Merge branch 'main' into fix-image-size

Bortnyak · web-flow · commit f1ba52f6bae8 · 2026-02-07T18:48:56.000+01:00
diff --git a/Package.swift b/Package.swift
@@ -22,7 +22,7 @@ import PackageDescription
 
 let releaseVersion = ProcessInfo.processInfo.environment["RELEASE_VERSION"] ?? "0.0.0"
 let gitCommit = ProcessInfo.processInfo.environment["GIT_COMMIT"] ?? "unspecified"
-let builderShimVersion = "0.7.0"
+let builderShimVersion = "0.8.0"
 let scVersion = "0.25.0"
 
 let package = Package(
diff --git a/Sources/ContainerBuild/BuildFSSync.swift b/Sources/ContainerBuild/BuildFSSync.swift
@@ -18,6 +18,7 @@ import Collections
 import ContainerAPIClient
 import ContainerizationArchive
 import ContainerizationOCI
+import CryptoKit
 import Foundation
 import GRPC
 
@@ -199,7 +200,7 @@ actor BuildFSSync: BuildPipelineHandler {
             format: .paxRestricted,
             filter: .none)
 
-        try Archiver.compress(
+        let tarHash = try Archiver.compress(
             source: contextDir,
             destination: tarURL,
             writerConfiguration: writerCfg
@@ -229,6 +230,25 @@ actor BuildFSSync: BuildPipelineHandler {
                 pathInArchive: URL(fileURLWithPath: rel))
         }
 
+        let hash = tarHash.compactMap { String(format: "%02x", $0) }.joined()
+        let header = BuildTransfer(
+            id: packet.id,
+            source: tarURL.path,
+            complete: false,
+            isDir: false,
+            metadata: [
+                "os": "linux",
+                "stage": "fssync",
+                "mode": "tar",
+                "hash": hash,
+            ]
+        )
+        var resp = ClientStream()
+        resp.buildID = buildID
+        resp.buildTransfer = header
+        resp.packetType = .buildTransfer(header)
+        sender.yield(resp)
+
         for try await chunk in try tarURL.bufferedCopyReader() {
             let part = BuildTransfer(
                 id: packet.id,
diff --git a/Sources/ContainerCommands/AggregateError.swift b/Sources/ContainerCommands/AggregateError.swift
@@ -0,0 +1,32 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the container project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+/// An error type that aggregates multiple errors into one.
+///
+/// When displayed, each underlying error is printed on its own line.
+public struct AggregateError: Swift.Error, Sendable {
+    public let errors: [any Error]
+
+    public init(_ errors: [any Error]) {
+        self.errors = errors
+    }
+}
+
+extension AggregateError: CustomStringConvertible {
+    public var description: String {
+        errors.map { String(describing: $0) }.joined(separator: "\n")
+    }
+}
diff --git a/Sources/ContainerCommands/Container/ContainerCreate.swift b/Sources/ContainerCommands/Container/ContainerCreate.swift
@@ -78,7 +78,8 @@ extension Application {
                 resource: resourceFlags,
                 registry: registryFlags,
                 imageFetch: imageFetchFlags,
-                progressUpdate: progress.handler
+                progressUpdate: progress.handler,
+                log: log
             )
 
             let options = ContainerCreateOptions(autoRemove: managementFlags.remove)
diff --git a/Sources/ContainerCommands/Container/ContainerDelete.swift b/Sources/ContainerCommands/Container/ContainerDelete.swift
@@ -81,11 +81,10 @@ extension Application {
                 }
             }
 
-            var failed = [String]()
+            var errors: [any Error] = []
             let force = self.force
             let all = self.all
-            let logger = log
-            try await withThrowingTaskGroup(of: String?.self) { group in
+            try await withThrowingTaskGroup(of: (any Error)?.self) { group in
                 for container in containers {
                     group.addTask {
                         do {
@@ -100,25 +99,20 @@ extension Application {
                             print(container.id)
                             return nil
                         } catch {
-                            logger.error("failed to delete container \(container.id): \(error)")
-                            return container.id
+                            return error
                         }
                     }
                 }
 
