## Type of Change
- [ ] Bug fix
- [x] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
`container` runs each workload in an ephemeral VM, so there's no
built-in way to keep a persistent Linux environment you can log into and
work in. `container machine` adds one.
A container machine is a lightweight, persistent, and integrated Linux
environments that feel like an extension of your Mac, created from
standard OCI images with a familiar UX. The login user matches your host
account with passwordless `sudo`, your home directory is mounted inside
the VM, and each machine keeps its filesystem and runs the image's own
init system (such as`systemd` or `openrc`).
```bash
container machine create alpine:3.22 --name my-machine
container machine run -n my-machine # interactive shell
container machine set -n my-machine cpus=4 memory=8G
```
Subcommands: `create`, `run`, `list` (`ls`), `inspect`, `set`,
`set-default`, `logs`, `stop`, `delete` (`rm`); `m` aliases `machine`.
Docs added to `docs/command-reference.md` (Machine Management) and
`docs/how-to.md` ("Use container machines").
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
Signed-off-by: Raj Aryan Singh <rajaryan_singh@apple.com>
Co-authored-by: Jaewon Hur <jaewon_hur@apple.com>
Co-authored-by: John Logan <john_logan@apple.com>
Co-authored-by: Michael Crosby <michael_crosby@apple.com>
Co-authored-by: Eric Ernst <eric_ernst@apple.com>
Co-authored-by: Danny Canter <danny_canter@apple.com>
https://github.com/apple/container/pull/1652 rearranged the JSON output
for image resources and included a duplicate "name" field. After further
discussion, we've decided to remove the duplicate field.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Fixes#1642.
- The `ensure-hawkeye-exists.sh` now actually
ensures that hawkeye is installed. If it is not
installed, the script informs that the installation
uses `curl | sh` and asks the user to confirm
before proceeding.
- Automated workflows can bypass the prompt
by invoking the script with the `-y`/`--auto-install`
option, or by setting the environment variable
`HAWKEYE_AUTO_INSTALL=1`.
- Export HAWKEYE_AUTO_INSTALL=1 in every
Git workflow job that runs make check, to
ensure license/format checks don't stall.
- Closes#1528.
- Several commands (`builder status`, `image list`,
`stats`, `system df`, `system status`) advertised
`--format yaml` and `--format toml` but only handled
`json`, and every other format fell through to the
table. With this PR, we now route them through one
shared renderer with an exhaustive switch over the
format enum, so a missing format would now be a
compile error, and not just fail silently.
- Since TOML has no top level array, TOML output
now wraps list payloads under an `items` key,
because otherwise it was returning nothing for lists.
- `stats` now prints one static result for machine
readable formats instead of opening its live table
view.
- `builder status` now returns an empty list for
json/yaml/toml when no builder is running, instead
of the unparseable "builder is not running" text.
The table view keeps the message.
- with `--quiet` and no builder it now exits 0 with
no output, earlier it exited non-zero.
- This PR changes the shape of the JSON
output for image resources to align closer with
`VolumeResource` and `NetworkResource`.
This includes adding `creationDate` in the
`configuration` section of the image output.
- This PR additionally cleans up some of the logic
around the `ImageResource` struct construction.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1641.
- This PR replaces the existing hook pathname computation
for `make pre-commit` with `git rev-parse --git-path hooks/...`,
which resolves to the shared hooks directory in both the main
checkout and any worktree.
- Closes#1647.
- `id` will become a system assigned (Docker-like) identifier
for the managed resource, and `configuration.name` is the
user-assigned name.
Today when we send a signal we don't wait for the container to exit, as
we don't know what signals the program will actually do anything with.
However, sigkill does not fit this mold, and we should wait for the
container to exit (or be removed for --rm containers).
Normalize JSON output for network and volume resources. (#1624)
- Reworks both JSON output presets to use sorted keys, ISO timestamps.
`compact` is used for `ls` output, and `pretty` is used for `inspect`.
- Extracts non-DRY option configuration into presets.
- Closes#1623.
- Closes#1625.
- For now, the ImageResource compliance happens
at the CLI level. We will work on pushing that into or
closer to the APIServer at a later time.
## Testing
- [x] Tested locally
---------
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1526 and #1527.
## Type of Change
- [x] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Motivation and Context
This PR fixes `system df` to report actual on-disk allocated bytes
(content blobs + snapshots) instead of summing per-image snapshot sizes.
Orphaned blobs are now included as reclaimable, and storage shared
across tags is no longer double counted. Also consolidates three
identical `calculateDirectorySize` implementations into a shared
`FileManager.allocatedSize(of:)` extension.
## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
- Refactor network model types: replace `NetworkState` enum and
phase-based NetworkStatus with a flat `NetworkStatus` struct.
- Simplify API server ↔ plugin protocol: plugin `status()` returns
runtime status only, API server owns configuration.
- `NetworksService` `list()`/`create()` now return `NetworkResource`
directly.
