mirror of
https://github.com/apple/container.git
synced 2026-10-15 18:49:20 +00:00
Michael Crosby
b438e97b93
apple/containerization currently runs containers in per-container VMs on macOS hosts via Virtualization.framework. This adds a second VMM backend so the same Swift orchestration layer (LinuxContainer / LinuxPod / Vminitd gRPC contract) runs on Linux hosts via cloud-hypervisor + KVM. **CloudHypervisor Swift package** (`Sources/CloudHypervisor/`) — a thin client for cloud-hypervisor's REST-over-UDS API, layered on AsyncHTTPClient. Endpoints cover VMM / VM lifecycle / hotplug (disk, fs, net, vsock, remove-device). Cross-platform (compiles on macOS for unit tests; consumed at runtime only by the Linux side of Containerization). **CH backend in Containerization** — one cloud-hypervisor subprocess per VM, gated behind `#if os(Linux)`. CHVirtualMachineManager / CHVirtualMachineInstance mirror the VZ shape behind the existing VirtualMachineManager / VirtualMachineInstance protocol. CHProcess and VirtiofsdProcess manage the binaries; CHHotplugProvider handles virtio-blk and virtio-fs runtime hotplug (with one virtiofsd per unique source-hash tag, refcounted across containers). **Linux host networking** — BridgeManager brings up a Linux bridge with an IPv4 subnet and (opt-in via `--enable-nat`) iptables MASQUERADE + scoped FORWARD rules. LinuxBridgedNetwork enslaves a fresh TAP per container to the bridge. State is recorded under `/run/containerization` so `cctl bridge delete` reverses exactly what create did. Bridge teardown verifies the link kind via sysfs to refuse deleting non-bridge interfaces. **cctl run / bridge** — end-to-end Linux container run path (image pull, ext4 rootfs assembly, VM boot, container exec) plus `cctl bridge create|delete` for the host network plumbing. **Build & dist** — `make linux-build` / `make linux-integration` build and exercise the host side inside an apple/container `--virtualization` dev container. `make dist-x86_64` produces a deployment tarball (cctl + cloud-hypervisor + virtiofsd + initfs + kernel) cross-compiled from the aarch64 dev container; pipeline documented in `docs/x86_64-build.md`. Static-musl C deps and the Zig cross compiler are pinned by SHA256. The host orchestrator runs as root. Per-VM runtime state lives under `/run/containerization/ch/<UUID>` with mode 0700; UDS sockets inside are bound with mode 0600. Vminitd's gRPC channel inherits that trust boundary — socket-file perms are the auth. Sandbox flags are upstream-secure by default. Two per-component opt-outs exist for the apple/container dev-container case (where the host seccomp profile SIGSYS-kills CH and virtiofsd): - `CONTAINERIZATION_NO_CH_SECCOMP=1` — `cloud-hypervisor --seccomp false`. - `CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1` — `virtiofsd --sandbox none`. Each emits a one-shot `logger.warning` at process start. Legacy alias `CONTAINERIZATION_RELAXED_SANDBOX=1` flips both. cctl spawns both binaries with `setsid` and a minimal env allowlist (PATH / HOME / RUST_LOG / RUST_BACKTRACE) so the parent's secrets don't leak to children. `make linux-integration` runs the cross-platform integration suite against a real cloud-hypervisor VM inside the dev container. Linux runs the cross-platform subset (`process true`/`false`/`echo hi`, virtiofs round-trip, hotplug); the macOS suite is unchanged. Signed-off-by: michael_crosby <michael_crosby@apple.com>
116 lines
4.0 KiB
Makefile
116 lines
4.0 KiB
Makefile
# Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
BUILD_CONFIGURATION ?= debug
|
|
WARNINGS_AS_ERRORS ?= true
|
|
export GIT_COMMIT := $(shell git rev-parse HEAD)
|
|
export GIT_TAG := $(shell git describe --tags --exact-match 2>/dev/null || echo "")
|
|
export BUILD_TIME := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
SWIFT_WARNING_CONFIG := $(if $(filter-out false,$(WARNINGS_AS_ERRORS)),-Xswiftc -warnings-as-errors)
