remove api server work + add runtime api

Author: saehejkang

Sources/APIServer/APIServer+Start.swift

@@ -297,8 +297,6 @@ extension APIServer {
             routes[XPCRoute.containerBootstrap] = XPCServer.route(harness.bootstrap)
             routes[XPCRoute.containerDial] = XPCServer.route(harness.dial)
             routes[XPCRoute.containerStop] = XPCServer.route(harness.stop)
-            routes[XPCRoute.containerFreeze] = XPCServer.route(harness.freeze)
-            routes[XPCRoute.containerThaw] = XPCServer.route(harness.thaw)
             routes[XPCRoute.containerStartProcess] = XPCServer.route(harness.startProcess)
             routes[XPCRoute.containerCreateProcess] = XPCServer.route(harness.createProcess)
             routes[XPCRoute.containerResize] = XPCServer.route(harness.resize)

Sources/Plugins/RuntimeLinux/RuntimeLinuxHelper+Start.swift

@@ -104,9 +104,9 @@ extension RuntimeLinuxHelper {
                         RuntimeRoutes.dial.rawValue: XPCServer.route(server.dial),
                         RuntimeRoutes.shutdown.rawValue: XPCServer.route(server.shutdown),
                         RuntimeRoutes.statistics.rawValue: XPCServer.route(server.statistics),
-                        RuntimeRoutes.filesystemOperation.rawValue: XPCServer.route(server.filesystemOperation),
                         RuntimeRoutes.copyIn.rawValue: XPCServer.route(server.copyIn),
                         RuntimeRoutes.copyOut.rawValue: XPCServer.route(server.copyOut),
+                        RuntimeRoutes.snapshotDisk.rawValue: XPCServer.route(server.snapshotDisk),
                     ],
                     log: log
                 )

Sources/Services/ContainerAPIService/Client/ContainerClient.swift

@@ -193,38 +193,6 @@ public struct ContainerClient: Sendable {
         }
     }
 
-    /// Freeze writes on the container root filesystem.
-    public func freeze(id: String) async throws {
-        do {
-            let request = XPCMessage(route: .containerFreeze)
-            request.set(key: .id, value: id)
-
-            try await xpcClient.send(request)
-        } catch {
-            throw ContainerizationError(
-                .internalError,
-                message: "failed to freeze container",
-                cause: error
-            )
-        }
-    }
-
-    /// Thaw writes on the container root filesystem.
-    public func thaw(id: String) async throws {
-        do {
-            let request = XPCMessage(route: .containerThaw)
-            request.set(key: .id, value: id)
-
-            try await xpcClient.send(request)
-        } catch {
-            throw ContainerizationError(
-                .internalError,
-                message: "failed to thaw container",
-                cause: error
-            )
-        }
-    }
-
     /// Delete the container along with any resources.
     public func delete(id: String, force: Bool = false) async throws {
         do {

Sources/Services/ContainerAPIService/Client/XPC+.swift

@@ -156,8 +156,6 @@ public enum XPCRoute: String {
     case containerWait
     case containerDelete
     case containerStop
-    case containerFreeze
-    case containerThaw
     case containerDial
     case containerResize
     case containerKill

Sources/Services/ContainerAPIService/Server/Containers/ContainersHarness.swift

@@ -77,32 +77,6 @@ public struct ContainersHarness: Sendable {
         return message.reply()
     }
 
-    @Sendable
-    public func freeze(_ message: XPCMessage) async throws -> XPCMessage {
-        let id = message.string(key: .id)
-        guard let id else {
-            throw ContainerizationError(
-                .invalidArgument,
-                message: "id cannot be empty"
-            )
-        }
-        try await service.freeze(id: id)
-        return message.reply()
-    }
-
-    @Sendable
-    public func thaw(_ message: XPCMessage) async throws -> XPCMessage {
-        let id = message.string(key: .id)
-        guard let id else {
-            throw ContainerizationError(
-                .invalidArgument,
-                message: "id cannot be empty"
-            )
-        }
-        try await service.thaw(id: id)
-        return message.reply()
-    }
-
     @Sendable
     public func dial(_ message: XPCMessage) async throws -> XPCMessage {
         let id = message.string(key: .id)

Sources/Services/ContainerAPIService/Server/Containers/ContainersService.swift

@@ -645,68 +645,6 @@ public actor ContainersService {
         try await handleContainerExit(id: id)
     }
 
