- Fixes#925.
- When the API service enumerates creation dates, the configuration
value from the network helper is used instead of the persistent config
value, so the creation date winds up being the current time. The short
term fix is for the API server to return NetworkState values that
combine the API server's persistent network config with the network
status returned from the helper.
- The longer term refinement could be to define a uniform model for
resources where each resource type has Metadata (id/Identifiable,
creationDate, labels), and type-specific configuration and state/status.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
See above.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#794
- TCP port forwarding currently fails for server-first protocols (SMTP,
FTP, SSH, PostgreSQL) because the backend connection is only established
when the client sends data.
- Fixes#901.
## Type of Change
- [x] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Previously `container image prune` called `ImageStore.prune()` (renamed
to `cleanupOrphanedBlobs()` in cz 0.15.0) which only removed orphaned
content blobs and never actually removed images.
This PR fixes that behavior so `container image prune` removes dangling
images by default, and with `-a` removes all unused images, not just
dangling ones.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
Resolves a build error in Xcode:
> Build input file cannot be found: '.../CAuditToken.o'. Did you forget
to declare this file as an output of a script phase or custom build rule
which produces it?
- Closes#884.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This PR implements the `container system df` command to display disk
usage statistics for images, containers, and volumes, along with their
total count, active count, size, and reclaimable space for each resource
type.
Active resources are determined by container mount references and
running state, while reclaimable space is calculated from inactive or
stopped resources.
Example output:
```
~/container ❯ container system df
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 4 3 4.42 GB 516.5 MB (11%)
Containers 4 2 2.69 GB 1.51 GB (56%)
Local Volumes 3 2 208.5 MB 66.2 MB (32%)
```
I'll have some follow-on PRs that will add `-v/--verbose` flag for
detailed per-resource information, `--filter` flag for filtering output
by resource type, and a `--debug` flag for debug statistics like block
usage, clone counts etc.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- This can basically Help teams know what changes are made in pr
- Added the split approach @katiewasnothere suggested using openssf
- Added additional feature for colors
- Currently this is for CLI only later we can add multiple
- Labeling flow
- TRIGGER: Pull Request Opened (untrusted code)
- READ-ONLY stage: just save job number to artifact
- WRITE: load job number artifact, use GH labeler
action with `labeler.yml` from repo
- When a user performs an `su` the effective UID changes but the bootstrap
mach port does not, so that if container is running as `alice` from a
GUI login session, it's possible to `su bob` and continue running
container. While this doesn't pose a significant security risk as it's
necessary for Alice to know Bob's password and manually enter it with
`su`, this change closes the loophole by validating that client UID from
the caller's audit token matches that of the API server.
Seems `run` was changed to return a data blob variant of stdout, which
made the function have a tuple of size 4 instead of 3 now. The stats
tests still used the old 3 wide variant which broke the build.
Closes#824
This implements statistics gathering across the various components, but
ultimately this is for implementing a new CLI command: `container
stats`. This shows memory usage, cpu usage, network and block i/o and
the number of processes in the container. The new command can inspect
stats for 1-N containers and by default continuously updates in a `top`
like stream.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Fixes#883.
Changes `BuildImageResolver` to use `fetch()` instead of `pull()`.
`fetch()` checks the cache first and only pulls if needed, preventing
incorrect progress events (e.g., "1/1 KB" metadata checks) on cached
images that caused the progress bar width calculation to produce
negative/weird padding counts, triggering "Fatal error: Negative count
not allowed" crashes during rebuilds.
When working on test cases for #827 and #734 the following issues
occurred
1. There was no support to pass in `Data` for `stdin` (input pipe added
+ new argument for the data)
2. Pipes were getting blocked during the `try process.run()` and
`process.waitUntilExit()` (order of operations were fixed)
3. We need the binary data for directly piping the `stdout` data to
`stdin`, and converting the data to a `string`, returns `""` (added a
new value to the tuple)
I opened a new PR here for this as I did not want to bloat the other PRs
with so many updates. At first I thought of creating a new function
named `runStdinStdout`, but that seemed redundant as it pretty much was
going to do the same thing as `run`.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
---------
Co-authored-by: J Logan <john_logan@apple.com>
- Lock-free UDP proxy forwarding by puttng front and back end on the
same thread.
- Cleans up some Swift language awkwardness in the proxies.
## Type of Change
- [ ] Bug fix
- [x] New feature (optimization)
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Proxies worked but could be made lock-free.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- Closes#710.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Fetching images during builds currently show just a 0.0s timer, and no
other info making builds appear hung. This adds a realtime download
progress bar with info, when pulling base images during builds.