|
|
# MUSL_ARCH selects which Static Linux SDK triple to build against
|
|
# ($(MUSL_ARCH)-swift-linux-musl). Defaults to the host architecture
|
|
# so the in-tree aarch64 flow works unchanged, but callers can override
|
|
# (e.g. `make MUSL_ARCH=x86_64` for the dist-x86_64 cross-build path).
|
|
ifndef MUSL_ARCH
|
|
UNAME_M := $(shell uname -m)
|
|
ifeq ($(UNAME_M),arm64)
|
|
MUSL_ARCH := aarch64
|
|
else ifeq ($(UNAME_M),aarch64)
|
|
MUSL_ARCH := aarch64
|
|
else
|
|
MUSL_ARCH := x86_64
|
|
endif
|
|
endif
|
|
|
|
LIBC ?= musl
|
|
ifeq ($(LIBC),musl)
|
|
SWIFT_SDK_FLAGS := --swift-sdk $(MUSL_ARCH)-swift-linux-musl
|
|
endif
|
|
|
|
SWIFT_CONFIGURATION := $(SWIFT_SDK_FLAGS) $(SWIFT_WARNING_CONFIG) -Xlinker -s --disable-automatic-resolution
|
|
|
|
SWIFT_VERSION := 6.3.0
|
|
SWIFT_SDK_URL := https://download.swift.org/swift-6.3-release/static-sdk/swift-6.3-RELEASE/swift-6.3-RELEASE_static-linux-0.1.0.artifactbundle.tar.gz
|
|
SWIFT_SDK_CHECKSUM := d2078b69bdeb5c31202c10e9d8a11d6f66f82938b51a4b75f032ccb35c4c286c
|
|
SWIFT_SDK_PATH := /tmp/$(notdir $(SWIFT_SDK_URL))
|
|
|
|
SYSTEM_TYPE := $(shell uname -s)
|
|
ifeq ($(SYSTEM_TYPE),Darwin)
|
|
SWIFTLY_URL := https://download.swift.org/swiftly/darwin/swiftly.pkg
|
|
SWIFTLY_FILENAME := $(notdir $(SWIFTLY_URL))
|
|
SWIFTLY_BIN_DIR ?= ~/.swiftly/bin
|
|
SWIFT := $(SWIFTLY_BIN_DIR)/swift
|
|
else
|
|
SWIFT ?= swift
|
|
endif
|
|
BUILD_BIN_DIR := $(shell $(SWIFT) build -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --show-bin-path)
|
|
|
|
ifeq ($(SYSTEM_TYPE),Darwin)
|
|
MACOS_VERSION := $(shell sw_vers -productVersion)
|
|
MACOS_MAJOR := $(shell echo $(MACOS_VERSION) | cut -d. -f1)
|
|
MACOS_RELEASE_TYPE := $(shell sw_vers | grep ReleaseType)
|
|
endif
|
|
|
|
.DEFAULT_GOAL := all
|
|
|
|
# INSTALL_DIR is where built binaries land. Defaults to ./bin so the
|
|
# in-tree aarch64 flow is unchanged. The dist-x86_64 cross-build
|
|
# overrides this to keep its artifacts out of vminitd/bin/.
|
|
INSTALL_DIR ?= ./bin
|
|
|
|
.PHONY: all
|
|
all:
|
|
@echo Building vminitd and vmexec...
|
|
@mkdir -p $(INSTALL_DIR)
|
|
@rm -f $(INSTALL_DIR)/vminitd
|
|
@rm -f $(INSTALL_DIR)/vmexec
|
|
@$(SWIFT) --version
|
|
@$(SWIFT) build -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION)
|
|
@install "$(BUILD_BIN_DIR)/vminitd" $(INSTALL_DIR)/
|
|
@install "$(BUILD_BIN_DIR)/vmexec" $(INSTALL_DIR)/
|
|
|
|
.PHONY: cross-prep
|
|
cross-prep: swift linux-sdk
|
|
|
|
.PHONY: swiftly
|
|
swiftly:
|
|
@if ! command -v ${SWIFTLY_BIN_DIR}/swiftly > /dev/null 2>&1; then \
|
|
echo "Installing Swiftly..."; \
|
|
curl -o /var/tmp/$(SWIFTLY_FILENAME) $(SWIFTLY_URL) && \
|
|
installer -pkg /var/tmp/$(SWIFTLY_FILENAME) -target CurrentUserHomeDirectory && \
|
|
${SWIFTLY_BIN_DIR}/swiftly init --quiet-shell-followup --skip-install && \
|
|
. ~/.swiftly/env.sh && \
|
|
hash -r && \
|
|
rm /var/tmp/$(SWIFTLY_FILENAME); \
|
|
fi
|
|
|
|
.PHONY: swift
|
|
swift: swiftly
|
|
@echo Installing Swift $(SWIFT_VERSION)...
|
|
@${SWIFTLY_BIN_DIR}/swiftly install $(SWIFT_VERSION)
|
|
|
|
.PHONY: linux-sdk
|
|
linux-sdk:
|
|
@echo Installing Static Linux SDK...
|
|
@curl -L -o $(SWIFT_SDK_PATH) $(SWIFT_SDK_URL)
|
|
-@$(SWIFT) sdk install $(SWIFT_SDK_PATH) --checksum $(SWIFT_SDK_CHECKSUM)
|
|
@rm $(SWIFT_SDK_PATH)
|
|
|
|
.PHONY: clean
|
|
clean:
|
|
@echo Cleaning the vminitd build files...
|
|
@rm -f ./bin/vminitd
|
|
@rm -f ./bin/vmexec
|
|
@rm -rf .build
|