Merge branch 'main' into k8s-plugin-upstream

Author: jshi991

.github/workflows/common.yml

@@ -94,6 +94,8 @@ jobs:
           LOG_ROOT="${APP_ROOT}/logs"
           echo "created data directory: ${APP_ROOT}"
           echo "hostname: $(hostname)"
+          echo "hw.physicalcpu: $(sysctl -n hw.physicalcpu)"
+          echo "hw.logicalcpu: $(sysctl -n hw.logicalcpu)"
           export NO_PROXY="${NO_PROXY},192.168.0.0/16,fe80::/10"
           echo NO_PROXY=${NO_PROXY}
           export no_proxy="${no_proxy},192.168.0.0/16,fe80::/10"

Sources/ContainerTestSupport/ContainerFixture+ImageHelpers.swift

@@ -15,6 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 import Foundation
+import SystemPackage
 import Testing
 
 // MARK: - Image inspect types
@@ -69,6 +70,27 @@ extension ContainerFixture {
         try run(args).check()
     }
 
+    /// Saves `image` to ``WarmupImage/cacheTarPath``, overwriting any existing archive.
+    ///
+    /// Called once per image by the `ImageWarmup` suite. No `--platform`/`--os`/`--arch`
+    /// is passed, so `image save` captures every platform the image supports.
+    public func cacheWarmupImage(_ image: WarmupImage) throws {
+        try FileManager.default.createDirectory(
+            atPath: WarmupImage.cacheDirectory.string, withIntermediateDirectories: true)
+        try run(["image", "save", "--output", image.cacheTarPath.string, image.rawValue])
+            .check("failed to cache \(image.rawValue)")
+    }
+
+    /// Reloads `image` from its cached tar archive rather than pulling over the network.
+    ///
+    /// Use this in serial tests to restore a warmup image after a destructive operation
+    /// (`image rm --all`, `image prune`) removes it from the store. Requires the
+    /// `ImageWarmup` suite to have already run and populated the cache.
+    public func restoreWarmupImage(_ image: WarmupImage) throws {
+        try run(["image", "load", "--input", image.cacheTarPath.string])
+            .check("failed to restore \(image.rawValue) from cache")
+    }
+
     /// Returns the full inspect output for an image, including variant information.
     public func doInspectImages(_ name: String) throws -> [ImageInspectOutput] {
         let result = try run(["image", "inspect", name]).check()

Sources/ContainerTestSupport/ContainerFixture.swift

@@ -80,38 +80,54 @@ public final class ContainerFixture: Sendable {
     public static func with<T>(_ body: (ContainerFixture) async throws -> T) async throws -> T {
         let testID = String(UUID().uuidString.prefix(8)).lowercased()
 
-        let scratchRoot =
-            ProcessInfo.processInfo.environment["CLITEST_SCRATCH_ROOT"]
-            .map { FilePath($0) }
-            ?? FilePath(FileManager.default.temporaryDirectory.path)
-
         let testName =
             Test.current.map { $0.name.hasSuffix("()") ? String($0.name.dropLast(2)) : $0.name }
             ?? testID
-        let suiteName = Test.current.map { "\(type(of: $0))" } ?? "unknown"
-
-        // Name the scratch directory so it's immediately identifiable when browsing:
-        // {sanitizedTestName}-{testID}
-        let safeName = testName.replacingOccurrences(
-            of: "[^a-zA-Z0-9]", with: "-", options: .regularExpression)
-        let testDir = scratchRoot.appending("\(safeName)-\(testID)")
-        try FileManager.default.createDirectory(
-            atPath: testDir.string, withIntermediateDirectories: true, attributes: nil)
-
+        // Test.current is a value describing the running test, not an instance of the suite
+        // type, so `type(of:)` always yields `Test` itself. Derive the suite from the test's
+        // fully-qualified ID instead (e.g. "IntegrationTests.TestCLIStatus/explicitTableFormat()/...")
+        // — the same identifier format used in the swift-testing event-stream JSON.
+        let testIdentifier = Test.current.map { "\($0.id)" }
+        let suiteName = testIdentifier?.split(separator: "/", maxSplits: 1).first.map(String.init) ?? "unknown"
+
+        // Swift Testing doesn't expose a stable per-case identifier or the case's arguments
+        // publicly, only `isParameterized`. Parameterized tests share one `testName` across all
+        // their concurrently-running cases, so fall back to the per-invocation `testID` to keep
+        // each case's log file distinct.
+        let isParameterized = Test.Case.current?.isParameterized ?? false
+        let logFileName = isParameterized ? "\(testName)-\(testID).log" : "\(testName).log"
+
+        // Set up logging before any fixture work (scratch dir creation, etc.) so a "test start"
+        // message is the first thing recorded — bookended by "test end" once `body` returns.
         var logger = Logger(label: "com.apple.container.test") { label in
             if let root = ProcessInfo.processInfo.environment["CLITEST_LOG_ROOT"], !root.isEmpty {
                 let path =
                     FilePath(root)
                     .appending("clitests")
                     .appending(suiteName)
-                    .appending(testName + ".log")
+                    .appending(logFileName)
                 if let handler = try? FileLogHandler(label: label, category: "clitests", path: path) {
                     return handler
                 }
             }
             return StreamLogHandler.standardOutput(label: label)
         }
         logger[metadataKey: "testID"] = "\(testID)"
+        logger[metadataKey: "test"] = "\(testIdentifier ?? testName)"
+        logger.info("test start")
+
+        let scratchRoot =
+            ProcessInfo.processInfo.environment["CLITEST_SCRATCH_ROOT"]
+            .map { FilePath($0) }
+            ?? FilePath(FileManager.default.temporaryDirectory.path)
+
+        // Name the scratch directory so it's immediately identifiable when browsing:
+        // {sanitizedTestName}-{testID}
+        let safeName = testName.replacingOccurrences(
+            of: "[^a-zA-Z0-9]", with: "-", options: .regularExpression)
+        let testDir = scratchRoot.appending("\(safeName)-\(testID)")
+        try FileManager.default.createDirectory(
+            atPath: testDir.string, withIntermediateDirectories: true, attributes: nil)
 
