Use FilePath for PublishSocket.

Closes CHAOS-1459. Unblocks CHAOS-1463 (Parser).

Author: chrisgeo

Sources/ContainerResource/Container/PublishSocket.swift

@@ -20,21 +20,64 @@ import SystemPackage
 /// Represents a socket that should be published from container to host.
 public struct PublishSocket: Sendable, Codable {
     /// The path to the socket in the container.
-    public var containerPath: URL
+    public var containerPath: FilePath
 
     /// The path where the socket should appear on the host.
-    public var hostPath: URL
+    public var hostPath: FilePath
 
     /// File permissions for the socket on the host.
     public var permissions: FilePermissions?
 
     public init(
-        containerPath: URL,
-        hostPath: URL,
+        containerPath: FilePath,
+        hostPath: FilePath,
         permissions: FilePermissions? = nil
     ) {
         self.containerPath = containerPath
         self.hostPath = hostPath
         self.permissions = permissions
     }
+
+    private enum CodingKeys: String, CodingKey {
+        case containerPath
+        case hostPath
+        case permissions
+    }
+
+    /// Encode paths as plain JSON strings.
+    ///
+    /// Previously these fields were `URL`s; `JSONEncoder` special-cases `URL`
+    /// to encode as `absoluteString` (e.g. `"file:///var/run/docker.sock"`).
+    /// `FilePath`'s synthesized Codable conformance uses a keyed container
+    /// (`{"_storage": "..."}`), which would change the on-disk and XPC wire
+    /// format. We override that here to keep the value a flat JSON string;
+    /// the decoder accepts both the new clean form (`"/var/run/docker.sock"`)
+    /// and the legacy `URL`-encoded form (`"file:///..."`).
+    public func encode(to encoder: any Encoder) throws {
+        var container = encoder.container(keyedBy: CodingKeys.self)
+        try container.encode(containerPath.string, forKey: .containerPath)
+        try container.encode(hostPath.string, forKey: .hostPath)
+        try container.encodeIfPresent(permissions, forKey: .permissions)
+    }
+
+    public init(from decoder: any Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+        self.containerPath = try Self.decodePath(from: container, forKey: .containerPath)
+        self.hostPath = try Self.decodePath(from: container, forKey: .hostPath)
+        self.permissions = try container.decodeIfPresent(FilePermissions.self, forKey: .permissions)
+    }
+
+    /// Decode a `FilePath` from either a plain path string or a legacy
+    /// `URL.absoluteString` (e.g. `"file:///foo"`) for backward compatibility
+    /// with container bundles persisted before the migration to `FilePath`.
+    private static func decodePath(
+        from container: KeyedDecodingContainer<CodingKeys>,
+        forKey key: CodingKeys
+    ) throws -> FilePath {
+        let raw = try container.decode(String.self, forKey: key)
+        if raw.hasPrefix("file://"), let url = URL(string: raw), url.isFileURL {
+            return FilePath(url.path)
+        }
+        return FilePath(raw)
+    }
 }

Sources/Services/ContainerAPIService/Client/Parser.swift

@@ -22,6 +22,7 @@ import ContainerizationExtras
 import ContainerizationOCI
 import ContainerizationOS
 import Foundation
+import SystemPackage
 
 /// A parsed volume specification from user input
 public struct ParsedVolume {
@@ -787,8 +788,8 @@ public struct Parser {
 
             // Create and return PublishSocket object with validated paths
             return PublishSocket(
-                containerPath: URL(fileURLWithPath: containerPath),
-                hostPath: URL(fileURLWithPath: absoluteHostPath),
+                containerPath: FilePath(containerPath),
+                hostPath: FilePath(absoluteHostPath),
                 permissions: nil
             )
 

Sources/Services/RuntimeLinux/Server/RuntimeService.swift

@@ -999,9 +999,10 @@ public actor RuntimeService {
         }
 
         for publishedSocket in config.publishedSockets {
+            // UnixSocketConfiguration (Containerization) takes URL; convert from FilePath at the boundary.
             let socketConfig = UnixSocketConfiguration(
-                source: publishedSocket.containerPath,
-                destination: publishedSocket.hostPath,
+                source: URL(filePath: publishedSocket.containerPath.string),
+                destination: URL(filePath: publishedSocket.hostPath.string),
                 permissions: publishedSocket.permissions,
                 direction: .outOf
             )