<img width="1133" height="640" alt="Screenshot 2025-11-04 at 2 54 33 PM"
src="https://github.com/user-attachments/assets/200d8485-a956-4ce1-bbfe-d7406bd85774"
/>
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
- #859 added the traversal necessary to load the app bundle but forgot
to resolve symlinks. This fix adds the resolution, making it possible to
get default system properties from an app bundle Info.plist even if the
user invokes a command from, for example, `/usr/local/bin/container`
which is a symlink to the actual install path of the bundle.
- Also fixes bugs where an incorrect executable path was supplied in
some calls.
- Breaking change: `CommandLine.executablePathUrl` extension moved from
ContainerPlugin to ContainerVersion.
`container` automatically enables Rosetta for amd64 containers. This
change allows Rosetta to be enabled for arm64 containers by passing the
`--rosetta` flag. This allows native containers to benefit from being
able to execute the occasional amd64 executable in niche situations,
e.g., containers used for cross-compilation.
Resolves#391.
I considered adding a warning for passing `--rosetta` when it is not
necessary, but there wasn't obvious infrastructure for conveying the
- Addresses slow cross-platform builds from #68.
- The shim wasn't doing everything needed to ensure the use of Rosetta for
`container build`. The new shim adds an `--enable-qemu` option that
controls whether `buildkit-qemu-emulator-x86_64 is available; when it is
not available, buildkitd will attempt to build natively, meaning Rosetta
will execute amd64 binaries.
Currently, when `FileDownloader.downloadFile()` encounters an error
during `client.execute()` (e.g., XPC connection interruption or network
timeout), the `HTTPClient` instance is deallocated without calling
`shutdown()`, resulting in a crash:
`AsyncHTTPClient/HTTPClient.swift:187: Fatal error: Client not shut down
before the deinit.`
This caused to a control flow issue when attempting to download the
default kernel during `container system start` and, under certain
conditions (e.g., network latency), encountering the timeout error
`HTTPClientError.connectTimeout`.
To address this, `client.execute()` is now wrapped in a do/catch to
ensure `shutdown()` is always called on both success and error paths.
Also I've added an explicit timeout configuration (30s connect, no read
timeout) to better accommodate large file downloads.
- In Alpine Linux containers (commonly used as Docker base images),
standard DNS resolution is provided by **musl**, a lightweight C
standard library (libc). Musl implements DNS lookups via
`getaddrinfo()`, which queries AAAA (IPv6) records first.
- Problem: DNS did not work correctly **inside containers**. Any
system command attempting to resolve hostnames
(e.g., `ping dynamodb-admin`) **failed** when the DNS server
responded NXDOMAIN for AAAA records, even if A (IPv4) records
existed. Explicitly forcing IPv4 (`ping -4dynamodb-admin`) worked
correctly, showing the issue is specific to musl’s IPv6-first behavior.
- Consequence: In IPv4-only environments, Alpine-based containers
cannot resolve hostnames using standard tools or libraries.
Applications relying on `getaddrinfo()` fail with ENOTFOUND,
breaking networking and inter-container communication.
- Root cause: Following RFC 8305 / RFC 6724, musl treats NXDOMAIN
for AAAA as “hostname does not exist” and does not fallback to A
(IPv4) records.
- Fix: The Apple Container DNS engine now behaves as follows:
* If an **A record exists**, AAAA queries return **NOERROR with empty
answer (NODATA)**.
* If neither **A nor AAAA** exist, NXDOMAIN is returned.
This ensures that Alpine-based containers in IPv4-only networks can
correctly resolve hostnames inside containers without modifying
container images or application code.
- Fixes#736.
- BuildKit returns nil ref for Dockerfiles containing only metadata
(`ENV/ARG/LABEL`) directives without filesystem operations
(`RUN/COPY/ADD`). Previously, this caused builds to fail with "no build
directives" error.
- Builder-shim 0.6.3 [fixes this](https://github.com/apple/container-builder-shim/pull/47) by
creating a minimal marker layer when ref is nil but image config is
valid, satisfying OCI manifest requirements.
- Also, added some tests for this behavior.
- Closes#752.
- Currently, there is no way to specify a custom MAC address for a
container's network interface and the MAC address is auto-generated by
the system.
- Use Cases
- **Network Testing**: Developers testing network-dependent applications
that need predictable MAC addresses
- **License Management**: Running containerized software with MAC-based
license keys
- **Network Automation**: Scripts and tools that expect specific MAC
addresses for configuration
- **Debugging**: Consistent MAC addresses across container restarts for
easier troubleshooting
Closes#782#99
If a Dockerfile can't be found in the context dir, check for the common
alternative Containerfile. This does not implement .containerignore
also, solely Containerfile for now. This also funnily enough fixes us
not checking for the Dockerfile IN the context directory.. woops.
## Type of Change
- [x] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
Santosh Bhavani