mirror of
https://github.com/apple/container.git
synced 2026-11-05 21:43:24 +00:00
J Logan
b3eb70307a
- Closes #457. - A container can now declare additional DNS names for a network attachment with a repeatable `alias` property on `--network`, including subtree aliases that match every name below a domain. - With the default domain `test`, this container answers to `gateway.test` by its name, to `api.test` by the exact alias, and to `web.gateway.test`, `a.b.gateway.test` and every other name below `gateway.test` by the subtree alias. The motivating case is a gateway container in front of a local Kubernetes cluster that answers for `*.gateway.test`, with an ingress controller routing on the `Host` header. - An alias is an exact name, or a name with a leading dot that matches every name below it. A name without a dot gets the default domain, as container names do. A subtree alias must be below a name the same attachment owns, and exact names are unique across all containers, so a container cannot claim another container's namespace. The rules for one attachment are checked when a container is created, again when a stored container starts, and again by the network helper when it registers the aliases. See `docs/architecture/dns.md` for the design, the invariants and the security considerations.
93 lines
3.0 KiB
Swift
93 lines
3.0 KiB
Swift
//===----------------------------------------------------------------------===//
|
|
// Copyright © 2026 Apple Inc. and the container project authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// https://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
import ContainerNetworkClient
|
|
import ContainerResource
|
|
import ContainerXPC
|
|
import ContainerizationExtras
|
|
import Foundation
|
|
|
|
public actor NetworkHarness: Sendable {
|
|
private let service: NetworkService
|
|
|
|
public init(service: NetworkService) {
|
|
self.service = service
|
|
}
|
|
|
|
@Sendable
|
|
public func status(_ message: XPCMessage) async throws -> XPCMessage {
|
|
let reply = message.reply()
|
|
let status = try await service.status()
|
|
try reply.setStatus(status)
|
|
return reply
|
|
}
|
|
|
|
@Sendable
|
|
public func allocate(_ message: XPCMessage, _ session: XPCServerSession) async throws -> XPCMessage {
|
|
let hostname = try message.hostname()
|
|
let macAddress =
|
|
try message.string(key: NetworkKeys.macAddress.rawValue)
|
|
.map { try MACAddress($0) }
|
|
|
|
let aliases = try message.aliases()
|
|
|
|
let (attachment:attachment, additionalData:additionalData) = try await service.allocate(
|
|
hostname: hostname,
|
|
macAddress: macAddress,
|
|
aliases: aliases,
|
|
session: session
|
|
)
|
|
|
|
let reply = message.reply()
|
|
try reply.setAttachment(attachment)
|
|
if let additionalData {
|
|
try reply.setAdditionalData(additionalData.underlying)
|
|
}
|
|
|
|
return reply
|
|
}
|
|
|
|
@Sendable
|
|
public func lookup(_ message: XPCMessage) async throws -> XPCMessage {
|
|
let name = try message.name()
|
|
let reply = message.reply()
|
|
guard let match = try await service.lookup(name: name) else {
|
|
return reply
|
|
}
|
|
|
|
try reply.setAttachment(match.attachment)
|
|
reply.setMatchKind(match.kind)
|
|
return reply
|
|
}
|
|
}
|
|
|
|
extension XPCMessage {
|
|
fileprivate func setAdditionalData(_ additionalData: xpc_object_t) throws {
|
|
xpc_dictionary_set_value(self.underlying, NetworkKeys.additionalData.rawValue, additionalData)
|
|
}
|
|
|
|
fileprivate func setAttachment(_ attachment: Attachment) throws {
|
|
let data = try JSONEncoder().encode(attachment)
|
|
self.set(key: NetworkKeys.attachment.rawValue, value: data)
|
|
}
|
|
|
|
fileprivate func setStatus(_ status: NetworkStatus) throws {
|
|
let data = try JSONEncoder().encode(status)
|
|
self.set(key: NetworkKeys.status.rawValue, value: data)
|
|
}
|
|
|
|
}
|