- Runner fleet is on 26.3 now.
- Integration tests started flaking and it appears that we've been misconfiguring/not configuring proxy variables where we needed to be and it finally caught up with us. Workflow now adds appropriate exclusions for host-to-container and container-to-container network requests so they aren't all rammed through the proxy.
- Facilitates #507, #642.
- Plumb logger with logger option access into every command.
- StderrLogHandler allows logging to be enhanced for ANSI color mode for
log levels, JSONL log output, replacing `--debug` with `--level level`.
- Global logger is now just an Application.swift fileprivate only used
for initial args processing.
- Log with timestamp at debug and trace level.
- Metadata output is crude at present; we can refine this in a
follow-up.
## Type of Change
- [x] Bug fix
## Motivation and Context
This PR changes the behavior of the Allocation Only vmnet network plugin
to use the default subnet in the fallback case if no subnet was
specified in the network configuration. This matches the behavior of
`ReservedVmnetNetwork`.
## Testing
- [x] Tested locally
## Type of Change
- [x] New feature
- [x] Breaking change
## Motivation and Context
This PR changes the behavior of the `defaultArguments` field in the
service plugin config. Previously, `defaultArguments` was functioning as
a way to indicate how to start a plugin in the event that the plugin is
loaded at boot (such as for the `container-core-images plugin`).
However, we now follow a convention where all plugins have a "start"
command that is used when launching the plugin, so this
`defaultArguments` field wasn't really providing much. Instead, there
are use cases where we may want to set default values to pass to a
plugin. This PR repurposes the `defaultArguments` field for those use
cases.
As an example use case, there are scenarios where someone may want to
use the AllocationOnlyVmnetNetwork even when running on macOS 26+. This
PR adds the ability to pass in a command line option to the vmnet
network plugin to specify that request. Combined with the
`defaultArguments` plugin config change, a user may choose to set that
field to ["--variant", "allocationOnly"] in the
`container-network-vmnet-config.json` to use AllocationOnlyVmnetNetwork
by default for all networks.
## Testing
- [x] Tested locally
Run = Create + Start
1) Mount source points to a valid directory
- Run and Create + Start both correctly create the container with mount.
2) Mount source points to a file
- Run fails bootstrapping the container, thus container not created.
- Create creates the container, but Start fails bootstrapping, removing
the container. (Thus, both are the same.)
3) Mount source deleted or replaced to file after container created
- Start throw errors but do not delete the container.
Closes https://github.com/apple/container/issues/1050
If the sandbox svc exits out of band of the usual stop (or regular exit)
case the container svc's state is not properly updated for the
container. This was due to the cleanup steps involving trying to send
the shutdown rpc which cannot succeed as the sandbox svc does not exist
to service it.
To handle this, let's treat shutdown not returning successfully as
non-fatal (as this is mostly best effort), log an error and continue the
state cleanup.
- Update image load and build to handle rejected paths during tar
extraction. For the image load command there is now a `--force` function
that fails extractions with rejected paths when false, and just warns
about the rejected paths when true.
- Update `container stats` for statistics API properties now all being
optional.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
See above
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Closes#639.
- Adds swift format configuration that removes lint checks so we can use
`swift lint` to perform format-only tests.
- Adds `check` target that invokes format and header checks.
- Adds pre-commit script that runs `make check`.
- Adds `pre-commit` target that installs the check script as a
pre-commit hook.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
Avoids wasting time and commit rewrites.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
- TestCLIRunCommand now run so many tests concurrently that the API
server gets swamped and tests randomly time out.
- The parallelism options on `swift test` only work for XCTest, not
swift-testing.
- Work around this while retaining some parallelism (good for stress
testing) by breaking the tests into two suites.
- It is common to have `gnu-tar` alongside other GNU tools
installed and aliased for compatibility reasons. However, this
breaks the current make build.
- Use BSD-only binaries (no GNU equivalents that are
commonly aliased), making the Makefile more portable.
- Adds `aarch64` as an alias for `arm64` in the `Arch` enum. This
addresses the maintainer's request to support this common architecture
name, ensuring consistency with `x86_64` normalization and preventing
failures for users expecting `aarch64` support.
- The container fails to start with a generic "permission denied"
error when attempting to publish privileged ports (ports below
1024) without root privileges. This provides a confusing user
experience as the error doesn't explain why permission was
denied.
There's a couple things I don't think are intuitive about this.
1. Because of the internal task, render() can still be called even after
finish() completes. Ideally async defers are supported and we could just
await the final render completing after cancelling the task and setting
.finished, but alas. To fix this we can just lock across the methods for
now.
2. We always clear the screen in the destructor, even if we don't use
the
progress bar. I don't think we should honestly do anything in the
destructor.
Feels a programmer error not to defer { bar.finish() } or call it
somewhere.
3. Our spaces based line clearing. Use the ansi escape sequence for
clearing line;
I think our calculations were slightly off and it would leave trailing
output ( "s]" )
in some cases.
4. Shrinking the window until the output is smaller than the terminal
window (and vice
versa) is wonky on various term emulators. Truthfully, this is just a
hard problem,
but we can truncate our output and still provide some useful info.
This fixes some single line output (cat /etc/hostname etc.) getting
cleared in our atexit handler, as well as the need for the usleep.
- Closes#1005.
- Adapt everything to use MACAddress type from containerization 0.20.0.
- Allocate MAC addresses for every container so that we have
deterministic IPv6 link local addresses.
- Add AAAA handling to ContainerDNSHandler.
