mirror of
https://github.com/apple/container.git
synced 2026-10-15 10:39:21 +00:00
Michael Crosby
b438e97b93
apple/containerization currently runs containers in per-container VMs on macOS hosts via Virtualization.framework. This adds a second VMM backend so the same Swift orchestration layer (LinuxContainer / LinuxPod / Vminitd gRPC contract) runs on Linux hosts via cloud-hypervisor + KVM. **CloudHypervisor Swift package** (`Sources/CloudHypervisor/`) — a thin client for cloud-hypervisor's REST-over-UDS API, layered on AsyncHTTPClient. Endpoints cover VMM / VM lifecycle / hotplug (disk, fs, net, vsock, remove-device). Cross-platform (compiles on macOS for unit tests; consumed at runtime only by the Linux side of Containerization). **CH backend in Containerization** — one cloud-hypervisor subprocess per VM, gated behind `#if os(Linux)`. CHVirtualMachineManager / CHVirtualMachineInstance mirror the VZ shape behind the existing VirtualMachineManager / VirtualMachineInstance protocol. CHProcess and VirtiofsdProcess manage the binaries; CHHotplugProvider handles virtio-blk and virtio-fs runtime hotplug (with one virtiofsd per unique source-hash tag, refcounted across containers). **Linux host networking** — BridgeManager brings up a Linux bridge with an IPv4 subnet and (opt-in via `--enable-nat`) iptables MASQUERADE + scoped FORWARD rules. LinuxBridgedNetwork enslaves a fresh TAP per container to the bridge. State is recorded under `/run/containerization` so `cctl bridge delete` reverses exactly what create did. Bridge teardown verifies the link kind via sysfs to refuse deleting non-bridge interfaces. **cctl run / bridge** — end-to-end Linux container run path (image pull, ext4 rootfs assembly, VM boot, container exec) plus `cctl bridge create|delete` for the host network plumbing. **Build & dist** — `make linux-build` / `make linux-integration` build and exercise the host side inside an apple/container `--virtualization` dev container. `make dist-x86_64` produces a deployment tarball (cctl + cloud-hypervisor + virtiofsd + initfs + kernel) cross-compiled from the aarch64 dev container; pipeline documented in `docs/x86_64-build.md`. Static-musl C deps and the Zig cross compiler are pinned by SHA256. The host orchestrator runs as root. Per-VM runtime state lives under `/run/containerization/ch/<UUID>` with mode 0700; UDS sockets inside are bound with mode 0600. Vminitd's gRPC channel inherits that trust boundary — socket-file perms are the auth. Sandbox flags are upstream-secure by default. Two per-component opt-outs exist for the apple/container dev-container case (where the host seccomp profile SIGSYS-kills CH and virtiofsd): - `CONTAINERIZATION_NO_CH_SECCOMP=1` — `cloud-hypervisor --seccomp false`. - `CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1` — `virtiofsd --sandbox none`. Each emits a one-shot `logger.warning` at process start. Legacy alias `CONTAINERIZATION_RELAXED_SANDBOX=1` flips both. cctl spawns both binaries with `setsid` and a minimal env allowlist (PATH / HOME / RUST_LOG / RUST_BACKTRACE) so the parent's secrets don't leak to children. `make linux-integration` runs the cross-platform integration suite against a real cloud-hypervisor VM inside the dev container. Linux runs the cross-platform subset (`process true`/`false`/`echo hi`, virtiofs round-trip, hotplug); the macOS suite is unchanged. Signed-off-by: michael_crosby <michael_crosby@apple.com>
73 lines
2.9 KiB
Swift
73 lines
2.9 KiB
Swift
//===----------------------------------------------------------------------===//
|
|
// Copyright © 2026 Apple Inc. and the Containerization project authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// https://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
import CloudHypervisor
|
|
import Testing
|
|
|
|
@testable import Containerization
|
|
|
|
@Suite("Mount+CH")
|
|
struct MountCHTests {
|
|
@Test("block mount without options produces DiskConfig with readonly=false")
|
|
func blockNoOptions() {
|
|
let mount = Mount.block(format: "ext4", source: "/foo.img", destination: "/data")
|
|
let cfg = mount.chDiskConfig(id: "blk-0")
|
|
#expect(cfg?.path == "/foo.img")
|
|
#expect(cfg?.readonly == false)
|
|
#expect(cfg?.id == "blk-0")
|
|
#expect(cfg?.direct == nil)
|
|
#expect(cfg?.iommu == nil)
|
|
#expect(cfg?.pciSegment == nil)
|
|
}
|
|
|
|
@Test("block mount with 'ro' option produces DiskConfig with readonly=true")
|
|
func blockReadOnly() {
|
|
let mount = Mount.block(format: "ext4", source: "/foo.img", destination: "/data", options: ["ro"])
|
|
let cfg = mount.chDiskConfig(id: "blk-1")
|
|
#expect(cfg?.readonly == true)
|
|
}
|
|
|
|
@Test("non-block mount returns nil from chDiskConfig")
|
|
func chDiskConfigNilForNonBlock() {
|
|
let share = Mount.share(source: "/host", destination: "/guest")
|
|
#expect(share.chDiskConfig(id: "x") == nil)
|
|
|
|
let any = Mount.any(type: "tmpfs", source: "tmpfs", destination: "/tmp")
|
|
#expect(any.chDiskConfig(id: "x") == nil)
|
|
}
|
|
|
|
@Test("share mount produces FsConfig with tag and socket")
|
|
func shareMount() {
|
|
let mount = Mount.share(source: "/host/dir", destination: "/guest/dir")
|
|
let cfg = mount.chFsConfig(tag: "share0", socketPath: "/tmp/vfs.sock", id: "fs-0")
|
|
#expect(cfg?.tag == "share0")
|
|
#expect(cfg?.socket == "/tmp/vfs.sock")
|
|
#expect(cfg?.id == "fs-0")
|
|
#expect(cfg?.numQueues == nil)
|
|
#expect(cfg?.queueSize == nil)
|
|
#expect(cfg?.pciSegment == nil)
|
|
}
|
|
|
|
@Test("non-share mount returns nil from chFsConfig")
|
|
func chFsConfigNilForNonShare() {
|
|
let block = Mount.block(format: "ext4", source: "/foo.img", destination: "/data")
|
|
#expect(block.chFsConfig(tag: "t", socketPath: "/s", id: "x") == nil)
|
|
|
|
let any = Mount.any(type: "tmpfs", source: "tmpfs", destination: "/tmp")
|
|
#expect(any.chFsConfig(tag: "t", socketPath: "/s", id: "x") == nil)
|
|
}
|
|
}
|