-    /// Freeze writes on the root filesystem of a running container.
-    public func freeze(id: String) async throws {
-        log.debug(
-            "ContainersService: enter",
-            metadata: [
-                "func": "\(#function)",
-                "id": "\(id)",
-            ]
-        )
-        defer {
-            log.debug(
-                "ContainersService: exit",
-                metadata: [
-                    "func": "\(#function)",
-                    "id": "\(id)",
-                ]
-            )
-        }
-
-        let state = try self._getContainerState(id: id)
-        guard state.snapshot.status == .running else {
-            throw ContainerizationError(
-                .invalidState,
-                message: "container \(id) is \(state.snapshot.status) and cannot be frozen"
-            )
-        }
-
-        let client = try state.getClient()
-        try await client.filesystemOperation(operation: .freeze, path: "/")
-    }
-
-    /// Thaw writes on the root filesystem of a running container.
-    public func thaw(id: String) async throws {
-        log.debug(
-            "ContainersService: enter",
-            metadata: [
-                "func": "\(#function)",
-                "id": "\(id)",
-            ]
-        )
-        defer {
-            log.debug(
-                "ContainersService: exit",
-                metadata: [
-                    "func": "\(#function)",
-                    "id": "\(id)",
-                ]
-            )
-        }
-
-        let state = try self._getContainerState(id: id)
-        guard state.snapshot.status == .running else {
-            throw ContainerizationError(
-                .invalidState,
-                message: "container \(id) is \(state.snapshot.status) and cannot be thawed"
-            )
-        }
-
-        let client = try state.getClient()
-        try await client.filesystemOperation(operation: .thaw, path: "/")
-    }
-
     public func dial(id: String, port: UInt32) async throws -> FileHandle {
         log.debug(
             "ContainersService: enter",
@@ -973,23 +911,10 @@ public actor ContainersService {
 
         if live {
             let client = try state.getClient()
-            try await client.filesystemOperation(operation: .freeze, path: "/")
-            do {
-                try EXT4.EXT4Reader(blockDevice: FilePath(rootfs)).export(archive: FilePath(archive))
-            } catch {
-                do {
-                    try await client.filesystemOperation(operation: .thaw, path: "/")
-                } catch {
-                    self.log.error(
-                        "failed to thaw filesystem after live export error",
-                        metadata: [
-                            "id": "\(id)",
-                            "error": "\(error)",
-                        ])
-                }
-                throw error
-            }
-            try await client.filesystemOperation(operation: .thaw, path: "/")
+            let snapshot = rootfs.appendingPathExtension("snapshot")
+            defer { try? FileManager.default.removeItem(at: snapshot) }
+            try await client.snapshotDisk(imagePath: rootfs.path, destinationPath: snapshot.path)
+            try EXT4.EXT4Reader(blockDevice: FilePath(snapshot)).export(archive: FilePath(archive))
             return
         }
 

Sources/Services/Runtime/RuntimeClient/RuntimeClient.swift

@@ -319,25 +319,17 @@ extension RuntimeClient {
         }
     }
 
-    public func filesystemOperation(operation: FilesystemOperation, path: String) async throws {
-        let request = XPCMessage(route: RuntimeRoutes.filesystemOperation.rawValue)
-        request.set(
-            key: RuntimeKeys.filesystemOperation.rawValue,
-            value: {
-                switch operation {
-                case .freeze: "freeze"
-                case .thaw: "thaw"
-                case .trim: "trim"
-                }
-            }())
-        request.set(key: RuntimeKeys.filesystemPath.rawValue, value: path)
+    public func snapshotDisk(imagePath: String, destinationPath: String) async throws {
+        let request = XPCMessage(route: RuntimeRoutes.snapshotDisk.rawValue)
+        request.set(key: RuntimeKeys.imagePath.rawValue, value: imagePath)
+        request.set(key: RuntimeKeys.destinationPath.rawValue, value: destinationPath)
 
         do {
             try await self.client.send(request, responseTimeout: .seconds(300))
         } catch {
             throw ContainerizationError(
                 .internalError,
-                message: "failed to perform filesystem operation in container \(self.id)",
+                message: "failed to snapshot disk in container \(self.id)",
                 cause: error
             )
         }

Sources/Services/Runtime/RuntimeClient/RuntimeKeys.swift

@@ -48,15 +48,12 @@ public enum RuntimeKeys: String {
     case destinationPath
     case fileMode
     case createParents
+    /// Image path for snapshot operations
+    case imagePath
 
     /// Special-case environment variables recomputed on each container start
     case dynamicEnv
 
