- Fixes#231.
- Extends #313 (@dcantah) so that all of `container create`, `container
run`, `container build`, `container image pull`, and `container image
save` accept the three options.
- `container build` now processes comma-separated lists for
`--platform`, `--arch`, and `--os`. It first checks `--platform`,
assembling the union of all platform values. If that set is non-empty,
the builder builds the values in the set. Otherwise, the set consists of
all combinations of the specified architecture and os values, finally
defaulting to `linux` and the host architecture if no options are
provided.
- All other commands work accept a single platform, preferring the
`--platform` option over `--arch` and `--os` when both are specified.
`--os` defaults to `linux`, and `--arch` defaults to the host
architecture.
- Clarify help messages and present the args in consistent order, with
platform first since it takes precedence if present.
- Deduplicate redundant platform options for `container build`.
I'm not sure why we had these going to OSLog, but I'd wager they're a
bit more useful being displayed directly to the user during the command
they're running.
Today force deleting (if a container is running then stop()'ing first)
is handled entirely in the cli, which is brittle. The CLI doesn't know
if the container was started with --rm so it would have to do a weird
timeout + list dance to check if the containers gone after stopping.
This change remedies this by just having the daemon take in a `force`
boolean to the delete rpc. If this is provided and the container is
running then we'll stop first, and then cleanup. We can additionally not
cleanup if --rm was provided as the daemon has the data to determine if
a container asked for autoRemove.
- This helps with brew cask packaging, can postflight link
libexec/container/plugins to the appropriate cask location, and the
plugin discovery will traverse the link.
This PR fixes SSH forwarding for exec processes.
Currently, only init processes received the `SSH_AUTH_SOCK` environment
variable when using `--ssh` flag. Exec processes didn't have access to
the SSH agent socket, even though the socket was mounted.
Now we set environment variable for exec processes to match init process
behavior, ensuring SSH forwarding works consistently across processes,
and refactoring SSH forwarding condition into `hostSocketUrl()` helper
function.
Add `--ssh` flag to forward the host's SSH agent socket into the
container, so we can use SSH authentication for things like cloning
private repos, and also updates the socket path every time the container
starts to handle socket path changes like reboot/re-login.
Closes#498
- Closes#150, #394.
- Introduces `AttachmentConfiguration` type so that we can add key-value
options to `--network` in the future.
- Eliminates redundant `ContainersService.Item` type.
- Since we now ensure at ContainersService that hostnames will not
conflict, the network helper IP allocator now simply provides the
existing IP if for an allocation on an existing hostname, which should
handle (in an eventually consistent way) the case where a container
fails to deallocate an IP on shutdown.
We were defer closing the IO for run/exec/start fairly late in the
container run cycle which had the downside of that if the container run
failed your tty would be stuck in raw mode. This change just moves the
closing (return tty to origin state) to directly after we create the IO.
This PR defines the snapshotter protocol
```swift
///Mount a snapshot and all its previous layers
func prepare(_ snapshot: Snapshot) async throws -> Snapshot
/// Commit a snapshot, making it permanent.
func commit(_ snapshot: Snapshot) async throws -> Snapshot
/// Remove a snapshot from snapshot store
func remove(_ snapshot: Snapshot) async throws
```
It updates executors to work with this new protocol
This PR introduces the `Differ` with methods:
```swift
// Differ protocol
func diff(base: Snapshot?, target: Snapshot) async throws -> Descriptor
func apply(descriptor: Descriptor, to base: Snapshot?) async throws -> Snapshot
```
It also introduces `DiffKey`, which is a MerkeTree based key for fast
diff computations between two dirs
Today if you asked for a pty and also wanted to detach we'd open stdin
and then immediately close that pipe which would close the guest relay
as well. I don't believe we need stdin open unless it's asked for with
-i. Truthfully there's one extra bit here that is needed which is if -i
and -d are supplied we need to tell the daemon to open stdin, but not
send an fd (as they're client supplied and the client/cli is going to
exit immediately). That will need to be a followup, as it's mainly
useful for attach which we don't have today.
