## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
- Added an index to the doc for easily accessing important sections
- Added two new main sections to help first time contributors with tips
on how to get started with issues, how to ask for help, and who to ask
for help.
- Made all headings sentence case for consistency
Closes https://github.com/apple/container/issues/880, as it was
preferred to not add a `CODEOWNERS` file, but instead add notes to where
contributors can find a list of maintainers to ping.
## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
Fixes#477
Because we start piping stdin before process launch we can fill up the
guest pipe buffer before the process even starts. We'd need some
backpressure mechanism to handle this and slow consumers (register the
other end with epoll and buffer some data etc.), but we should probably
just start piping after the process is up and running. This change does
exactly that, as well as stops holding the process mutex while draining
stdin in the guest for `CloseStdin()`.
This fixes issues where we try and write > pipe_buf bytes through stdin.
Today this hangs.
* Admit only valid OCI layout files when loading image.
- Adds `AdmissionMapper` protocol for validating archive
member paths and normalizing them to relative paths
under the extraction root directory.
- Renames `Reader.swift` to `ArchiveReader.swift` to
match type name.
- Rework `TempDir` to address `NSString.utf8String`
deprecation warning in Swift 6.2.3.
- Rework `ArchiveReader.extractContent()` to use an
`AdmissionMapper` to validate and remap archive
members before extracting.
- Adds `IdentityAdmissionWrapper` for naive extraction.
- Adds `NoSymlinkAdmissionWrapper` that only extracts
regular files and directories under the extraction root.
- Adds `OCIImageAdmissionWrapper` that only extracts
valid OCI image layout paths.
- Use `OCIImageAdmissionWrapper` for `cctl image load`
and print rejected paths.
* PR feedback.
* Adds public init() for TrustedAdmissionMapper.
* Replace AdmissionMapper with more secure extraction.
- Adds FileDescriptor.mkdirSecure() to prevent
root escapes on member pathnames, and to prevent
symlink traversal.
- Adds FileDescriptor.unlinkRecursive() to
facilitate overwrites when there are multiple
archive entries with the same member path.
- Adds FileDescriptor.validateSymlinkTargetInRoot()
to validate that extracted symlink targets do
not escape the root.
- Rewrite ArchiveReader.extractContents() to use
secure path functions.
* Remove unneeded symlink check, rename files.
* Simplify the lexical normalizer workaround.
* Reject member paths containing parent traversal components.
* Remove unused lexical normalization workaround.
* Fix leaking fds, extract absolute members as relative.
The guest agent isn't free, and today we were sizing the VMs memory
allotment and the containers cgroup to the same value. This change gives
some overhead memory to the VM (50MB for now) for the guest agent.
It's possible a user doesn't want the full stats list, and only wants
cpu/mem etc. This plumbs through the ability to filter to only what is
requested. This, while we're already here, adds in memory.event output
to the stats list. For that specifically, I think eventually we may want
a streaming variant of this so you can get alerted of changes in the
file immediately instead of polling/one off reads, but this is useful
for now.
We can't write to stderr because it may be the containers stderr, so
this is mostly dead code. We should think about how to do logging from
here as there's a couple spots it'd be nice.
- Simplifies processing and validation of MAC addresses for
apple/container#1005, where we need to create MAC addresses and
corresponding link local IPv6 addresses.
- Adds Codable for IPAddress and CIDR for apple/container#1006, so we
can parse and relay IP addresses regardless of address family for port
forwards.
Add a streaming rpc to copy single files in and out. This can easily be
extended to support copying directories, but we need the guest agent to
be able to tar/untar, and we'll need to figure out what that model is.
Closely related to https://github.com/apple/container/issues/305 I would
like to override the used SSL TrustRoots via standard env variables.
This here would add this configuration and would give an entrypoint for
an implementation of 305 to provide CLI flags or similar.
This has no tests yet, as this would require setting up something like a
MITM proxy when testing against a registry.
As I am unfamiliar with the codebase, I would be willing to do this, but
would require a first nudge on where to best implement this.
To actually use this, we would need to add the allowed env variables to
the `container system start` command env filter.
This change adds extension to the CIDR and IPAddress types to implement
custom encode/decode functions for `Codable` conformance to use their
string representation as the output from encode and input to decode.
This would make the output from encoding this type (e.g. JSON) more
human-readable rather than using the internal integer representation.
