Merge remote-tracking branch 'upstream/main' into feat/chaos-1456-sandbox-runtime-config

Author: chrisgeo

Sources/ContainerCommands/Image/ImageList.swift

@@ -46,7 +46,7 @@ extension Application {
 
         public mutating func run() async throws {
             let containerSystemConfig: ContainerSystemConfig = try await ConfigurationLoader.load()
-            try Self.validate(format: format, quiet: quiet, verbose: verbose)
+            try Self.validate(quiet: quiet, verbose: verbose)
 
             var images = try await ClientImage.list().filter { img in
                 !Utility.isInfraImage(name: img.reference, builderImage: containerSystemConfig.build.image, initImage: containerSystemConfig.vminit.image)
@@ -76,14 +76,10 @@ extension Application {
             Output.emit(Output.renderTable(items))
         }
 
-        private static func validate(format: ListFormat, quiet: Bool, verbose: Bool) throws {
+        private static func validate(quiet: Bool, verbose: Bool) throws {
             if quiet && verbose {
                 throw ContainerizationError(.invalidArgument, message: "cannot use flag --quiet and --verbose together")
             }
-            let modifier = quiet || verbose
-            if modifier && format == .json {
-                throw ContainerizationError(.invalidArgument, message: "cannot use flag --quiet or --verbose along with --format json")
-            }
         }
 
         private static func emitJSON(images: [ClientImage]) async throws {

Sources/ContainerCommands/Volume/VolumeList.swift

@@ -43,7 +43,8 @@ extension Application.VolumeCommand {
             let volumes = try await ClientVolume.list()
 
             if format == .json {
-                try Output.emit(Output.renderJSON(volumes))
+                let options = JSONOptions(dateEncodingStrategy: .iso8601)
+                try Output.emit(Output.renderJSON(volumes, options: options))
                 return
             }
 

Sources/Services/ContainerAPIService/Client/Flags.swift

@@ -344,6 +344,21 @@ public struct Flags {
 
         @Option(name: [.customLong("volume"), .short], help: "Bind mount a volume into the container")
         public var volumes: [String] = []
+
+        public func validate() throws {
+            if dnsDisabled {
+                let hasDNSConfig =
+                    !dns.nameservers.isEmpty
+                    || dns.domain != nil
+                    || !dns.options.isEmpty
+                    || !dns.searchDomains.isEmpty
+                if hasDNSConfig {
+                    throw ValidationError(
+                        "`--no-dns` cannot be used with DNS configuration flags (`--dns`, `--dns-domain`, `--dns-option`, `--dns-search`)"
+                    )
+                }
+            }
+        }
     }
 
     public struct Progress: ParsableArguments {

Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift

@@ -265,10 +265,16 @@ class TestCLINetwork: CLITest {
                 name,
                 curlImage,
                 "curl",
+                "--connect-timeout",
+                "5",
                 "http://google.com",
             ])
 
-            #expect(failed == 6, "external connection should fail")
+            // hostOnly mode blocks off-host traffic; depending on whether vmnet/firewall
+            // rejects (7) or drops (28) packets, or DNS itself can't reach an external
+            // resolver (6), curl will fail with one of these codes.
+            let hostOnlyBlockedCodes: Set<Int32> = [6, 7, 28]
+            #expect(hostOnlyBlockedCodes.contains(failed), "external connection should fail")
         }
     }
 

Tests/CLITests/Subcommands/Volumes/TestCLIAnonymousVolumes.swift

@@ -319,7 +319,9 @@ class TestCLIAnonymousVolumes: CLITest {
 
         // Parse JSON to verify metadata
         let data = output.data(using: .utf8)!
-        let volumes = try JSONDecoder().decode([Volume].self, from: data)
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .iso8601
+        let volumes = try decoder.decode([Volume].self, from: data)
 
         let anonVolume = volumes.first { $0.name == volumeName }
         #expect(anonVolume != nil, "should find anonymous volume in list")

Tests/ContainerAPIClientTests/ParserTest.swift

@@ -1296,4 +1296,44 @@ struct ParserTest {
         #expect(result.cpus == 2)
         #expect(result.memoryInBytes == 2048.mib())
     }
+
+    // MARK: - DNS Flag Validation Tests
+
+    @Test
+    func testManagementFlagsRejectsNoDNSWithDNS() throws {
+        #expect(throws: (any Error).self) {
+            _ = try Flags.Management.parse(["--dns", "1.1.1.1", "--no-dns"])
+        }
+    }
+
+    @Test
+    func testManagementFlagsRejectsNoDNSWithDNSDomain() throws {
+        #expect(throws: (any Error).self) {
+            _ = try Flags.Management.parse(["--dns-domain", "example.com", "--no-dns"])
+        }
+    }
+
+    @Test
+    func testManagementFlagsRejectsNoDNSWithDNSSearch() throws {
+        #expect(throws: (any Error).self) {
+            _ = try Flags.Management.parse(["--dns-search", "example.com", "--no-dns"])
+        }
+    }
+
+    @Test
+    func testManagementFlagsRejectsNoDNSWithDNSOption() throws {
+        #expect(throws: (any Error).self) {
+            _ = try Flags.Management.parse(["--dns-option", "debug", "--no-dns"])
+        }
+    }
+
+    @Test
+    func testManagementFlagsAcceptsDNSAlone() throws {
+        _ = try Flags.Management.parse(["--dns", "1.1.1.1"])
+    }
+
+    @Test
+    func testManagementFlagsAcceptsNoDNSAlone() throws {
+        _ = try Flags.Management.parse(["--no-dns"])
+    }
 }