Moving bundle creation to sandboxService

ajemory · ajemory · commit f812e9e1e7c6 · 2026-02-03T02:39:08.000-08:00
diff --git a/Sources/ContainerResource/Container/Bundle.swift b/Sources/ContainerResource/Container/Bundle.swift
@@ -18,6 +18,31 @@ import Containerization
 import ContainerizationError
 import Foundation
 
+public struct BundleMetadata: Codable, Sendable {
+    public let path: URL
+    public let initialFilesystem: Filesystem
+    public let kernel: Kernel
+    public let containerConfiguration: ContainerConfiguration?
+    public let containerRootFilesystem: Filesystem?
+    public let options: ContainerCreateOptions?
+
+    public init(
+        path: URL,
+        initialFilesystem: Filesystem,
+        kernel: Kernel,
+        containerConfiguration: ContainerConfiguration? = nil,
+        containerRootFilesystem: Filesystem? = nil,
+        options: ContainerCreateOptions? = nil
+    ) {
+        self.path = path
+        self.initialFilesystem = initialFilesystem
+        self.kernel = kernel
+        self.containerConfiguration = containerConfiguration
+        self.containerRootFilesystem = containerRootFilesystem
+        self.options = options
+    }
+}
+
 public struct Bundle: Sendable {
     private static let initfsFilename = "initfs.ext4"
     private static let kernelFilename = "kernel.json"
@@ -109,6 +134,46 @@ extension Bundle {
         }
         return bundle
     }
+
+    public static func createFromMetadata(_ metadata: BundleMetadata) throws -> Bundle {
+        let bundle = try create(
+            path: metadata.path,
+            initialFilesystem: metadata.initialFilesystem,
+            kernel: metadata.kernel,
+            containerConfiguration: metadata.containerConfiguration
+        )
+
+        if let containerRootFs = metadata.containerRootFilesystem {
+            let readonly = metadata.containerConfiguration?.readOnly ?? false
+            try bundle.setContainerRootFs(cloning: containerRootFs, readonly: readonly)
+        }
+
+        if let options = metadata.options {
+            try bundle.write(filename: "options.json", value: options)
+        }
+
+        return bundle
+    }
+
+    public static func writeMetadata(
+        _ metadata: BundleMetadata,
+        to metadataPath: URL
+    ) throws {
+        let data = try JSONEncoder().encode(metadata)
+        try data.write(to: metadataPath)
+    }
+
+    public static func readMetadata(from metadataPath: URL) throws -> BundleMetadata {
+        guard FileManager.default.fileExists(atPath: metadataPath.path) else {
+            throw ContainerizationError(
+                .notFound,
+                message: "Bundle metadata file not found at path: \(metadataPath.path)"
+            )
+        }
+
+        let data = try Data(contentsOf: metadataPath)
+        return try JSONDecoder().decode(BundleMetadata.self, from: data)
+    }
 }
 
 extension Bundle {
diff --git a/Sources/Helpers/RuntimeLinux/RuntimeLinuxHelper+Start.swift b/Sources/Helpers/RuntimeLinux/RuntimeLinuxHelper+Start.swift
@@ -89,6 +89,7 @@ extension RuntimeLinuxHelper {
                     connection: anonymousConnection,
                     routes: [
                         SandboxRoutes.bootstrap.rawValue: server.bootstrap,
+                        SandboxRoutes.createBundle.rawValue: server.createBundle,
                         SandboxRoutes.createProcess.rawValue: server.createProcess,
                         SandboxRoutes.state.rawValue: server.state,
                         SandboxRoutes.stop.rawValue: server.stop,
diff --git a/Sources/Services/ContainerAPIService/Server/Containers/ContainersService.swift b/Sources/Services/ContainerAPIService/Server/Containers/ContainersService.swift
@@ -235,17 +235,23 @@ public actor ContainersService {
             let systemPlatform = kernel.platform
             let initFs = try await self.getInitBlock(for: systemPlatform.ociPlatform())
 