-    /// Filesystem operation to perform inside the guest.
-    case filesystemOperation
-    /// Target path for a guest filesystem operation.
-    case filesystemPath
-
     /// Per-network connection info passed to the runtime so it can allocate directly.
     case networkBootstrapInfos
 }

Sources/Services/Runtime/RuntimeClient/RuntimeRoutes.swift

@@ -52,10 +52,10 @@ public enum RuntimeRoutes: String {
     case exec = "com.apple.container.runtime/exec"
 
     // MARK: - File Management
-    /// Perform a filesystem operation inside the container.
-    case filesystemOperation = "com.apple.container.runtime/filesystemOperation"
     /// Copy a file or directory into the container.
     case copyIn = "com.apple.container.runtime/copyIn"
     /// Copy a file or directory out of the container.
     case copyOut = "com.apple.container.runtime/copyOut"
+    /// Snapshot the container's root filesystem to an image file.
+    case snapshotDisk = "com.apple.container.runtime/snapshotDisk"
 }

Sources/Services/RuntimeLinux/Server/RuntimeService.swift

@@ -772,35 +772,63 @@ public actor RuntimeService {
         }
     }
 
-    /// Perform a filesystem operation inside the container.
+    /// Snapshot the container's root filesystem by freezing it, cloning it to a destination image,
+    /// and then thawing it. This ensures the filesystem is frozen for the minimal duration.
     ///
     /// - Parameters:
     ///   - message: An XPC message with the following parameters:
-    ///     - filesystemOperation: The operation to perform.
-    ///     - filesystemPath: The target path inside the container.
+    ///     - imagePath: The path to the source filesystem image.
+    ///     - destinationPath: The path where the snapshot will be written.
     ///
     /// - Returns: An XPC message with no parameters.
     @Sendable
-    public func filesystemOperation(_ message: XPCMessage) async throws -> XPCMessage {
-        self.log.info("`filesystemOperation` xpc handler")
+    public func snapshotDisk(_ message: XPCMessage) async throws -> XPCMessage {
+        self.log.info("`snapshotDisk` xpc handler")
         switch self.state {
         case .running, .booted:
-            let operation = try message.filesystemOperation()
-            guard let path = message.string(key: RuntimeKeys.filesystemPath.rawValue) else {
+            guard let imagePath = message.string(key: RuntimeKeys.imagePath.rawValue) else {
                 throw ContainerizationError(
                     .invalidArgument,
-                    message: "no filesystem path supplied for filesystemOperation"
+                    message: "no image path supplied for snapshotDisk"
+                )
+            }
+            guard let destinationPath = message.string(key: RuntimeKeys.destinationPath.rawValue) else {
+                throw ContainerizationError(
+                    .invalidArgument,
+                    message: "no destination path supplied for snapshotDisk"
                 )
             }
 
             let ctr = try getContainer()
-            try await ctr.container.filesystemOperation(operation: operation, path: path)
+
+            // Freeze the filesystem
+            try await ctr.container.filesystemOperation(operation: .freeze, path: "/")
+
+            do {
+                // Clone the filesystem image atomically while frozen
+                try FileManager.default.copyItem(atPath: imagePath, toPath: destinationPath)
+            } catch {
+                // Ensure we thaw even on error
+                do {
+                    try await ctr.container.filesystemOperation(operation: .thaw, path: "/")
+                } catch {
+                    self.log.error(
+                        "failed to thaw filesystem after snapshotDisk error",
+                        metadata: [
+                            "error": "\(error)"
+                        ])
+                }
+                throw error
+            }
+
+            // Thaw the filesystem
+            try await ctr.container.filesystemOperation(operation: .thaw, path: "/")
 
             return message.reply()
         default:
             throw ContainerizationError(
                 .invalidState,
-                message: "cannot perform filesystem operation: container is not running"
+                message: "cannot snapshot disk: container is not running"
             )
         }
     }
@@ -1357,20 +1385,6 @@ extension XPCMessage {
         return dynamicEnv
     }
 
-    fileprivate func filesystemOperation() throws -> FilesystemOperation {
-        guard let operation = self.string(key: RuntimeKeys.filesystemOperation.rawValue) else {
-            throw ContainerizationError(.invalidArgument, message: "empty filesystem operation")
-        }
-        switch operation {
-        case "freeze":
-            return .freeze
-        case "thaw":
-            return .thaw
-        default:
-            throw ContainerizationError(.invalidArgument, message: "invalid filesystem operation \(operation)")
-        }
-    }
-
 }
 
 extension ContainerResource.Bundle {