- NOTE: Only works on Tahoe. On Sequoia, we don't have a good way to set
or determine the IPv6 network prefix when networks are created, so we
can't infer the IPv6 link local addresses for AAAA responses and we
instead return `NODATA`.
The tests are run in parallel on CI, and were split into three tests.
They change the cwd, so it's kind of a gamble whether some of them pass.
This just moves all the logic into one test mostly.
- Closes#461.
- Extract core types into ContainerResources target.
- Extract ContainerNetworkServiceClient from ContainerNetworkService.
- Relocate sandbox client from ContainerClient to
ContainerSandboxServiceClient.
- Relocate ContainerClient to ContainerAPIServiceClient.
- Common structure from services and clients under Source/Services.
Updated project hierarchy:
```
Sources/CAuditToken - audit token access wrapper
Sources/CLI - CLI executable
Sources/ContainerBuild - builder
Sources/ContainerCommands - CLI command implementations
Sources/ContainerLog - logging helpers
Sources/ContainerPersistence - persistent data and system property helpers
Sources/ContainerPlugin - plugin system
Sources/ContainerResource - resource (container, image, volume, network) types
Sources/ContainerVersion - version helpers
Sources/ContainerXPC - XPC helpers
Sources/CVersion - injected project version
Sources/DNSServer - container DNS resolver
Sources/Helpers - service executables
Sources/Services/*/Client - service clients
Sources/Services/*/Server - service implementations
Sources/SocketForwarder - port forwarding
Sources/TerminalProgress - progress bar
```
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [x] Breaking change
- [ ] Documentation update
## Motivation and Context
The ContainerClient library was a bit of a grab bag. This refactor
applies a more sensible project and library structure for resource data
types, services, and clients.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
Often times I'll be making a change that only touches the cli and I
don't feel like sitting through the potential song and dance of the
other components building/installing.
- Fixes: #992
- Port validation previously rejected valid configurations
when the same port number was used for different
protocols (TCP and UDP). For example:
`-p 1024:1024/udp -p 1024:1024/tcp`
Although this is a valid and common use case, the
validation logic treated it as a conflict.
To fix this, I updated the validation key to include the protocol name.
The validation now checks for overlapping port numbers only within the
same protocol, rather than across all protocols.
This change enables binding the same port number for both TCP and UDP,
aligning the validation behavior with real-world networking
requirements.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
## Summary
- Fixes a grammar error in the tutorial's publish section
## Details
Line 287 of `docs/tutorial.md` had "you need push images" which should
be "you need to push images".
This is a simple grammar fix to improve readability.
## Test plan
- [x] Verified the sentence now reads correctly
- Corrects the MAC address example command in the
how-to guide to use the correct `--network` flag syntax
instead of the incorrect `--mac-address` flag.
Fixes#833.
Currently, when stopping and immediately restarting a container, it would fail with the error:
`“container expected to be in created state, got: shuttingDown”` and then be automatically deleted.
The `SandboxService` process waits five seconds before exiting after shutdown. During this interval, a rapid restart could reconnect to the still-terminating process in the `shuttingDown` state, triggering a state validation error.
This fix forcefully terminates the `SandboxService` process with `SIGKILL` upon container exit, instead of waiting five seconds. The bootstrap now defensively checks for and cleans up any stale services before registering new ones, preventing reconnections to processes in the `shuttingDown` state.
- Part of work for #460.
- Enable set/get of IPv6 network prefix in ReservedVmnetNetwork.
- Show IPv6 prefix in `network list` full output.
- Option for setting IPv6 prefix when creating a network.
- System property for default IPv6 prefix.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
See #460.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
This is a fix for
[issue#956](https://github.com/apple/container/issues/956)
`FileManager.default.contents(atPath:)` returns `nil` for named pipes
(FIFOs)
and process substitutions like `/dev/fd/XX` because:
1. It expects regular files with a known size
2. Named pipes are stream-based and block until data arrives
## Solution
Use `FileHandle(forReadingFrom:)` instead, which:
- Properly handles blocking I/O
- Works with named pipes, process substitutions, and regular files
(mentioned in the
[doc](https://developer.apple.com/documentation/foundation/filehandle))
Co-authored-by: Bortniak Volodymyr <Bortnyak@users.noreply.github.com>
- Fixes issue #923
- I fixed a race condition in `ConnectHandler.swift` where
an asynchronous network connection could complete
after the handler had already been removed from the
pipeline.
- This prevents the EXC_BREAKPOINT crash in
container-runtime-linux that occurred when kinc
(Kubernetes in Container) created rapid connections.
- The actual fix was inadvertently applied in #957, so this
PR contains only the test code.
- Part of work for #460.
- With CZ release 0.17.0, the IP and CIDR address
types changed from String to IPv4Address and
CIDRv4, respectively. This PR applies the corresponding
adaptations to container.
## Summary
Add Dependabot configuration to automatically keep GitHub Actions up to
date.
## Changes
Adds `.github/dependabot.yml` configured to:
- Check for GitHub Actions updates weekly
- Group all action updates together for easier review
- Use `ci` prefix for commit messages
## Why
As discussed in #958, this helps:
- Keep actions up to date with security patches automatically
- Handle Node runtime deprecations proactively (e.g., Node 20 → Node 24)
- Reduce manual maintenance burden
## Reference
Based on the pattern used in
[swift-nio](https://github.com/apple/swift-nio/blob/main/.github/dependabot.yml).
J Logan