Merge branch 'main' into fix-image-size

Author: Bortnyak

Package.resolved

@@ -23,7 +23,7 @@ import PackageDescription
 let releaseVersion = ProcessInfo.processInfo.environment["RELEASE_VERSION"] ?? "0.0.0"
 let gitCommit = ProcessInfo.processInfo.environment["GIT_COMMIT"] ?? "unspecified"
 let builderShimVersion = "0.7.0"
-let scVersion = "0.23.2"
+let scVersion = "0.24.5"
 
 let package = Package(
     name: "container",

Package.swift

@@ -25,6 +25,8 @@ import NIOHPACK
 import NIOHTTP2
 
 public struct Builder: Sendable {
+    public static let builderContainerId = "buildkit"
+
     let client: BuilderClientProtocol
     let clientAsync: BuilderClientAsyncProtocol
     let group: EventLoopGroup

Sources/ContainerBuild/Builder.swift

@@ -201,8 +201,7 @@ extension Application {
                 useRosetta ? nil : "--enable-qemu",
             ].compactMap { $0 }
 
-            let id = "buildkit"
-            try ContainerAPIClient.Utility.validEntityName(id)
+            try ContainerAPIClient.Utility.validEntityName(Builder.builderContainerId)
 
             let image = try await ClientImage.fetch(
                 reference: builderImage,
@@ -244,9 +243,9 @@ extension Application {
                 memory: memory
             )
 
-            var config = ContainerConfiguration(id: id, image: imageDesc, process: processConfig)
+            var config = ContainerConfiguration(id: Builder.builderContainerId, image: imageDesc, process: processConfig)
             config.resources = resources
-            config.labels = ["com.apple.container.resource.role": "builder"]
+            config.labels = [ResourceLabelKeys.role: ResourceRoleValues.builder]
             config.mounts = [
                 .init(
                     type: .tmpfs,
@@ -264,11 +263,15 @@ extension Application {
             // Enable Rosetta only if the user didn't ask to disable it
             config.rosetta = useRosetta
 
-            let network = try await ClientNetwork.get(id: ClientNetwork.defaultNetworkName)
-            guard case .running(_, let networkStatus) = network else {
+            guard let defaultNetwork = try await ClientNetwork.builtin else {
+                throw ContainerizationError(.invalidState, message: "default network is not present")
+            }
+            guard case .running(_, let networkStatus) = defaultNetwork else {
                 throw ContainerizationError(.invalidState, message: "default network is not running")
             }
-            config.networks = [AttachmentConfiguration(network: network.id, options: AttachmentOptions(hostname: id))]
+            config.networks = [
+                AttachmentConfiguration(network: defaultNetwork.id, options: AttachmentOptions(hostname: Builder.builderContainerId))
+            ]
             let subnet = networkStatus.ipv4Subnet
             let nameserver = IPv4Address(subnet.lower.value + 1).description
             let nameservers = dnsNameservers.isEmpty ? [nameserver] : dnsNameservers

Sources/ContainerCommands/Builder/BuilderStart.swift

@@ -54,20 +54,22 @@ extension Application {
             let uniqueNetworkNames = Set<String>(networkNames)
             let networks: [NetworkState]
 
-            if uniqueNetworkNames.contains(ClientNetwork.defaultNetworkName) {
-                throw ContainerizationError(
-                    .invalidArgument,
-                    message: "cannot delete the default network"
-                )
-            }
-
             if all {
                 networks = try await ClientNetwork.list()
-                    .filter { $0.id != ClientNetwork.defaultNetworkName }
+                    .filter { !$0.isBuiltin }
             } else {
                 networks = try await ClientNetwork.list()
                     .filter { c in
-                        uniqueNetworkNames.contains(c.id)
+                        guard uniqueNetworkNames.contains(c.id) else {
+                            return false
+                        }
+                        guard !c.isBuiltin else {
+                            throw ContainerizationError(
+                                .invalidArgument,
+                                message: "cannot delete a builtin network: \(c.id)"
+                            )
+                        }
+                        return true
                     }
 
                 // If one of the networks requested isn't present lets throw. We don't need to do

Sources/ContainerCommands/Network/NetworkDelete.swift

@@ -41,7 +41,7 @@ extension Application.NetworkCommand {
             }
 
             let networksToPrune = allNetworks.filter { network in
-                network.id != ClientNetwork.defaultNetworkName && !networksInUse.contains(network.id)
+                !network.isBuiltin && !networksInUse.contains(network.id)
             }
 
             var prunedNetworks = [String]()

