0x4C33
57b07fa2ac
Closes https://github.com/apple/container/issues/1687 The default kernel archive is downloaded from a remote release URL during first-run setup and via `container system kernel set --recommended`. Previously, the archive contents were not verified after download, so integrity depended on HTTPS and the release artifact remaining unchanged. This change adds digest verification for kernel archives. The recommended/default kernel now has pinned digest metadata using an algorithm-prefixed value such as `sha256:<hex>`. `container system kernel set --tar` accepts `--digest`; remote tar URLs require it, and local tar archives can also be verified before unpacking and installation. The system config also supports `kernel.digest`, and a custom `kernel.url` must provide a digest for that archive.
2.8 KiB
Customize container default configuration values
Important
This file contains documentation for the CURRENT BRANCH. To find documentation for official releases, find the target release on the Release Page and click the tag corresponding to your release version.
Example: release 0.4.1 tag
Take a guided tour of setting configurations for container CLI commands and services.
Configuration sources
The container service loads values from these TOML files at startup, with first-match-wins precedence:
- Your user file at
~/.config/container/config.toml. - An optional file shipped with the
containerpackage install at<installRoot>/etc/container/config.toml.
Any key absent from both files falls back to a hardcoded default. For the full schema and defaults, see the config.toml reference.
Create a custom user TOML configuration file
The container service reads your file once at startup, so restart the service whenever you want changes to take effect.
Open or create your config file
Your editable config lives at ~/.config/container/config.toml. Create it if it does not exist:
mkdir -p ~/.config/container
touch ~/.config/container/config.toml
Set the values you want to customize
Open the file in the editor of your choice and add only the sections and keys you want to change.
For this tutorial, increase the default CPU and memory limits used for each new container and set a DNS domain for resolving container IP addresses from the host.
[container]
cpus = 8
memory = "4g"
[dns]
domain = "test"
Each top-level table maps directly to a section of ContainerSystemConfig.
Restart the container service
To make your edits take effect, stop and start the system:
container system stop
container system start
Verify the values are loaded
Use container system property list (alias ls) to print the merged configuration that the container service is using.
% container system property list
[build]
cpus = 2
memory = "2048mb"
rosetta = true
image = "ghcr.io/apple/container-builder-shim/builder:0.11.0"
[container]
cpus = 8
memory = "4gb"
[dns]
domain = "test"
[kernel]
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.15-186"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"
digest = "sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"
[network]
[registry]
domain = "docker.io"
[vminit]
image = "ghcr.io/apple/containerization/vminit:0.34.0"
For machine-readable output, pass --format json:
container system property list --format json