleans up the container if bootstrap
failed which is even worse. This change short circuits us first in the
cli if the state is running when we get() the container, and also adds
in a clause to bootstrap to just early return if we already have a
client.
- Closes#690.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Named volumes are now implicitly created when referenced in container
commands. So, if `myvolume` doesn't exist and you run `container run -v
myvolume:/data alpine`, it is automatically created.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
Closes#691
Any envvars that had equal signs in the value would be ommitted today.
This change brings it much more in line with docker's behavior/parser
and adds unit tests to verify this is the case.
Common subcommands for all defaults.
- Closes#384.
- Replaces `registry default` and `system dns default` subcommands with
`system property`.
- Users can use `system property ls` to see details about each supported
default value.
- `system property set` implements reasonable validation for all
properties.
- NOTE: Probing of the registry for `registry default set` was removed,
which means users will find out about a botched setting when pulling or
pushing.
- Updates docs.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [x] Breaking change
- [x] Documentation update
## Motivation and Context
See #384.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fixes https://github.com/apple/container/issues/588. This PR changes the
archiver compression file enumeration to use the
[enumerator(atPath:)](https://developer.apple.com/documentation/foundation/filemanager/enumerator(atpath:))
version. This version returns relative paths instead of full file paths
from the filesystem. /tmp is symlinked to /private/tmp and some swift
packages will handle that path differently. While a call to Foundation's
`URL.resolvingSymlinksInPath()` will return "/tmp", a call to
`FileManager.enumerator(at:)` will return "/private/tmp". This
difference causes a container image build to fail when the user is using
a path under /tmp or other special case paths as the context directory.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#557.
- Breaking change: removes `.upToNextOption` for labels on volumes as
this is not what is done for containers, and it forces the argument to
precede the options if a label is supplied, which is non-intuitive.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [x] Breaking change
- [x] Documentation update
## Motivation and Context
Consistent features and UX across managed resources.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Closes#547.
- Reduce DNS test count, make tests more readable.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Painful to have to unset the default domain on a dev system to pass
local integration tests.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Kathryn Baldauf