Dmitry Kovba
9319eecf14
Prevent a leak detection crash when close() fails ( #280 )
...
When an image is broken, `container-core-images` may crash with:
```
Application Specific Information:
_NIOFileSystem/SystemFileHandle.swift:131: Fatal error: Leaking file descriptor: the handle for '/Users/Dmitry/Library/Application Support/com.apple.container/content/ingest/03144D38-D98D-4833-9E0C-60229BF653D9/.tmp-MIB1oc' MUST be closed or detached with 'close()' or 'detachUnsafeFileDescriptor()' before the final reference to the handle is dropped.
Thread 9 Crashed:
0 libswiftCore.dylib 0x1adbfe110 _assertionFailure(_:_:file:line:flags:) + 176
1 container-core-images 0x105773628 closure #1 in SystemFileHandle.deinit + 424 (SystemFileHandle.swift:131)
2 container-core-images 0x10577365c partial apply for closure #1 in SystemFileHandle.deinit + 20
3 container-core-images 0x104ebd994 closure #1 in LockStorage.withLockedValue<A>(_:) + 124 (NIOLock.swift:183)
4 container-core-images 0x104ebde38 partial apply for closure #1 in LockStorage.withLockedValue<A>(_:) + 52
5 container-core-images 0x104c387fc ManagedBuffer<>.withUnsafeMutablePointers<A, B>(_:) + 152
6 container-core-images 0x104ebd8ec LockStorage.withLockedValue<A>(_:) + 172 (NIOLock.swift:180)
7 container-core-images 0x104ebe088 NIOLockedValueBox.withLockedValue<A>(_:) + 104 (NIOLockedValueBox.swift:38)
8 container-core-images 0x105773438 SystemFileHandle.deinit + 112 (SystemFileHandle.swift:128)
9 container-core-images 0x105773684 SystemFileHandle.__deallocating_deinit + 28
10 libswiftCore.dylib 0x1adaeef50 _swift_release_dealloc + 56
11 libswiftCore.dylib 0x1adaefabc bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1>>::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 152
12 container-core-images 0x104b81aac RegistryClient.fetchBlob(name:descriptor:into:progress:) + 180 (RegistryClient+Fetch.swift:200)
13 container-core-images 0x104b9f481 protocol witness for ContentClient.fetchBlob(name:descriptor:into:progress:) in conformance RegistryClient + 1
14 container-core-images 0x1049b6b29 ImageStore.ImportOperation.fetchBlob(_:) + 1 (ImageStore+Import.swift:167)
15 container-core-images 0x1049b5c6d ImageStore.ImportOperation.fetch(_:) + 1 (ImageStore+Import.swift:153)
16 container-core-images 0x1049b4f69 closure #1 in closure #1 in ImageStore.ImportOperation.fetchAll(_:) + 1 (ImageStore+Import.swift:126)
17 container-core-images 0x1049bb08d partial apply for closure #1 in closure #1 in ImageStore.ImportOperation.fetchAll(_:) + 1
18 libswift_Concurrency.dylib 0x2945e05f9 completeTaskWithClosure(swift::AsyncContext*, swift::SwiftError*) + 1
```
Replacing the `SwiftNIO` file handle with the `Foundation` file handle
resolved the crash. However, this led to a worse performance:
```
Debug version:
SwiftNIO: 1:05s
Foundation: 1:18s (1.2 times worse)
Release version:
SwiftNIO: 0:34s
Foundation: 1:00s (1.8 times worse)
```
This PR attempts to prevent the crash without switching back to the
`Foundation` file handle.
2025-09-04 23:07:11 -07:00
Dmitry Kovba
c3f5816353
Handle the same file name in the fetchBlob method ( #258 )
...
With the suggested change, when a file exists, we'll verify whether it
has the same content before skipping it.
2025-08-15 14:02:22 -04:00
Danny Canter
3cc638624f
KeychainHelper: Simplify lookup ( #214 )
2025-07-17 09:37:59 -07:00
Kathryn Baldauf
ab559752b8
Handle keychain query errors in keychain helper lookup ( #211 )
...
This allows us to handle errors from lookup with only the keychain
helper error types which simplifies the logic
related https://github.com/apple/container/pull/331
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-07-14 11:40:30 -07:00
Aditya Ramani
016c80fac0
Better parsing for www-authenticate headers ( #155 )
...
There was a bug where the `www-authenticate` header in the HTTP response
from a registry would not be parsed accurately.
Specifically, if the header value had more than one `<space>` character,
the entire header would be ignored. This PR fixes this bug and adds unit
test to detect this in the future.
Fixes https://github.com/apple/container/issues/240
And most likely fixes https://github.com/apple/container/issues/237
Signed-off-by: Aditya Ramani <a_ramani@apple.com >
2025-06-20 15:51:47 -07:00
Danny Canter
1992cfe779
Containerization: Reduce allocations for image subsystems ( #152 )
...
Continue the allocations journey for anything that is in the codepaths
for pulling images. This time there's a couple spots in archive and ext4
we can get rid of some copies.
2025-06-18 16:11:46 -07:00
Alexey Makhov
4a196b6dc2
Adds some context to fetchToken errors ( #129 )
...