         let fixture = ContainerFixture(testID: testID, testDir: testDir, log: logger)
 
@@ -123,10 +139,14 @@ public final class ContainerFixture: Sendable {
 
         do {
             let result = try await body(fixture)
+            logger.info("test end", metadata: ["result": "pass"])
             await fixture.runCleanup()
+            logger.info("test cleaned up")
             return result
         } catch {
+            logger.info("test end", metadata: ["result": "fail", "error": "\(error)"])
             await fixture.runCleanup()
+            logger.info("test cleaned up")
             throw error
         }
     }

Sources/ContainerTestSupport/WarmupImage.swift

@@ -14,10 +14,29 @@
 // limitations under the License.
 //===----------------------------------------------------------------------===//
 
+import ContainerPersistence
+import SystemPackage
+
 /// Images preloaded by the ``ImageWarmup`` suite before concurrent tests run.
 /// Add new commonly-used images here; the warmup pass pulls them in parallel.
 public enum WarmupImage: String, CaseIterable, Sendable {
     case alpine320 = "ghcr.io/linuxcontainers/alpine:3.20"
     case alpine318 = "ghcr.io/linuxcontainers/alpine:3.18"
     case busybox136 = "ghcr.io/containerd/busybox:1.36"
+
+    /// Directory under app-root holding OCI tar archives of each warmup image.
+    ///
+    /// Living under app-root (rather than a scratch dir tied to a single
+    /// fixture) means the cache survives across the warmup/concurrent/serial
+    /// `swift test` invocations, which run as separate processes, and rides
+    /// along whatever process clears app-root between full test runs — no
+    /// dedicated cleanup needed.
+    public static var cacheDirectory: FilePath {
+        PathUtils.BaseConfigPath.appRoot.basePath().appending("test-image-cache")
+    }
+
+    /// Path to this image's cached OCI tar archive.
+    public var cacheTarPath: FilePath {
+        Self.cacheDirectory.appending("\(self).tar")
+    }
 }

Sources/Services/ContainerAPIService/Client/Flags.swift

@@ -178,6 +178,7 @@ public struct Flags {
             kernel: String?,
             kernelArgs: [String],
             labels: [String],
+            maskedPaths: [String],
             mounts: [String],
             name: String?,
             networks: [String],
@@ -186,6 +187,7 @@ public struct Flags {
             publishPorts: [String],
             publishSockets: [String],
             readOnly: Bool,
+            readonlyPaths: [String],
             remove: Bool,
             rosetta: Bool,
             runtime: String?,
@@ -208,6 +210,7 @@ public struct Flags {
             self.kernel = kernel
             self.kernelArgs = kernelArgs
             self.labels = labels
+            self.maskedPaths = maskedPaths
             self.mounts = mounts
             self.name = name
             self.networks = networks
@@ -216,6 +219,7 @@ public struct Flags {
             self.publishPorts = publishPorts
             self.publishSockets = publishSockets
             self.readOnly = readOnly
+            self.readonlyPaths = readonlyPaths
             self.remove = remove
             self.rosetta = rosetta
             self.runtime = runtime
@@ -291,6 +295,16 @@ public struct Flags {
         @Option(name: [.short, .customLong("label")], help: "Add a key=value label to the container")
         public var labels: [String] = []
 