-            let bundle = try ContainerResource.Bundle.create(
-                path: path,
-                initialFilesystem: initFs,
-                kernel: kernel,
-                containerConfiguration: configuration
-            )
+            let metadataPath = FileManager.default.temporaryDirectory
+                .appendingPathComponent("bundle-metadata-\(configuration.id).json")
+
             do {
                 let containerImage = ClientImage(description: configuration.image)
                 let imageFs = try await containerImage.getCreateSnapshot(platform: configuration.platform)
-                try bundle.setContainerRootFs(cloning: imageFs, readonly: configuration.readOnly)
-                try bundle.write(filename: "options.json", value: options)
+
+                let completeMetadata = BundleMetadata(
+                    path: path,
+                    initialFilesystem: initFs,
+                    kernel: kernel,
+                    containerConfiguration: configuration,
+                    containerRootFilesystem: imageFs,
+                    options: options
+                )
+
+                try ContainerResource.Bundle.writeMetadata(completeMetadata, to: metadataPath)
 
                 let snapshot = ContainerSnapshot(
                     configuration: configuration,
@@ -255,11 +261,8 @@ public actor ContainersService {
                 )
                 await self.setContainerState(configuration.id, ContainerState(snapshot: snapshot), context: context)
             } catch {
-                do {
-                    try bundle.delete()
-                } catch {
-                    self.log.error("failed to delete bundle for container \(configuration.id): \(error)")
-                }
+                try? FileManager.default.removeItem(at: metadataPath)
+                self.log.error("failed to cleanup metadata file for container \(configuration.id)")
                 throw error
             }
         }
@@ -279,8 +282,7 @@ public actor ContainersService {
             }
 
             let path = self.containerRoot.appendingPathComponent(id)
-            let bundle = ContainerResource.Bundle(path: path)
-            let config = try bundle.configuration
+            let config = try await self.getContainerConfiguration(for: id, at: path)
 
             do {
                 try Self.registerService(
@@ -295,6 +297,13 @@ public actor ContainersService {
                     id: id,
                     runtime: runtime
                 )
+
+                // Create bundle if it doesn't exist
+                if !(await self.bundleExists(at: path)) {
+                    let metadataPath = Self.getMetadataPath(for: id)
+                    try await sandboxClient.createBundle(metadataPath: metadataPath)
+                }
+
                 try await sandboxClient.bootstrap(stdio: stdio)
 
                 try await self.exitMonitor.registerProcess(
@@ -596,15 +605,39 @@ public actor ContainersService {
         // the OCI runtime.
         await self.exitMonitor.stopTracking(id: id)
         let path = self.containerRoot.appendingPathComponent(id)
+
+        // Try to get config for service deregistration, but don't fail if bundle is incomplete
+        var config: ContainerConfiguration?
         let bundle = ContainerResource.Bundle(path: path)
-        let config = try bundle.configuration
+        do {
+            config = try bundle.configuration
+        } catch {
+            self.log.warning("Unable to read bundle configuration during cleanup for container \(id): \(error)")
+        }
+
+        // Only try to deregister service if we have a valid config
+        if let config = config {
+            let label = Self.fullLaunchdServiceLabel(
+                runtimeName: config.runtimeHandler,
+                instanceId: id
+            )
+            try? ServiceManager.deregister(fullServiceLabel: label)
+        }
+
+        // Always try to delete the bundle directory, even if it's incomplete
+        do {
+            try bundle.delete()
+        } catch {
+            self.log.warning("Failed to delete bundle for container \(id): \(error)")
+            // Still try to remove the directory manually if bundle.delete() fails
+            try? FileManager.default.removeItem(at: path)
+        }
+
+        // If a container is created and immediately removed (without starting),
+        // the temp bundle metadata file never gets removed (so do that now)
+        let metadataPath = Self.getMetadataPath(for: id)
+        try? FileManager.default.removeItem(at: metadataPath)
 
-        let label = Self.fullLaunchdServiceLabel(
-            runtimeName: config.runtimeHandler,
-            instanceId: id
-        )
-        try ServiceManager.deregister(fullServiceLabel: label)
-        try bundle.delete()
         self.containers.removeValue(forKey: id)
     }
 
@@ -668,6 +701,43 @@ public actor ContainersService {
     private static func isInitProcess(id: String, processID: String) -> Bool {
         id == processID
     }
+
+    /// Check if a bundle exists at the given path
+    private func bundleExists(at path: URL) async -> Bool {
+        guard FileManager.default.fileExists(atPath: path.path) else {
+            return false
+        }
+
+        let bundle = ContainerResource.Bundle(path: path)
+        do {
+            _ = try bundle.configuration
+            return true
+        } catch {
+            return false
+        }
+    }
+
+    /// Get metadata file path for the given container ID
+    private static func getMetadataPath(for containerID: String) -> URL {
+        FileManager.default.temporaryDirectory
+            .appendingPathComponent("bundle-metadata-\(containerID).json")
+    }
+
+    /// Get container configuration, either from existing bundle or from metadata
+    private func getContainerConfiguration(for id: String, at path: URL) async throws -> ContainerConfiguration {
+        guard await bundleExists(at: path) else {
+            // Bundle doesn't exist, get config from metadata
+            let metadataPath = Self.getMetadataPath(for: id)
+            let metadata = try ContainerResource.Bundle.readMetadata(from: metadataPath)
+            guard let config = metadata.containerConfiguration else {
+                throw ContainerizationError(.internalError, message: "Metadata missing container configuration")
+            }
+            return config
+        }
+        // Bundle exists, read config normally
+        let bundle = ContainerResource.Bundle(path: path)
+        return try bundle.configuration
+    }
 }
 
