- Closes#1122.
- Adds placeholder ManagedResource and unit tests. Nothing is using
these yet.
- Adds system-defined resource labels for owning plugin and resource
role. The system discriminates the builtin network using role "builtin".
- Adds builtin role when creating builtin network at startup, and
ensures that a preexisting network with ID "default" gets updated with
the role label.
- Replace all network ID checks for "default" with the builtin role
check.
- Adds "builder" role to builder VM.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
Role and owner labels should make cross-cutting resource policy easier
to implement.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
## Summary
The `reload()` method in `PacketFilter.swift` references
`/sbin/reloadProcess` (the local variable name) instead of
`/sbin/pfctl`. This causes all DNS create and delete operations to fail:
```
Error: internalError: "pfctl reload exec failed: "Error Domain=NSCocoaErrorDomain Code=4 "The file "reloadProcess" doesn't exist.""
```
## Fix
One-line change: `/sbin/reloadProcess` → `/sbin/pfctl`
## Testing
Verified on macOS 26 (Tahoe) with Apple Silicon:
- `sudo container system dns create test.sdc.internal --localhost
203.0.113.1` succeeds without error
- Container can resolve and reach host services through the DNS redirect
- `DirectoryWatcher` opens file descriptors for monitoring
directories but never closes them, causing a file descriptor
leak.
- Adds `setCancelHandler` to properly close file descriptors
when the `DispatchSource` is cancelled.
Signed-off-by: Ronit Sabhaya <ronitsabhaya75@gmail.com>
- Closes#1113.
- This is the newest we can do until we address #767.
- Slight change to PacketFilter error handling so unit tests work more
reliably.
- Try making CLINetworkTests serialized to see if parallel execution is
causing flakes.
The old mtu default in containerization was 1280 to account for some
alpine/musl images that have issues with
1500. This changed in the last couple tags to be modifiable, but the new
default is the standard 1500. Ideally we eventually allow supplying the
mtu to be used when you create a network (or possibly a container
creation setting), but for now just default in here back to what CZ used
to use.
Updating the package dependency on apple/containerization to pick up bug fixes
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
Co-authored-by: J Logan <john_logan@apple.com>
- ContainerResources shouldn't need to know anything about CLI stuff.
- Move ExpressibleByArgument protocol conformance to an extension in the
package where it's needed.
- Refer to #862
- Updated `SIZE` field to `FULL SIZE`, as it seemed more appropriate so
it does not get mixed up with the `descriptor size` field
- Closes#860
- Fixed#892.
- By contrast with `rm`, `prune` should display
the amount of reclaimed storage, so added code
to retrieve it.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
- Closes#977.
- Closes#1058.
- Prevents unexpected removal of containers on
bootstrapping and starting failures, by reorganizing
error handling for container `run`, `start`, and
`exec` so that error handling only unwinds that
which was done in the current scope.
- Relies on apple/containerization#495.
- Closes#1037.
- Adds a `--mode` flag that has `nat` and `hostOnly` options.
The host-only option selects the vmnet host-only mode,
where containers attached to the network can reach each
other and the host, but not external systems.
- Closes#346.
- This PR enables connecting host's localhost ports from
containers.
- It adds an option `--localhost <localhost>` to DNS
create command, after which the packets heading
ip address in container are redirected to localhost in
host machine. Packet filter rule is added and deleted
along with the creation and deletion of localhost domain.
- Services started from Terminal run in the `gui/$uid`
launchd domain. When `ensure-container-stopped.sh`
runs from a different context, `launchctl managername`
may return a different domain, causing the script to
check the wrong domain and miss running services.
I noticed this after upgrading `container` via Homebrew.
- Introduces a getopt option `-a` that allows booting out all
domains explicitly. Also adds `-h` for a usage message.
Signed-off-by: Patrick Linnane <patrick@linnane.io>
This change adds --dns parameter support to the build command, matching
the existing functionality in the run command. This allows users to
specify custom DNS nameservers (like Google DNS 8.8.8.8) when building
container images, which is essential when the host machine uses a local
DNS resolver (e.g., 127.0.0.2) that doesn't work inside containers.
Changes:
- Added --dns option to BuildCommand to accept DNS nameserver IP
addresses
- Modified build logic to detect DNS configuration changes and recreate
the builder container when DNS settings differ
- Passed DNS configuration to BuilderStart.start() method
- Updated builder container creation to use specified DNS nameservers or
fall back to network gateway
## Type of Change
- [ ] Bug fix
- [X] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This change adds --dns parameter support to the build command, matching
the existing functionality in the run command. This allows users to
specify custom DNS nameservers (like Google DNS 8.8.8.8) when building
container images, which is essential when the host machine uses a local
DNS resolver (e.g., 127.0.0.2) that doesn't work inside containers.