Fixes https://github.com/apple/container/issues/182 and
https://github.com/apple/container/issues/183
Signed-off-by: Alexey <makhov.alex@gmail.com >
2025-06-17 08:26:46 -07:00
Danny Canter
328221e44c
ContainerizationOCI: Cut down on allocations ( #141 )
...
We were doing intermediate step copies to Data objects both for push and
pull. We only need the data for the lifetime of the singular writes to
update the state of the checksums and to write to disk somewhere, so we
can use a view into the buffer from the http client to satisfy this.
2025-06-16 22:18:36 -07:00
Dmitry Kovba
b14395515c
Fix warnings in make docs ( #139 )
...
This PR also has additional small improvements.
2025-06-16 17:22:22 -07:00
Aditya Ramani
f4177e7d67
More informative errors from RegistryClient ( #134 )
...
Also creates an `ErrorResponse` type to model the errors typically
returned by a container registry.
Reference: https://distribution.github.io/distribution/spec/api/#errors
Example error message:
```
Error: HTTP request to https://ghcr.io/token?client_id=containerization-registry-client&service=ghcr.io&scope=repository:user/image:pull failed with response: 403 Forbidden. Reason: {"errors":[{"message":"requested access to the resource is denied","code":"DENIED"}]}
```
Signed-off-by: Aditya Ramani <a_ramani@apple.com >
2025-06-16 11:07:32 -07:00
Michael Crosby
5d2d7a1bc3
update license header removing new line ( #99 )
...
Fixes #63
Signed-off-by: crosbymichael <michael_crosby@apple.com >
2025-06-12 09:57:35 -04:00
Seyed Mojtaba Hosseini Zeidabadi
27db60af22
fix: structure in createOCILayoutStructure ( #93 )
...
Both the callee and caller names have been corrected.
2025-06-11 14:51:15 -04:00
Dmitry Kovba
f245ae63b3
Improve @SendableProperty ( #91 )
...
This PR ensures that we enter a lock inside the `@SendableProperty`
implementation as soon as we access a computed property. Additionally,
it mirrors the access level of the original property. Both changes are
required for [improved
accuracy](https://github.com/apple/container/pull/144 ) of progress
updates in container. Additionally, it should resolve
https://github.com/apple/containerization/issues/60 that occurs on
certain configurations.
Please tag as 0.1.1 after merging.
2025-06-11 14:13:21 -04:00
Danny Canter
fc4a124173
Continue documenting public surface ( #25 )
...
Signed-off-by: Danny Canter <danny_canter@apple.com >
2025-06-06 10:34:19 -04:00
Aditya Ramani
c2e22192d4
Fix compiler warning in LocalOCILayoutClient ( #19 )
...
Resolves the warning
```
LocalOCILayoutClient.swift:87:37: warning: capture of non-sendable type 'T.AsyncIterator.Type' in an isolated closure
87 | for try await buffer in input {
| `- warning: capture of non-sendable type 'T.AsyncIterator.Type' in an isolated closure
88 | wrote += buffer.readableBytes
89 | try buffer.withUnsafeReadableBytes { pointer in
```
Signed-off-by: Aditya Ramani <a_ramani@apple.com >
2025-06-05 16:16:32 -07:00
Danny Canter
f49f668936
Updates to license headers ( #17 )
...
- Capitalize containerization.
- Wrap "All rights reserved" to a new line.
Signed-off-by: Danny Canter <danny_canter@apple.com >
2025-06-05 16:16:22 -07:00
Danny Canter
6bc4bf5124
Source code documentation updates ( #9 )
...
This change adds documentation to quite a few existing public types that
didn't have a blurb before.
Additionally, this fixes a couple things that I think either didn't make
sense when going to document them:
- Rename ConnectionStream to VsockConnectionStream. This type only
functions for vsock connections.
- Deletes NsLock+Closure. This was not used anywhere.
- Rename ContainerizationOCI/Config.swift to ImageConfig.swift.
Signed-off-by: Danny Canter <danny_canter@apple.com >
2025-06-05 16:16:18 -07:00
+6
3407cc3f16
initial commit
...
Co-authored-by: Aditya Ramani <a_ramani@apple.com >
Co-authored-by: Agam Dua <agam_dua@apple.com >
Co-authored-by: Danny Canter <danny_canter@apple.com >
Co-authored-by: Dmitry Kovba <dkovba@apple.com >
Co-authored-by: Eric Ernst <eric_ernst@apple.com >
Co-authored-by: Evan Hazlett <ehazlett@apple.com >
Co-authored-by: Gilbert Song <gilbertsong@apple.com >
Co-authored-by: Hugh Bussell <hbussell@apple.com >
Co-authored-by: John Logan <john_logan@apple.com >
Co-authored-by: Kathryn Baldauf <k_baldauf@apple.com >
Co-authored-by: Madhu Venugopal <mvenugopal@apple.com >
Co-authored-by: Michael Crosby <michael_crosby@apple.com >
Co-authored-by: Sidhartha Mani <sidhartha_mani@apple.com >
Co-authored-by: Tanweer Noor <tnoor@apple.com >
Co-authored-by: Ximena Perez Diaz <xperez528@gmail.com >
Co-authored-by: Yibo Zhuang <yzhuang@apple.com >
2025-06-05 16:15:21 -07:00
Dmitry Kovba