Update container clean for mount namespace trimming - #1
Closed
recrack wants to merge 21 commits into
Closed
Conversation
- Closes apple#1982. - Makes warmup image code more readable in tests.
- Closes apple#2001. - Handle "container exists" error gracefully instead of failing, when trying to start the buildkit container. - Move build tests to parallel suites, while the builder lifecycle tests remain serial. Parallel builds don't use the fixture lock that deletes and restarts the builder and runs a build block in isolation.
Signed-off-by: Ari Rubinstein <22369+arirubinstein@users.noreply.github.com> Co-authored-by: Ari Rubinstein <22369+arirubinstein@users.noreply.github.com>
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
…, and validate plugin name (apple#2027) Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com> Co-authored-by: John Logan <john_logan@apple.com> Co-authored-by: Raj Aryan Singh <rajaryan_singh@apple.com>
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- When container is not running, the runtime helper traverses the container's root fs and writes it to the specified tar archive or stdout. - When the container is running, the helper performs the same operation but wraps it in freeze/thaw to ensure data integrity for the resulting archive.
) Each container runs in its own guest VM sized to `--memory` with no swap, so the guest kernel's stock `vm` sysctl defaults are hit far too easily: - `vm.overcommit_memory=0` (heuristic overcommit) rejects an oversized `mmap()` upfront whenever the reservation exceeds the small, swap-less VM's free RAM — even if the memory is never touched — returning `ENOMEM`. - `vm.max_map_count=65530` caps per-process mapping count, which mapping-heavy applications (e.g. Elasticsearch, many JVMs) can exceed.
7 tasks
Author
|
Closing this fork-targeted PR in favor of the official upstream draft apple#2068. The branch and commit history remain preserved in recrack/container. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
This updates
container-clean-commandwithout opening a duplicate pull request againstapple/container.apple/containermaininto the clean-command branch and resolve the API/test-fixture conflictslstat().st_blocksand poll for asynchronous allocation/reclaim changesCompanion change
Named volumes are mounted in the workload container's mount namespace, not vminitd's namespace. The companion draft apple/containerization#830 carries the workload identity through filesystem-operation RPCs and resolves targets through the managed init process root.
This PR should remain a draft until that API shape is agreed and the dependency revision can be updated to the merged containerization commit.
Testing
make fmtswift build -Xswiftc -warnings-as-errors --build-testsmake containervminit:latestCommit structure
mainand resolve conflictsBoth commits are SSH signed locally. GitHub currently reports the key as unknown because this machine's authentication key has not yet been registered separately as a signing key.