 extension XPCMessage {
diff --git a/Sources/Services/ContainerSandboxService/Client/SandboxClient.swift b/Sources/Services/ContainerSandboxService/Client/SandboxClient.swift
@@ -106,6 +106,20 @@ extension SandboxClient {
         }
     }
 
+    public func createBundle(metadataPath: URL) async throws {
+        let request = XPCMessage(route: SandboxRoutes.createBundle.rawValue)
+        request.set(key: SandboxKeys.metadataPath.rawValue, value: metadataPath.path)
+        do {
+            _ = try await self.client.send(request)
+        } catch {
+            throw ContainerizationError(
+                .internalError,
+                message: "failed to create bundle for container \(self.id)",
+                cause: error
+            )
+        }
+    }
+
     public func state() async throws -> SandboxSnapshot {
         let request = XPCMessage(route: SandboxRoutes.state.rawValue)
         let response: XPCMessage
diff --git a/Sources/Services/ContainerSandboxService/Client/SandboxKeys.swift b/Sources/Services/ContainerSandboxService/Client/SandboxKeys.swift
@@ -42,4 +42,6 @@ public enum SandboxKeys: String {
 
     /// Container statistics
     case statistics
+    /// Path to bundle metadata file
+    case metadataPath
 }
diff --git a/Sources/Services/ContainerSandboxService/Client/SandboxRoutes.swift b/Sources/Services/ContainerSandboxService/Client/SandboxRoutes.swift
@@ -41,4 +41,6 @@ public enum SandboxRoutes: String {
     case shutdown = "com.apple.container.sandbox/shutdown"
     /// Get statistics for the sandbox.
     case statistics = "com.apple.container.sandbox/statistics"
+    /// Create bundle from metadata.
+    case createBundle = "com.apple.container.sandbox/createBundle"
 }
diff --git a/Sources/Services/ContainerSandboxService/Server/SandboxService.swift b/Sources/Services/ContainerSandboxService/Server/SandboxService.swift
@@ -60,7 +60,29 @@ public actor SandboxService {
         return nil
     }
 
-    /// Create an instance with a bundle that describes the container.
+    /// Create bundle from metadata file
+    @Sendable
+    public func createBundle(_ message: XPCMessage) async throws -> XPCMessage {
+        self.log.info("`createBundle` xpc handler")
+
+        guard let metadataPathString = message.string(key: SandboxKeys.metadataPath.rawValue) else {
+            throw ContainerizationError(.invalidArgument, message: "missing metadata path in createBundle xpc message")
+        }
+
+        let metadataPath = URL(fileURLWithPath: metadataPathString)
+
+        do {
+            let metadata = try ContainerResource.Bundle.readMetadata(from: metadataPath)
+            _ = try ContainerResource.Bundle.createFromMetadata(metadata)
+            try FileManager.default.removeItem(at: metadataPath)
+            self.log.info("Created bundle from metadata at \(metadata.path)")
+        } catch {
+            try? FileManager.default.removeItem(at: metadataPath)
+            throw error
+        }
+
+        return message.reply()
+    }
     ///
     /// - Parameters:
     ///   - root: The file URL for the bundle root.

Original file line number	Diff line number	Diff line change
`@@ -42,4 +42,6 @@ public enum SandboxKeys: String {`
`42`	`42`
`43`	`43`	`/// Container statistics`
`44`	`44`	`case statistics`
	`45`	`+ /// Path to bundle metadata file`
	`46`	`+ case metadataPath`
`45`	`47`	`}`
Original file line number	Diff line number	Diff line change
`@@ -41,4 +41,6 @@ public enum SandboxRoutes: String {`
`41`	`41`	`case shutdown = "com.apple.container.sandbox/shutdown"`
`42`	`42`	`/// Get statistics for the sandbox.`
`43`	`43`	`case statistics = "com.apple.container.sandbox/statistics"`
	`44`	`+ /// Create bundle from metadata.`
	`45`	`+ case createBundle = "com.apple.container.sandbox/createBundle"`
`44`	`46`	`}`