166 Commits

Author SHA1 Message Date
J Logan a23bcf0061 Propagate host ssh socket permissions to relay socket in guest. (#811)
- Closes #580.
- Depends on apple/containerization#362.

## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-10-27 14:46:27 -07:00
Danny Canter 9f8a0fb87d Build: Fallback to Containerfile if Dockerfile not found (#812)
Closes #782 #99

If a Dockerfile can't be found in the context dir, check for the common
alternative Containerfile. This does not implement .containerignore
also, solely Containerfile for now. This also funnily enough fixes us
not checking for the Dockerfile IN the context directory.. woops.

## Type of Change
- [x] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-27 08:28:29 -07:00
Dmitry Kovba f2b3cbdd73 Lowercase stdin, stdout, stderr (#807)
Lowercased stdin, stdout, stderr.
2025-10-25 06:55:45 -07:00
Dmitry Kovba 4944fe1641 Use a consistent capitalization in log and error messages (#806)
Updates the capitalization in log and error messages to be consistent.
2025-10-24 19:18:32 -07:00
Danny Canter b4528924dc Dns: Fix delete error message (#803) 2025-10-24 14:04:47 -07:00
J Logan 5de195f720 Bump Containerization to 0.12.0. (#802)
- Include change to bootlog API.
2025-10-23 14:26:45 -07:00
Danny Canter da501ce620 Raise createEndpoint response timeout (#797) 2025-10-21 18:09:37 -07:00
Raj b4c3ebfed8 add volume prune command (#783)
- Closes #508.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Adds a `container volume prune` command that removes volumes with no
container references and reports the amount of disk space reclaimed.
This helps users clean up unused volumes and easily reclaim disk space.

Also updates the `volume delete` documentation to clarify and highlight
how the `--all` flag works.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-21 16:58:11 -07:00
Danny Canter 2f507fe9d9 Make container start idempotent (#792)
Fixes #772 

Today it fails in bootstrap the second go around, and we also have an
error handler that automatically cleans up the container if bootstrap
failed which is even worse. This change short circuits us first in the
cli if the state is running when we get() the container, and also adds
in a clause to bootstrap to just early return if we already have a
client.
2025-10-21 14:42:32 -07:00
Danny Canter b4814f0c4a Deps: Bump Containerization to 0.11.0 (#796) 2025-10-21 14:28:52 -07:00
Raj ce40ffd33d add support for multiple --tag flags in build (#785)
- Closes #732.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Adds support for specifying multiple `-t` / `--tag` flags with the
`build` command. All specified tags will point to the same built image.

Example:
`container build -t myapp:latest -t myapp:v1.0.0 -t myapp:stable .`

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-21 13:03:46 -07:00
Saehej Kang d610a85703 [container-run-create]: add support for --network none (#739)
Closes #386
2025-10-21 11:18:06 -07:00
Saehej Kang 27eee1e7f9 [container-system-dns-ls]: add --format and --quiet options (#720)
Closes #510
2025-10-16 16:18:52 -07:00
Raj 2f8de3a660 Implicitly create named volumes (#769)
- Closes #690.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Named volumes are now implicitly created when referenced in container
commands. So, if `myvolume` doesn't exist and you run `container run -v
myvolume:/data alpine`, it is automatically created.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-16 14:48:57 -07:00
Raj f90f67ccf0 Add support for anonymous volumes (#768)
- Closes #726.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Adds support for anonymous volumes. Users can now create volumes without
explicit naming using `-v /path` and `--mount type=volume,dst=/path`
syntax.

Usage:
```
# anonymous volume  
container run -v /data alpine
container run -v anon-01k7jpghe4kg4ph5a4vkccksbb:/data alpine

# Multiple anonymous volumes
container run --rm -v /logs -v /cache -v /tmp alpine
```

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-15 17:33:49 -07:00
J Logan 78701f1b73 Add app bundle Info.plist as a system property source. (#764)
- Closes #708.
- Allows `container` and services/plugins to get backstop defaults from
  `Info.plist` properties if repackaged into a signed app bundle.
2025-10-14 17:00:03 -07:00
Kathryn Baldauf 6cb40b3687 Add image env variables to builder start command (#756)
## Type of Change
- [x] Bug fix

## Motivation and Context
Required for builder to run correctly with bug fix in containerization
here https://github.com/apple/containerization/pull/329. Builder was
previously not passing any environment variables when starting the
initial process.