- Remove lifecycle phase checks and state machine guards throughout CLI
and API server.
- `variant` is plugin-specific, it's not a required property. This PR
replaces `NetworkPluginInfo` with a `plugin` name property on
`NetworkConfiguration` and an `options` list similar to that for
volumes.
- Moved `variant` to the option list.
- Part of #1404.
- Updates containerization to 0.33.2.
- Reorganizes network plugin targets into:
- `ContainerNetworkClient` - network plugin client and default types
- `ContainerNetworkServer` - separate protocols for `Network` which
manages the underlying virtual network, `NetworkService`, which takes a
network and implements the API, and an actor `NetworkHarness` that
marshals between the API and the XPC protocol. The service-harness
separation will help us ensure XPC protocol compatibility in both
directions as we evolve the plugin APIs.
- Removes `disableAllocator()` which is no longer used since #1545
switched over to using XPC connections between runtime and network
plugin instances to track whether a network has attached containers.
- Closes#1610.
- Discovered, and originally filed as a security advisory, by:
PresidentL <131139636+liyander@users.noreply.github.com>.
- `PublishPort` currently can store invalid combinations of starting
port and range that can overflow UInt16 values when summed, crashing the
process.
- Updates `PublishPort` to validate inputs on initialization.
## Type of Change
- [x] New feature
## Motivation and Context
Related to https://github.com/apple/container/issues/1404.
This PR adds the initial work to have volume resources conform to
ManagedResource, in alignment with other resources such as networks (see
[here](https://github.com/apple/container/pull/1421)). Further work is
necessary to move the use of `VolumeResource` down to the APIServer (in
the VolumesService) and in the volume client. Volumes do not currently
have any plugin or runtime state, so that information is not included in
the `VolumeResource`, but could be added later if needed.
## Testing
- [x] Tested locally
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] New feature
## Motivation and Context
When developing, there are times when I want to run a specific set of
CLI tests. This PR allows users to set what integration tests they want
to run by setting the makefile variable `INTEGRATION_TEST_SUITES`.
Example usage:
```
% INTEGRATION_TEST_SUITES="TestCLIVolumes TestCLIAnonymousVolumes" make all integration
```
## Testing
- [x] Tested locally
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Fixes#1509. The CLI's own help text tells users to
run `container help <subcommand>`, but every form
of that results in an error.
- Added a captured subcommand path, walked
Application`'s `subcommands` + `groupedSubcommands`
tree (matching `commandName` and `aliases`), and
printed `Application.helpMessage(for:)` for the resolved
target. Empty path keeps existing plugin-aware top-level
help; unknown path throws `ValidationError`.
## Type of Change
- [x] Bug fix
## Motivation and Context
Ensure all fields are initialized in the management flags' init
function. Without this change, if someone calls init() on this set of
flags, they will get an error like
```
Can't read a value from a parsable argument definition.
This error indicates that a property declared with an `@Argument`,
`@Option`, `@Flag`, or `@OptionGroup` property wrapper was neither
initialized to a value nor decoded from command-line arguments.
To get a valid value, either call one of the static parsing methods
(`parse`, `parseAsRoot`, or `main`) or define an initializer that
initializes _every_ property of your parsable type.
```
## Testing
- [x] Tested locally
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## Type of Change
- [x] Bug fix
## Motivation and Context
Many CLI commands need to reference the system configurations for
`container`. Previously, CLI commands would try to load the system
configurations from the default application root location, regardless of
if `container` had been started with a custom application root location.
This PR fixes that issue by having each CLI command ping the APIServer's
health check service to get the correct app root path.
Closes https://github.com/apple/container/issues/1576
## Testing
- [x] Tested locally
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#1557.
- Replaces `executableURL` utility function for getting app executable
path with `executablePath`.
- Adds `FilePath.resolvingSymlinks()` extension.
- Also converts for FilePath for types in `ContainerVersion` target.
- Closes#1540.
- Use a published vminit image in the custom init example.
- Refine the integration test example in BUILDING.md to build in an
isolated app-root directory.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [x] Documentation update
## Motivation and Context
We don't make `latest` tags for vminit images, so the example would
fail.
## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
- Closes#1547.
- A negative progress value (e.g. from a race in progress events) would
produce a negative barLength and crash inside String(repeating:count:).
Wrap the computed length in max(0, ...) and add a regression test that
calls set(size: -10) and exercises draw(state:detail:).
- Closes#1581.
- This adds stop signal support to the cli. The priority is:
1. If an explicit stop signal is passed on the cli use this.
2. If not, check if there is a stop signal in the image config.
3. Finally, use the default (TERM).
- Replace `URL` with `FilePath` in `container copy` (#1557).
In addition, make `copyIn`/`copyOut` API to use `String` for path as we
need to preserve the trailing slash to the `LinuxContainer.copy`---i.e.,
this trailing slash is used in `LinuxContainer.copy` to determine copy
behavior.
J Logan