plumbing for service apis + sandbox

Author: saehejkang

Sources/APIServer/APIServer+Start.swift

@@ -297,6 +297,8 @@ extension APIServer {
             routes[XPCRoute.containerBootstrap] = XPCServer.route(harness.bootstrap)
             routes[XPCRoute.containerDial] = XPCServer.route(harness.dial)
             routes[XPCRoute.containerStop] = XPCServer.route(harness.stop)
+            routes[XPCRoute.containerFreeze] = XPCServer.route(harness.freeze)
+            routes[XPCRoute.containerThaw] = XPCServer.route(harness.thaw)
             routes[XPCRoute.containerStartProcess] = XPCServer.route(harness.startProcess)
             routes[XPCRoute.containerCreateProcess] = XPCServer.route(harness.createProcess)
             routes[XPCRoute.containerResize] = XPCServer.route(harness.resize)

Sources/Services/ContainerAPIService/Client/ContainerClient.swift

@@ -193,6 +193,38 @@ public struct ContainerClient: Sendable {
         }
     }
 
+    /// Freeze writes on the container root filesystem.
+    public func freeze(id: String) async throws {
+        do {
+            let request = XPCMessage(route: .containerFreeze)
+            request.set(key: .id, value: id)
+
+            try await xpcClient.send(request)
+        } catch {
+            throw ContainerizationError(
+                .internalError,
+                message: "failed to freeze container",
+                cause: error
+            )
+        }
+    }
+
+    /// Thaw writes on the container root filesystem.
+    public func thaw(id: String) async throws {
+        do {
+            let request = XPCMessage(route: .containerThaw)
+            request.set(key: .id, value: id)
+
+            try await xpcClient.send(request)
+        } catch {
+            throw ContainerizationError(
+                .internalError,
+                message: "failed to thaw container",
+                cause: error
+            )
+        }
+    }
+
     /// Delete the container along with any resources.
     public func delete(id: String, force: Bool = false) async throws {
         do {

Sources/Services/ContainerAPIService/Client/XPC+.swift

@@ -156,6 +156,8 @@ public enum XPCRoute: String {
     case containerWait
     case containerDelete
     case containerStop
+    case containerFreeze
+    case containerThaw
     case containerDial
     case containerResize
     case containerKill

Sources/Services/ContainerAPIService/Server/Containers/ContainersHarness.swift

@@ -77,6 +77,32 @@ public struct ContainersHarness: Sendable {
         return message.reply()
     }
 
+    @Sendable
+    public func freeze(_ message: XPCMessage) async throws -> XPCMessage {
+        let id = message.string(key: .id)
+        guard let id else {
+            throw ContainerizationError(
+                .invalidArgument,
+                message: "id cannot be empty"
+            )
+        }
+        try await service.freeze(id: id)
+        return message.reply()
+    }
+
+    @Sendable
+    public func thaw(_ message: XPCMessage) async throws -> XPCMessage {
+        let id = message.string(key: .id)
+        guard let id else {
+            throw ContainerizationError(
+                .invalidArgument,
+                message: "id cannot be empty"
+            )
+        }
+        try await service.thaw(id: id)
+        return message.reply()
+    }
+
     @Sendable
     public func dial(_ message: XPCMessage) async throws -> XPCMessage {
         let id = message.string(key: .id)

Sources/Services/ContainerAPIService/Server/Containers/ContainersService.swift

@@ -645,6 +645,68 @@ public actor ContainersService {
         try await handleContainerExit(id: id)
     }
 
+    /// Freeze writes on the root filesystem of a running container.
+    public func freeze(id: String) async throws {
+        log.debug(
+            "ContainersService: enter",
+            metadata: [
+                "func": "\(#function)",
+                "id": "\(id)",
+            ]
+        )
+        defer {
+            log.debug(
+                "ContainersService: exit",
+                metadata: [
+                    "func": "\(#function)",
+                    "id": "\(id)",
+                ]
+            )
+        }
+
+        let state = try self._getContainerState(id: id)
+        guard state.snapshot.status == .running else {
+            throw ContainerizationError(
+                .invalidState,
+                message: "container \(id) is \(state.snapshot.status) and cannot be frozen"
+            )
+        }
+
+        let client = try state.getClient()
+        try await client.filesystemOperation(operation: .freeze, path: "/")
+    }
+
+    /// Thaw writes on the root filesystem of a running container.
+    public func thaw(id: String) async throws {
+        log.debug(
+            "ContainersService: enter",
+            metadata: [
+                "func": "\(#function)",
+                "id": "\(id)",
+            ]
+        )
+        defer {
+            log.debug(
+                "ContainersService: exit",
+                metadata: [
+                    "func": "\(#function)",
+                    "id": "\(id)",
+                ]
+            )
+        }
+
+        let state = try self._getContainerState(id: id)
+        guard state.snapshot.status == .running else {
+            throw ContainerizationError(
+                .invalidState,
+                message: "container \(id) is \(state.snapshot.status) and cannot be thawed"
+            )
+        }
+
+        let client = try state.getClient()
+        try await client.filesystemOperation(operation: .thaw, path: "/")
+    }
+
     public func dial(id: String, port: UInt32) async throws -> FileHandle {
         log.debug(
             "ContainersService: enter",

Sources/Services/Runtime/RuntimeClient/RuntimeClient.swift

@@ -327,6 +327,7 @@ extension RuntimeClient {
                 switch operation {
                 case .freeze: "freeze"
                 case .thaw: "thaw"
+                case .trim: "trim"
                 }
             }())
         request.set(key: RuntimeKeys.filesystemPath.rawValue, value: path)