## Testing
- [x] Tested locally

---------

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
2025-10-14 11:13:18 -07:00
siikamiika d8eb510e1e Support --subnet in network create (#737)
> [!CAUTION]
> Just noticed you can actually create a network that conflicts with an
existing network not managed by `network create`. Unless that is fine do
not merge!

Currently containerization only supports IPv4.

Example:
<img width="2012" height="578" alt="screenshot"
src="https://github.com/user-attachments/assets/38fef1ef-3ffd-4d77-b9e2-8c43f7e4851d"
/>



Docker ref: https://docs.docker.com/reference/cli/docker/network/create/
Podman ref:
https://docs.podman.io/en/v5.0.3/markdown/podman-network-create.1.html#subnet-subnet

Fixes apple/container#458

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
[Why is this change needed?]

Scripted creation of deterministic network environments for containers

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
2025-10-13 16:30:10 -07:00
J Logan 77e68a7613 Moves .build directory to builder. (#749)
Closes #416.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change (possibly, I would think we're just going to leave
an unused `.build` directory behind which we can document, but can run
more tests next week).
- [ ] Documentation update

## Motivation and Context
We have nothing to hide?

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-10-10 10:19:05 -07:00
J Logan bc70b39182 Fix broken proxy configuration for default kernel fetch. (#747)
- Closes #466.

## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Proxy logic worked well enough for CI but broken in general.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
2025-10-10 10:17:42 -07:00
Bisman Sahni 0d3f20c4ca Fix race condition in ContainersService.create() (#721)
Fixes #692 

This PR resolves a race condition in `ContainersService.create()` that
occurs when creating containers with the same name concurrently.
2025-10-08 17:30:06 -07:00
Kathryn Baldauf 23b058c53c Remove StandardErrorPath and StandardOutPath from launchd plists (#742)
## Type of Change
- [x] Bug fix

## Motivation and Context
We setup logging for the services in `container` using OSLog. See
[here](https://github.com/apple/container/blob/73709232d2705b7008b7380fe90a373059b6074a/Sources/Helpers/APIServer/APIServer.swift#L31).
This makes it unnecessary to redirect stderr and stdio for these
services. Additionally, there are some cases where failure to open or
write to the path given for StandardErrorPath or StandardOutPath in a
service's plist could result in a failure to start a service through
`launchctl`.

Related to https://github.com/apple/container/discussions/713

## Testing
- [x] Tested locally

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
2025-10-08 16:08:08 -07:00
Danny Canter 73709232d2 CLI: Fix env-file parsing (#707)
Closes #691

Any envvars that had equal signs in the value would be ommitted today.
This change brings it much more in line with docker's behavior/parser
and adds unit tests to verify this is the case.
2025-10-06 12:12:50 -07:00
J Logan bfc5ca9222 Removes "all rights reserved" from license header. (#711)
Closes #63.
2025-10-03 13:28:16 -07:00
Dmitry Kovba 48230f3804 Update license headers in C files (#693)
## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
There was a duplicated and outdated license header in some files.

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-10-02 09:42:24 -07:00
J Logan ffc1195556 Remove references to macOS 26 beta. (#702)
## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [x] Documentation update
2025-10-01 15:27:35 -07:00
J Logan d045e5b0f0 Updates containerization to 0.9.1. (#697)
- Converts client to work with ExitStatus instead of integer error
codes.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change (SandboxClient.wait() returns ExitStatus instead
of Int32, apple/containerization#300)
- [ ] Documentation update

## Motivation and Context
Pick up DNS bug fix, update for breaking API change.

## Testing
- [x] Tested locally
- [x] Added/updated tests (fixed DNS test, using correct `options` now,
apple/containerization#303).
- [ ] Added/updated docs
2025-10-01 10:04:39 -07:00
Dmitry Kovba 69fd9484b9 Fix races in the SandboxService actor due to reentrancy after await calls (#684)
This PR fixes several races with the `stop()` and `shutdown()` methods
by moving all state transitions inside a lock.

## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
[Why is this change needed?]

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-25 18:35:51 -04:00
J Logan 2b07e890c7 Relocate ProcessIO to ContainerClient. (#681)
- Makes ProcessIO more generally available.
- `Application.handleProcess(processIO:process:)` becomes
`processIO.handleProcess(process:log:)`.

## Motivation and Context
This code shouldn't be in the CLI, it should be part of ContainerClient.
2025-09-24 18:02:34 -07:00
J Logan 0fe44a04fb Adds a plain stderr log handler. (#680)
- Initial work for #642. CLI commands will configure this log handler so
that they write warnings and errors to stderr, and only proper output
will go to stdout.
- Facilitates #507. The `--debug` option can set the logging level
appropriately, and CLI commands can just use `log.debug()`.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update
2025-09-24 13:57:34 -07:00
J Logan e54ee7cb4e Fix regression - removed shutdown XPC inadvertently. (#675)
## Motivation and Context
#654 forgot to include the shutdown XPC that was added in #628.
2025-09-23 14:50:14 -07:00
J Logan e7018bc30b Cleans up image subcommand options. (#659)
- Part of #515.
- Order options alphabetically.
- Use consistent descriptions for platform, os, arch.
- Add os/arch options to push.
- Rename ImageRemove to ImageDelete since delete is the primary command
and rm is the alias.

## Motivation and Context
Clear, consistent presentation of command help.
2025-09-23 10:55:04 -07:00
J Logan 076d28ebb1 Add and use container-runtime-linux start. (#654)
- Part of #653.
- No need for `defaultCommand` since ContainerService startup will write
a new launchd plist with the `start` subcommand included.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Allows us to add commands to support post-installation, migration, etc.

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-23 10:05:06 -07:00
J Logan e460ca9252 Add and use container-apiserver start. (#655)
- Part of #653.
- Also use same file organization for network helper.

## Motivation and Context
Future-proof plugin CLIs.
2025-09-23 10:01:02 -07:00
J Logan f3b33ffc45 Cleans up option groups, container subcommand help. (#647)
- Part of #515.
- Add titles to option groups for container subcommands.
- Order option groups and container subcommand options alphabetically.
- Use `container-id` and `container-ids` consistently as argument names.
- Shorten long valueNames to avoid option column overflow in help output
where possible.
- Replace customShort and customLong with short, long, and shortAndLong
where possible.
- Always place global options and arguments after alphabetized
command-specific options.
- Rename RunCommand to ContainerRun and relocate it.
- Rename Executable to ContainerCLI.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change (if you're depending on `RunCommand`, renamed).
- [ ] Documentation update

## Motivation and Context
See #385.

## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-22 16:36:07 -07:00
Danny Canter 7df9763aa5 ClientContainer: Remove response timeout from stop (#667)
After the large reworks, I'm not as worried about having this timeout
anymore. Prior to the reworks stop was signaled via an async event sent
to the daemon as stop was performed directly on the given runtime-helper
instance. If anything errored during that it was common for things to
explode, but now that stop is:

client -> APIServer -> runtime-helper instance

and the logic for stop has been improved quite a bit, in addition to
stop no longer holding a lock during it's operation, I'm not sure we
need this. In the future it'd also be nice to support no timeout (the
timeout until we send SIGKILL, not response timeout) in which case we'd
have to have an extra bit of logic here to skip the response timeout in
that scenario anyways.
2025-09-22 14:17:38 -07:00
J Logan bcfcd5ac19 Cleans up registry subcommand options. (#660)
- Part of #515.
- Order options alphabetically.

## Motivation and Context
See #515.
2025-09-22 13:18:20 -07:00
J Logan 1f94a8340a Cleans up build subcommand options. (#658)
- Part of #515.
- Order options alphabetically.
- Use `container ls` options for `builder status`.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change - Change options and output of `builder status`.
- [x] Documentation update

## Motivation and Context
See #515.

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
2025-09-22 12:48:45 -07:00
J Logan 7d905bde64 Cleans up network and volume subcommands. (#661)
- Part of #515.
- Order options alphabetically.
- Use consistent delete logic for network and volume delete.