+        /// EXPERIMENTAL: The flag is subject to change.
+        @Option(
+            name: .customLong("masked-path"),
+            help: .init(
+                "[EXPERIMENTAL] Hide a path inside the container, in addition to the runtime defaults (or NONE to clear prior values and the defaults)",
+                valueName: "path"
+            )
+        )
+        public var maskedPaths: [String] = []
+
         @Option(name: .customLong("mount"), help: "Add a mount to the container (format: type=<>,source=<>,target=<>,readonly)")
         public var mounts: [String] = []
 
@@ -330,6 +344,16 @@ public struct Flags {
         @Flag(name: .long, help: "Mount the container's root filesystem as read-only")
         public var readOnly = false
 
+        /// EXPERIMENTAL: The flag is subject to change.
+        @Option(
+            name: .customLong("read-only-path"),
+            help: .init(
+                "[EXPERIMENTAL] Mark a path inside the container read-only, in addition to the runtime defaults (or NONE to clear prior values and the defaults)",
+                valueName: "path"
+            )
+        )
+        public var readonlyPaths: [String] = []
+
         @Flag(name: [.customLong("rm"), .long], help: "Remove the container after it stops")
         public var remove = false
 

Sources/Services/ContainerAPIService/Client/Parser.swift

@@ -1056,6 +1056,60 @@ public struct Parser {
         return (normalizedAdd, normalizedDrop)
     }
 
+    // MARK: Security paths
+
+    /// Sentinel that clears all previously accumulated paths, including the runtime defaults.
+    private static let pathResetSentinel = "NONE"
+
+    /// Parse and validate --masked-path arguments.
+    ///
+    /// Values are processed in order on top of the runtime default set, so
+    /// `--masked-path /foo` yields the defaults plus `/foo`. The `NONE` sentinel
+    /// clears everything accumulated so far, including the defaults. A nil result
+    /// means the flag was not supplied and the runtime defaults apply unchanged.
+    public static func maskedPaths(_ values: [String]) throws -> [String]? {
+        try pathOverrides(values, defaults: LinuxContainer.defaultMaskedPaths(), flagName: "masked-path")
+    }
+
+    /// Parse and validate --read-only-path arguments. Ordering, the `NONE`
+    /// sentinel, and the nil result carry the same meaning as ``maskedPaths(_:)``.
+    public static func readonlyPaths(_ values: [String]) throws -> [String]? {
+        try pathOverrides(values, defaults: LinuxContainer.defaultReadonlyPaths(), flagName: "read-only-path")
+    }
+
+    /// Accumulate absolute paths on top of `defaults`, honoring the `NONE` reset
+    /// sentinel and dropping duplicates while preserving first-occurrence order.
+    private static func pathOverrides(_ values: [String], defaults: [String], flagName: String) throws -> [String]? {
+        guard !values.isEmpty else {
+            return nil
+        }
+        var paths = defaults
+        var seen = Set(defaults)
+        for value in values {
+            let trimmed = value.trimmingCharacters(in: .whitespaces)
+            if trimmed.uppercased() == pathResetSentinel {
+                paths = []
+                seen = []
+                continue
+            }
+            guard trimmed.hasPrefix("/") else {
+                throw ContainerizationError(
+                    .invalidArgument,
+                    message: "invalid path '\(value)' for --\(flagName): path must be absolute, or the \(pathResetSentinel) sentinel"
+                )
+            }
+            // Strip trailing slashes, preserving the root path itself.
+            var normalized = trimmed
+            while normalized.count > 1 && normalized.hasSuffix("/") {
+                normalized.removeLast()
+            }
+            if seen.insert(normalized).inserted {
+                paths.append(normalized)
+            }
+        }
+        return paths
+    }
+
     // MARK: Miscellaneous
 
     public static func parseBool(string: String) -> Bool? {

Sources/Services/ContainerAPIService/Client/Utility.swift

@@ -255,6 +255,8 @@ public struct Utility {
         let caps = try Parser.capabilities(capAdd: management.capAdd, capDrop: management.capDrop)
         config.capAdd = caps.capAdd
         config.capDrop = caps.capDrop
+        config.maskedPaths = try Parser.maskedPaths(management.maskedPaths)
+        config.readonlyPaths = try Parser.readonlyPaths(management.readonlyPaths)
         config.stopSignal = imageConfig?.stopSignal
 
         if let runtime = management.runtime {