## Testing
- [X] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
---------
Co-authored-by: J Logan <sgtbakerrahulnet@yahoo.com>
- Fixed#1073
- Move the conditional check to the front; there's no need
to check for a default network after filtering.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
- Relates to #642.
- Each image carries it own error message (allows for different error
types per image)
- Stdout/stderr support
- Use of the new `StderrLogHandler`
- Runner fleet is on 26.3 now.
- Integration tests started flaking and it appears that we've been misconfiguring/not configuring proxy variables where we needed to be and it finally caught up with us. Workflow now adds appropriate exclusions for host-to-container and container-to-container network requests so they aren't all rammed through the proxy.
- Facilitates #507, #642.
- Plumb logger with logger option access into every command.
- StderrLogHandler allows logging to be enhanced for ANSI color mode for
log levels, JSONL log output, replacing `--debug` with `--level level`.
- Global logger is now just an Application.swift fileprivate only used
for initial args processing.
- Log with timestamp at debug and trace level.
- Metadata output is crude at present; we can refine this in a
follow-up.
## Type of Change
- [x] Bug fix
## Motivation and Context
This PR changes the behavior of the Allocation Only vmnet network plugin
to use the default subnet in the fallback case if no subnet was
specified in the network configuration. This matches the behavior of
`ReservedVmnetNetwork`.
## Testing
- [x] Tested locally
## Type of Change
- [x] New feature
- [x] Breaking change
## Motivation and Context
This PR changes the behavior of the `defaultArguments` field in the
service plugin config. Previously, `defaultArguments` was functioning as
a way to indicate how to start a plugin in the event that the plugin is
loaded at boot (such as for the `container-core-images plugin`).
However, we now follow a convention where all plugins have a "start"
command that is used when launching the plugin, so this
`defaultArguments` field wasn't really providing much. Instead, there
are use cases where we may want to set default values to pass to a
plugin. This PR repurposes the `defaultArguments` field for those use
cases.
As an example use case, there are scenarios where someone may want to
use the AllocationOnlyVmnetNetwork even when running on macOS 26+. This
PR adds the ability to pass in a command line option to the vmnet
network plugin to specify that request. Combined with the
`defaultArguments` plugin config change, a user may choose to set that
field to ["--variant", "allocationOnly"] in the
`container-network-vmnet-config.json` to use AllocationOnlyVmnetNetwork
by default for all networks.
## Testing
- [x] Tested locally
Run = Create + Start
1) Mount source points to a valid directory
- Run and Create + Start both correctly create the container with mount.
2) Mount source points to a file
- Run fails bootstrapping the container, thus container not created.
- Create creates the container, but Start fails bootstrapping, removing
the container. (Thus, both are the same.)
3) Mount source deleted or replaced to file after container created
- Start throw errors but do not delete the container.
Closes https://github.com/apple/container/issues/1050
If the sandbox svc exits out of band of the usual stop (or regular exit)
case the container svc's state is not properly updated for the
container. This was due to the cleanup steps involving trying to send
the shutdown rpc which cannot succeed as the sandbox svc does not exist
to service it.
To handle this, let's treat shutdown not returning successfully as
non-fatal (as this is mostly best effort), log an error and continue the
state cleanup.
- Update image load and build to handle rejected paths during tar
extraction. For the image load command there is now a `--force` function
that fails extractions with rejected paths when false, and just warns
about the rejected paths when true.
- Update `container stats` for statistics API properties now all being
optional.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
See above
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
- Closes#639.
- Adds swift format configuration that removes lint checks so we can use
`swift lint` to perform format-only tests.
- Adds `check` target that invokes format and header checks.
- Adds pre-commit script that runs `make check`.
- Adds `pre-commit` target that installs the check script as a
pre-commit hook.
## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
Avoids wasting time and commit rewrites.
## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
- TestCLIRunCommand now run so many tests concurrently that the API
server gets swamped and tests randomly time out.
- The parallelism options on `swift test` only work for XCTest, not
swift-testing.
- Work around this while retaining some parallelism (good for stress
testing) by breaking the tests into two suites.
- It is common to have `gnu-tar` alongside other GNU tools
installed and aliased for compatibility reasons. However, this
breaks the current make build.
- Use BSD-only binaries (no GNU equivalents that are
commonly aliased), making the Makefile more portable.
- Adds `aarch64` as an alias for `arm64` in the `Arch` enum. This
addresses the maintainer's request to support this common architecture
name, ensuring consistency with `x86_64` normalization and preventing
failures for users expecting `aarch64` support.
- The container fails to start with a generic "permission denied"
error when attempting to publish privileged ports (ports below
1024) without root privileges. This provides a confusing user
experience as the error doesn't explain why permission was
denied.
Danny Canter