## Motivation and Context
See #515
2025-09-22 12:17:24 -07:00
J Logan f86befafc7 Cleans up system subcommand options. (#662)
- Part of #515.
- Order options alphabetically.
- Make descriptions more concise and consistent.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
See #515.

## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-22 11:05:48 -07:00
J Logan 06eab455c8 Clarify memory units in help and documentation. (#657)
Closes #519.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [x] Documentation update

## Motivation and Context
Clarifies memory units.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-09-22 11:05:06 -07:00
Dmitry Kovba 6eaf51b8bc Remove Native Builder from the main branch (#634)
The work on the Native Builder has been moved to a separate branch
`dev/native-builder`. This PR removes it from the `main` branch.
2025-09-20 00:07:57 -07:00
Danny Canter 444064dc35 Swap to APIServer for all communications (#628) 2025-09-19 23:09:01 -07:00
J Logan 07f1d60a52 Use com.apple.container.registry as keychain ID. (#652)
- Closes #644.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change
- [ ] Documentation update

## Motivation and Context
Avoids conflicts.

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-19 09:41:55 -07:00
Danny Canter 2ef1d8fdbb CLI: Skip stopping containers in system stop if APIServer is down (#650)
Today if you do system stop twice (or if you forgot the server isn't
running) you get bombarded with annoying (and confusing) XPC interrupted
messages. We should skip the container stop and list dance if we can't
talk to the APIServer with a simple ping.
2025-09-19 08:56:23 -07:00
Morris Richman 996a6819e3 Rename CLI and ExecutableCLI folders (#635)
## Motivation and Context
This is an extension of #603 to cleanup the folder structure and have it
match with the new library and target names.
2025-09-18 17:49:48 -07:00
Morris Richman dd6bdc20cf Expose Command Structs for Plugins (#603)
## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Plugins technically exist, but to add shortcuts or to do existing things
with functions in `container` requires calling a compiled binary. This
pull request aims to remove that hurdle and instability by exposing
commands as a new `ContainerCommands ` target.

Simply import `ContainerCommands` and you can access almost
any command as if it were a native part of the binary. This makes
plugin development significantly easier.

Closes #609.
2025-09-17 15:24:26 -07:00
Dmitry Kovba c571546f60 Use a lock consistently in the ExecutionContext class (#619)
The changes in this PR improve the consistency of using a lock in the
`ExecutionContext` class.
2025-09-17 09:49:30 -07:00
J Logan 449f1d23df Replace scattered defaults subcommands with system property. (#604)
Common subcommands for all defaults.

- Closes #384.
- Replaces `registry default` and `system dns default` subcommands with
`system property`.
- Users can use `system property ls` to see details about each supported
default value.
- `system property set` implements reasonable validation for all
properties.
- NOTE: Probing of the registry for `registry default set` was removed,
which means users will find out about a botched setting when pulling or
pushing.
- Updates docs.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [x] Breaking change
- [x] Documentation update

## Motivation and Context
See #384.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-09-16 13:37:55 -07:00
Kathryn Baldauf 386fd87b5d Enumerate using relative paths to avoid mismatch with symlink resolution of special paths like /tmp (#613)
## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Fixes https://github.com/apple/container/issues/588. This PR changes the
archiver compression file enumeration to use the
[enumerator(atPath:)](https://developer.apple.com/documentation/foundation/filemanager/enumerator(atpath:))
version. This version returns relative paths instead of full file paths
from the filesystem. /tmp is symlinked to /private/tmp and some swift
packages will handle that path differently. While a call to Foundation's
`URL.resolvingSymlinksInPath()` will return "/tmp", a call to
`FileManager.enumerator(at:)` will return "/private/tmp". This
difference causes a container image build to fail when the user is using
a path under /tmp or other special case paths as the context directory.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
2025-09-16 10:52:08 -07:00