`make test` occasionally fails with:
```
✘ Test testHostDNSReinitialize() recorded an issue at HostDNSResolverTest.swift:132:45: Expectation failed: (error →
Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory") as? (ContainerizationError → NSError)
✘ Suite HostDNSResolverTest failed after 0.119 seconds with 1 issue.
```
Send the hash of entire tar file in the first BuildTransfer packet to
prevent container-builder-shim from using stale cached contents.
This PR resolves#1143.
This PR relies on apple/container-builder-shim#64.
## Type of Change
- [X] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Current container-builder-shim uses only first few bytes of tar file as
checksum, which leads to the usage of stale cached contents if the
change of build context is not included in the first bytes of tar file.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
---------
Co-authored-by: Ronit Sabhaya <ronitsabhaya75@gmail.com>
Co-authored-by: J Logan <john_logan@apple.com>
Co-authored-by: saehejkang <saehej.kang@gmail.com>
Co-authored-by: Anthony DePasquale <anthony@depasquale.org>
- Bump `containerization` to `0.25.0`
- Updates for parameter changes on containerization
registry access API.
- Updates for change to containerization
`cleanUpOrphanedBlobs` function.
- Closes#1122.
- Adds placeholder ManagedResource and unit tests. Nothing is using
these yet.
- Adds system-defined resource labels for owning plugin and resource
role. The system discriminates the builtin network using role "builtin".
- Adds builtin role when creating builtin network at startup, and
ensures that a preexisting network with ID "default" gets updated with
the role label.
- Replace all network ID checks for "default" with the builtin role
check.
- Adds "builder" role to builder VM.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Role and owner labels should make cross-cutting resource policy easier
to implement.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Closes#1113.
- This is the newest we can do until we address #767.
- Slight change to PacketFilter error handling so unit tests work more
reliably.
- Try making CLINetworkTests serialized to see if parallel execution is
causing flakes.
- Refer to #862
- Updated `SIZE` field to `FULL SIZE`, as it seemed more appropriate so
it does not get mixed up with the `descriptor size` field
- Closes#860
- Fixed#892.
- By contrast with `rm`, `prune` should display
the amount of reclaimed storage, so added code
to retrieve it.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
- Closes#977.
- Closes#1058.
- Prevents unexpected removal of containers on
bootstrapping and starting failures, by reorganizing
error handling for container `run`, `start`, and
`exec` so that error handling only unwinds that
which was done in the current scope.
- Relies on apple/containerization#495.
- Closes#1037.
- Adds a `--mode` flag that has `nat` and `hostOnly` options.
The host-only option selects the vmnet host-only mode,
where containers attached to the network can reach each
other and the host, but not external systems.
- Closes#346.
- This PR enables connecting host's localhost ports from
containers.
- It adds an option `--localhost <localhost>` to DNS
create command, after which the packets heading
ip address in container are redirected to localhost in
host machine. Packet filter rule is added and deleted
along with the creation and deletion of localhost domain.
- Runner fleet is on 26.3 now.
- Integration tests started flaking and it appears that we've been misconfiguring/not configuring proxy variables where we needed to be and it finally caught up with us. Workflow now adds appropriate exclusions for host-to-container and container-to-container network requests so they aren't all rammed through the proxy.
- Update image load and build to handle rejected paths during tar
extraction. For the image load command there is now a `--force` function
that fails extractions with rejected paths when false, and just warns
about the rejected paths when true.
- Update `container stats` for statistics API properties now all being
optional.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
See above
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Closes#639.
- Adds swift format configuration that removes lint checks so we can use
`swift lint` to perform format-only tests.
- Adds `check` target that invokes format and header checks.
- Adds pre-commit script that runs `make check`.
- Adds `pre-commit` target that installs the check script as a
pre-commit hook.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
Avoids wasting time and commit rewrites.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
- TestCLIRunCommand now run so many tests concurrently that the API
server gets swamped and tests randomly time out.
- The parallelism options on `swift test` only work for XCTest, not
swift-testing.
- Work around this while retaining some parallelism (good for stress
testing) by breaking the tests into two suites.
- Adds `aarch64` as an alias for `arm64` in the `Arch` enum. This
addresses the maintainer's request to support this common architecture
name, ensuring consistency with `x86_64` normalization and preventing
failures for users expecting `aarch64` support.
- The container fails to start with a generic "permission denied"
error when attempting to publish privileged ports (ports below
1024) without root privileges. This provides a confusing user
experience as the error doesn't explain why permission was
denied.
- Closes#1005.
- Adapt everything to use MACAddress type from containerization 0.20.0.
- Allocate MAC addresses for every container so that we have
deterministic IPv6 link local addresses.
- Add AAAA handling to ContainerDNSHandler.
- NOTE: Only works on Tahoe. On Sequoia, we don't have a good way to set
or determine the IPv6 network prefix when networks are created, so we
can't infer the IPv6 link local addresses for AAAA responses and we
instead return `NODATA`.
