- Closes#457.
- A container can now declare additional DNS names for
a network attachment with a repeatable `alias` property
on `--network`, including subtree aliases that match
every name below a domain.
- With the default domain `test`, this container answers
to `gateway.test` by its name, to `api.test` by the exact
alias, and to `web.gateway.test`, `a.b.gateway.test`
and every other name below `gateway.test` by the
subtree alias. The motivating case is a gateway container
in front of a local Kubernetes cluster that answers for
`*.gateway.test`, with an ingress controller routing on
the `Host` header.
- An alias is an exact name, or a name with a leading
dot that matches every name below it. A name without
a dot gets the default domain, as container names do.
A subtree alias must be below a name the same
attachment owns, and exact names are unique across
all containers, so a container cannot claim another
container's namespace. The rules for one attachment
are checked when a container is created, again when
a stored container starts, and again by the network
helper when it registers the aliases. See
`docs/architecture/dns.md` for the design, the
invariants and the security considerations.
- The k8s load-image CLI command will issue a
ctr image tag command in the guest to make
the fully qualified name of an image available
when the image has a short name (such as
when building and testing locally). The ordering
of fully qualified name and source image name
was backwards, causing the command to
silently fail.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Closes#2321.
- Removes image script and ORAS resource extension
point handling for container machine user setup.
- Replaces image script resource with hardcoded script.
- Adds more flexible user setup options to
`container machine`.
- Updates container machine documentation to clearly
identify convenience-isolation tradeoffs.
- Skips the rootfs when the container was created with
`--read-only`, and skips block mounts whose options
include `ro`.
- Keeps trimming the remaining targets after a failure,
then throws one error listing each failed path with its
underlying error.
- Fixes#815.
- Relocates the API server info received from the health check
XPC to a `server` property.
- Fixes the server `version` property in the health check result
to contain only the version; previously it included text that was
already in sibling properties.
- Adds properties for host, client, paths, and resources.
- Adds these properties to the output of `container system status`,
in a table or as JSON (`--format json`). Daemon-sourced fields
populate only when the API server responds, so the command
degrades gracefully to a "server not running" view when the
daemon is stopped. System configuration values are not repeated
here — `container system property ls` already reports them.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Switch the default guest kernel from vmlinux-6.18.15-186
(kata-static-3.28.0) to the newer version and variant
vmlinux-6.18.35-197-debug (kata-static-3.32.0).
- The debug variant enables eBPF, kprobes, uprobes, ftrace
and BTF (kata-containers/kata-containers#12567).
Signed-off-by: Agam Dua <agam_dua@apple.com>
- Closes#2078.
- Move all K8s sources from the container-k8s executable
into a new ContainerK8s library target. Sources/Plugins/K8s/
becomes a thin entry point (K8sMain.swift) that calls
K8sCommand.main().
- closes#2043
- introduces the k8s plugin, allowing users to make single
node clusters with the kind base image
- other functionality is included as well such as creation,
deletion, and loading custom images
- When pulling warmup images for concurrent tests, save
the images to a cache directory under the application root.
- Serial tests that aren't testing pull can save time by restoring
a cached warmup image.
- When container is not running, the runtime helper
traverses the container's root fs and writes it to the
specified tar archive or stdout.
- When the container is running, the helper performs
the same operation but wraps it in freeze/thaw
to ensure data integrity for the resulting archive.
- Closes#2001.
- Handle "container exists" error gracefully instead
of failing, when trying to start the buildkit container.
- Move build tests to parallel suites, while the builder
lifecycle tests remain serial. Parallel builds don't
use the fixture lock that deletes and restarts the
builder and runs a build block in isolation.
Closes https://github.com/apple/container/issues/1687
The default kernel archive is downloaded from a remote release URL
during first-run setup and via `container system kernel set
--recommended`. Previously, the archive contents were not verified after
download, so integrity depended on HTTPS and the release artifact
remaining unchanged.
This change adds digest verification for kernel archives. The
recommended/default kernel now has pinned digest metadata using an
algorithm-prefixed value such as `sha256:<hex>`. `container system
kernel set --tar` accepts `--digest`; remote tar URLs require it, and
local tar archives can also be verified before unpacking and
installation.
The system config also supports `kernel.digest`, and a custom
`kernel.url` must provide a digest for that archive.
- Part of #1833.
- CLI progress and registry test migrations were inadventently reverted
by #1857.
- Migrate TestCLINoParallelCases to TestCLIImagePruneSerial and
TestCLINetworkPruneSerial.
- Clean up test selection patterns in Makefile.
- Remove all legacy CLITests files.
- Use swift-testing `withKnownIssue` to run but ignore failures on flaky
`testCreateNameLongestValid` and `testIsolatedNetwork`.
- Extracts a fixture helper for tests requiring a retry loop.
This PR cleans up some of the new IntegrationTests files to ensure that
each file has a single test suite defined within it and the name of the
file matches the name of the test suite.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
J Logan