Allows decoding of minimal OCI specs with empty linux objects by
providing default values for missing fields. Also added unit test to
ensure that empty Linux struct {} works correctly with the fix.
These types can benefit from swift's automatic
synthesis as the properties already conform to Codable. This will give
some flexibility for clients using these types to not have to add
extension and implement the encoding / decoding separately.
## Summary
Upgrade GitHub Actions to their latest versions for improved features,
bug fixes, and security updates.
## Changes
| Action | Old Version(s) | New Version | Release | Files |
|--------|---------------|-------------|---------|-------|
| `actions/upload-pages-artifact` |
[`v3`](https://github.com/actions/upload-pages-artifact/releases/tag/v3)
|
[`v4`](https://github.com/actions/upload-pages-artifact/releases/tag/v4)
|
[Release](https://github.com/actions/upload-pages-artifact/releases/tag/v4)
| containerization-build-template.yml |
## Why upgrade?
Keeping GitHub Actions up to date ensures:
- **Security**: Latest security patches and fixes
- **Features**: Access to new functionality and improvements
- **Compatibility**: Better support for current GitHub features
- **Performance**: Optimizations and efficiency improvements
### Security Note
Actions that were previously pinned to commit SHAs remain pinned to SHAs
(updated to the latest release SHA) to maintain the security benefits of
immutable references.
### Testing
These changes only affect CI/CD workflow configurations and should not
impact application functionality. The workflows should be tested by
running them on a branch before merging.
If there's any nested cgroups in the one we made for the container
(commonly seen for systemd images) removeItem didn't seem to be having a
grand time, even though it states it should do recursive removals. Lets
roll our own, and have a small EBUSY/EAGAIN retry loop as well. This
fixes LinuxContainer.stop() for any containers with nested cgs.
Context: https://github.com/apple/container/issues/928
We'd like a way for people to know who they can ping for help on PRs and
issues, but we want to avoid being automatically assigned to PRs via
something like CODEOWNERS. Instead, we've opted to list the maintainers
of the project in a new MAINTAINERS file.
We opted to change from CONTRIBUTORS to MAINTAINERS since we believe
that contributors are already acknowledged via the `Contributors` tab on
GitHub and in the release notes we make for each new release.
In the future, the MAINTAINERS file can be extended to include
additional maintainers and past maintainers can continue to be
recognized for their work.
In a prior change I'd added a way for vminitd to double as a simple
pause container. This change wires this up by adding a new bool to the
pod config to ask for pid ns sharing.
Due to us supporting a pod type now, and pid ns sharing being quite a
common thing for pods, lets add a pause container like command to
vminitd to eventually enable pid ns sharing between containers in our
variant of a pod.
This changes vminitd slightly to have pause and init (default) commands
as it seemed simpler than creating a whole new binary to include in the
guest image.
Add support for parent death signal (pdeathSignal) to ensure child
processes receive a signal when the parent process dies. This addresses
the FIXME comment in Runc.execute().
## Changes
- Add pdeathSignal field to exec_command_attrs C struct
- Implement prctl(PR_SET_PDEATHSIG) in child process handler (Linux
only)
- Expose pdeathSignal through Command.Attrs Swift API
- Wire up pdeathSignal in Runc.execute() to remove FIXME
## Implementation Details
The implementation uses Linux-specific prctl() to set the parent death
signal, ensuring proper cleanup when parent processes terminate. The
feature is conditionally compiled for Linux only, maintaining
compatibility with other platforms.
Add a small bit of logic to monitor if vminitd goes over a (somewhat
arbitrary) memory threshold. On average, when running one container it
seems to hover around 25MiB, so this is mostly to catch cases where it's
exceeding a limit we don't deem normal.
Adds `calculateOrphanedBlobsSize()` to calculate the size of orphaned
blobs, will need this to include them under size and reclaimable space
for images in the `container system df` command so it matches up with
what `container image prune` frees up on disk.
- Fixes#417.
Rename `_prune()` to `cleanupOrphanedBlobs()` to clarify what it
actually does, and remove `prune()` method as we'll do all that logic in
container directly.
For the constructor we're using where we pass an already connected
socket, I'm not sure this even does anything, and if it does that's a
bug I'd rather just avoid altogether.
Also gets rid of the unused constructor we have to pass in a UDS.
J Logan