- Sets up API server as source of truth for installation root, similarly
to what was done for the data root. `system start` establishes the
install root, setting the environment variable `CONTAINER_INSTALL_ROOT`
when launching the API server.
- The API server propagates the environment variable when launching
helpers, and returns the install root to the CLI via the health check
XPC.
- Includes several fixes for detecting plugins that use app bundle
layout.
- Part of #384.
- Rename to reflect that these are not just client defaults.
- Relocate so callers don't need the heavyweight coupling to
ContainerClient to access the type.
Closes#339.
This change adds named volume support to container, providing volume
management CLI commands - `create, delete, list and inspect`. The
implementation uses EXT4 block-based persistent storage with a new
`VolumesService` actor for thread-safe operations, integrates seamlessly
with the existing container mount system through a new `.volume`
filesystem type, and provides atomic volume operations with XPC-based
API communication. Volumes are stored in isolated directories with
configurable sizes (default 512GB) and include proper cleanup and
container usage tracking for safe deletion.
Example Usage:
```
# Create a volume
container volume create mydata
# Use volume in container
container run -v mydata:/data alpine
# List volumes
container volume list
# Inspect volume details
container volume inspect mydata
# Clean up
container volume rm mydata
```
Remove the option token from the dockerfile tokenizer for the native
builder. This cleans up some of the logic around handling options
depending on if they're instruction options or user provided options to
a command.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
This PR adds support for CMD and LABEL instructions in the native
builder's parser.
This also changes how options are tokenized. Options now include the raw
string so that when constructing a command for instructions like CMD and
RUN, we can use the exact user input without having to add logic in the
tokenizer to know when we're parsing a command verses other options,
etc.
Closes https://github.com/apple/container/issues/428 and
https://github.com/apple/container/issues/429
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Closes: #314
This change uses the new `.hosts` config entry
on Containerization's LinuxContainer config to setup a default
/etc/hosts file in the container. Today the two entries are localhost to
127.0.0.1 and the container's IP to its hostname.
Fixes#212
This PR:
- adds a `package func resolved()` on `ClientImage` that makes use of
the new `com.apple.containerization.index.indirect` annotation to
identify and resolve wrapper indices created by Containerization;
- replace the digest displayed in `container image list` with the one of
the resolved manifest;
- use the resolved manifest for `container image inspect` if the index
is a wrapper.
We're working on making a pure swift container image build system that
leverages containerization. This PR represents our initial design and
initial work towards this goal.
The native builder is still in active development and most of the
implementation has not been started or completed. We will be opening a
series of issues that represent various (but not necessarily all) pieces
of work that need to be done here.
There are docs included in this PR that describe the overall design of
each component and outline some of our goals. The easiest way to view
the docs by themselves (since this is a massive PR) is to look at the
docs commit in the `Commits` tab.
We'd love any feedback!
@wlan0
---------
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
This matches other container commands that rely on user arguments at the
end, such as `container run`. Closes#395.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
0.5.0 introduces a new way to configure the containers and execs. This
is now done all upfront at constructor time in a callback style. I'm
very happy with the config improvements, but because IO can only be
setup at constructor time this makes it so that we need to supply IO at
creation time of the VM or exec, which isn't the end of the world. All
that really changes is `boostrap()` and `createProcess()` now take in IO
instead of slightly later in `process.start()`
readabilityHandler is a bit crummy if it's a regular file. This just
writes our own loop and exits and shuts down the write end of the pipe
if we get to the end of the file.
Looks like we've been ignoring the "cause" field for
ContainerizationError when sent over xpc. Add the cause to the
`ContainerXPCError` message field instead of a new `cause` field since
`Error` is not encodable. The goal here is just to preserve information.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
I want to access the different variants of an image in my app, which
information is only available in the ImageDetail. Although the function
ClientImage.details() -> ImageDetail and its return type are already
public, its properties aren’t, which prevents access to this
information.
J Logan