The tests are run in parallel on CI, and were split into three tests.
They change the cwd, so it's kind of a gamble whether some of them pass.
This just moves all the logic into one test mostly.
- Closes#461.
- Extract core types into ContainerResources target.
- Extract ContainerNetworkServiceClient from ContainerNetworkService.
- Relocate sandbox client from ContainerClient to
ContainerSandboxServiceClient.
- Relocate ContainerClient to ContainerAPIServiceClient.
- Common structure from services and clients under Source/Services.
Updated project hierarchy:
```
Sources/CAuditToken - audit token access wrapper
Sources/CLI - CLI executable
Sources/ContainerBuild - builder
Sources/ContainerCommands - CLI command implementations
Sources/ContainerLog - logging helpers
Sources/ContainerPersistence - persistent data and system property helpers
Sources/ContainerPlugin - plugin system
Sources/ContainerResource - resource (container, image, volume, network) types
Sources/ContainerVersion - version helpers
Sources/ContainerXPC - XPC helpers
Sources/CVersion - injected project version
Sources/DNSServer - container DNS resolver
Sources/Helpers - service executables
Sources/Services/*/Client - service clients
Sources/Services/*/Server - service implementations
Sources/SocketForwarder - port forwarding
Sources/TerminalProgress - progress bar
```
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [x] Breaking change
- [ ] Documentation update
## Motivation and Context
The ContainerClient library was a bit of a grab bag. This refactor
applies a more sensible project and library structure for resource data
types, services, and clients.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Fixes: #992
- Port validation previously rejected valid configurations
when the same port number was used for different
protocols (TCP and UDP). For example:
`-p 1024:1024/udp -p 1024:1024/tcp`
Although this is a valid and common use case, the
validation logic treated it as a conflict.
To fix this, I updated the validation key to include the protocol name.
The validation now checks for overlapping port numbers only within the
same protocol, rather than across all protocols.
This change enables binding the same port number for both TCP and UDP,
aligning the validation behavior with real-world networking
requirements.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
This is a fix for
[issue#956](https://github.com/apple/container/issues/956)
`FileManager.default.contents(atPath:)` returns `nil` for named pipes
(FIFOs)
and process substitutions like `/dev/fd/XX` because:
1. It expects regular files with a known size
2. Named pipes are stream-based and block until data arrives
## Solution
Use `FileHandle(forReadingFrom:)` instead, which:
- Properly handles blocking I/O
- Works with named pipes, process substitutions, and regular files
(mentioned in the
[doc](https://developer.apple.com/documentation/foundation/filehandle))
Co-authored-by: Bortniak Volodymyr <Bortnyak@users.noreply.github.com>
- Fixes issue #923
- I fixed a race condition in `ConnectHandler.swift` where
an asynchronous network connection could complete
after the handler had already been removed from the
pipeline.
- This prevents the EXC_BREAKPOINT crash in
container-runtime-linux that occurred when kinc
(Kubernetes in Container) created rapid connections.
- The actual fix was inadvertently applied in #957, so this
PR contains only the test code.
- Part of work for #460.
- With CZ release 0.17.0, the IP and CIDR address
types changed from String to IPv4Address and
CIDRv4, respectively. This PR applies the corresponding
adaptations to container.
- Updates to `image prune` for consistency with how
other `prune` commands are done. Added missing
test cases as well for the command
- Relates to the discussion from #914
- Refactor the `volume prune` command to follow a client-side approach.
The `volumeDiskUsage` is calculated in the service file, so it made
sense to leave that there.
- Relates to the discussion from #914
- Fixes#943.
- Use images other than alpine:3.20 for image concurrency test so as not
to interfere with tests using that image.
- Rename test files to match suite names.
- Closes#884.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This PR implements the `container system df` command to display disk
usage statistics for images, containers, and volumes, along with their
total count, active count, size, and reclaimable space for each resource
type.
Active resources are determined by container mount references and
running state, while reclaimable space is calculated from inactive or
stopped resources.
Example output:
```
~/container ❯ container system df
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 4 3 4.42 GB 516.5 MB (11%)
Containers 4 2 2.69 GB 1.51 GB (56%)
Local Volumes 3 2 208.5 MB 66.2 MB (32%)
```
I'll have some follow-on PRs that will add `-v/--verbose` flag for
detailed per-resource information, `--filter` flag for filtering output
by resource type, and a `--debug` flag for debug statistics like block
usage, clone counts etc.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Seems `run` was changed to return a data blob variant of stdout, which
made the function have a tuple of size 4 instead of 3 now. The stats
tests still used the old 3 wide variant which broke the build.
Closes#824
This implements statistics gathering across the various components, but
ultimately this is for implementing a new CLI command: `container
stats`. This shows memory usage, cpu usage, network and block i/o and
the number of processes in the container. The new command can inspect
stats for 1-N containers and by default continuously updates in a `top`
like stream.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
ChengHao Yang