Sources/ContainerCommands/Network/NetworkPrune.swift

@@ -20,7 +20,7 @@ import ContainerizationError
 import Foundation
 
 public enum DefaultsStore {
-    private static let userDefaultDomain = "com.apple.container.defaults"
+    public static let userDefaultDomain = "com.apple.container.defaults"
 
     public enum Keys: String {
         case buildRosetta = "build.rosetta"
@@ -181,9 +181,9 @@ extension DefaultsStore.Keys {
             }
             return "ghcr.io/apple/containerization/vminit:\(tag)"
         case .defaultKernelBinaryPath:
-            return "opt/kata/share/kata-containers/vmlinux-6.12.42-162"
+            return "opt/kata/share/kata-containers/vmlinux-6.18.5-177"
         case .defaultKernelURL:
-            return "https://github.com/kata-containers/kata-containers/releases/download/3.20.0/kata-static-3.20.0-arm64.tar.xz"
+            return "https://github.com/kata-containers/kata-containers/releases/download/3.26.0/kata-static-3.26.0-arm64.tar.zst"
         case .defaultSubnet:
             return "192.168.64.1/24"
         case .defaultIPv6Subnet:

Sources/ContainerPersistence/DefaultsStore.swift

@@ -0,0 +1,58 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the container project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+import Foundation
+
+/// Common properties for all managed resources.
+public protocol ManagedResource: Identifiable, Sendable, Codable {
+    /// A 64 byte hexadecimal string, assigned by the system, that uniquely
+    /// identifies the resource.
+    var id: String { get }
+
+    /// A user assigned name that shall be unique within the namespace of
+    /// the resource category. If the user does not assign a name, this value
+    /// shall be the same as the system-assigned identifier.
+    var name: String { get }
+
+    /// The time at which the system created the resource.
+    var creationDate: Date { get }
+
+    /// Key-value properties for the resource. The user and system may both
+    /// make use of labels to read and write annotations or other metadata.
+    /// A good practice is to use
+    var labels: [String: String] { get }
+
+    /// Generates a unique resource ID value.
+    static func generateId() -> String
+
+    /// Returns true only if the specified resource name is syntactically valid.
+    static func nameValid(_ name: String) -> Bool
+}
+
+extension ManagedResource {
+    /// Generate a random identifier that has the format of an ASCII SHA-256 hash.
+    public static func generateId() -> String {
+        (0..<2)
+            .map { _ in UInt128.random(in: 0...UInt128.max) }
+            .map { String($0, radix: 16).padding(toLength: 32, withPad: "0", startingAt: 0) }
+            .joined()
+    }
+}
+
+// FIXME: This moves to ManagedResource and/or a ResourceLabels typealias eventually.
+extension [String: String] {
+    public var isBuiltin: Bool { self.contains { $0 == ResourceLabelKeys.role && $1 == ResourceRoleValues.builtin } }
+}

Sources/ContainerResource/Common/ManagedResource.swift

@@ -0,0 +1,33 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the container project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+/// System-defined keys for resource labels.
+public struct ResourceLabelKeys {
+    /// Indicates a owner of a resource managed by a plugin.
+    public static let plugin = "com.apple.container.plugin"
+
+    /// Indicates a resource with a reserved or dedicated purpose.
+    public static let role = "com.apple.container.resource.role"
+}
+
+/// System-defined values for resource the resource role label.
+public struct ResourceRoleValues {
+    /// Indicates a container that can build images.
+    public static let builder = "builder"
+
+    /// Indicates a system-created resource that cannot be deleted by the user.
+    public static let builtin = "builtin"
+}

Sources/ContainerResource/Common/ResourceLabels.swift

@@ -57,15 +57,19 @@ public enum NetworkState: Codable, Sendable {
 
     public var id: String {
         switch self {
-        case .created(let configuration): configuration.id
-        case .running(let configuration, _): configuration.id
+        case .created(let config), .running(let config, _): config.id
         }
     }
 
     public var creationDate: Date {
         switch self {
-        case .created(let configuration): configuration.creationDate
-        case .running(let configuration, _): configuration.creationDate
+        case .created(let config), .running(let config, _): config.creationDate
+        }
+    }
+
+    public var isBuiltin: Bool {
+        switch self {
+        case .created(let config), .running(let config, _): config.labels.isBuiltin
         }
     }
 }