-                for try await ctr in group {
-                    guard let ctr else {
-                        continue
+                for try await error in group {
+                    if let error {
+                        errors.append(error)
                     }
-                    failed.append(ctr)
                 }
             }
 
-            if failed.count > 0 {
-                throw ContainerizationError(
-                    .internalError,
-                    message: "delete failed for one or more containers: \(failed)"
-                )
+            if !errors.isEmpty {
+                throw AggregateError(errors)
             }
         }
     }
diff --git a/Sources/ContainerCommands/Container/ContainerKill.swift b/Sources/ContainerCommands/Container/ContainerKill.swift
@@ -64,18 +64,17 @@ extension Application {
 
             let signalNumber = try Signals.parseSignal(signal)
 
-            var failed: [String] = []
+            var errors: [any Error] = []
             for container in containers {
                 do {
                     try await client.kill(id: container.id, signal: signalNumber)
                     print(container.id)
                 } catch {
-                    log.error("failed to kill container \(container.id): \(error)")
-                    failed.append(container.id)
+                    errors.append(error)
                 }
             }
-            if failed.count > 0 {
-                throw ContainerizationError(.internalError, message: "kill failed for one or more containers \(failed.joined(separator: ","))")
+            if !errors.isEmpty {
+                throw AggregateError(errors)
             }
         }
     }
diff --git a/Sources/ContainerCommands/Container/ContainerRun.swift b/Sources/ContainerCommands/Container/ContainerRun.swift
@@ -103,7 +103,8 @@ extension Application {
                 resource: resourceFlags,
                 registry: registryFlags,
                 imageFetch: imageFetchFlags,
-                progressUpdate: progress.handler
+                progressUpdate: progress.handler,
+                log: log
             )
 
             progress.set(description: "Starting container")
diff --git a/Sources/ContainerCommands/Container/ContainerStop.swift b/Sources/ContainerCommands/Container/ContainerStop.swift
@@ -71,40 +71,38 @@ extension Application {
                 timeoutInSeconds: self.time,
                 signal: try Signals.parseSignal(self.signal)
             )
-            let failed = try await Self.stopContainers(client: client, containers: containers, stopOptions: opts, log: log)
-            if failed.count > 0 {
-                throw ContainerizationError(
-                    .internalError,
-                    message: "stop failed for one or more containers \(failed.joined(separator: ","))"
-                )
-            }
+            try await Self.stopContainers(
+                client: client,
+                containers: containers,
+                stopOptions: opts
+            )
         }
 
-        static func stopContainers(client: ContainerClient, containers: [ContainerSnapshot], stopOptions: ContainerStopOptions, log: Logger) async throws -> [String] {
-            var failed: [String] = []
-            try await withThrowingTaskGroup(of: ContainerSnapshot?.self) { group in
+        static func stopContainers(client: ContainerClient, containers: [ContainerSnapshot], stopOptions: ContainerStopOptions) async throws {
+            var errors: [any Error] = []
+            await withTaskGroup(of: (any Error)?.self) { group in
                 for container in containers {
                     group.addTask {
                         do {
                             try await client.stop(id: container.id, opts: stopOptions)
                             print(container.id)
                             return nil
                         } catch {
-                            log.error("failed to stop container \(container.id): \(error)")
-                            return container
+                            return error
                         }
                     }
                 }
 
-                for try await ctr in group {
-                    guard let ctr else {
-                        continue
+                for await error in group {
+                    if let error {
+                        errors.append(error)
                     }
-                    failed.append(ctr.id)
                 }
             }
 
-            return failed
+            if !errors.isEmpty {
+                throw AggregateError(errors)
+            }
         }
     }
 }
diff --git a/Sources/ContainerCommands/System/SystemStop.swift b/Sources/ContainerCommands/System/SystemStop.swift
@@ -67,10 +67,11 @@ extension Application {
                     let containers = try await client.list()
                     let signal = try Signals.parseSignal("SIGTERM")
                     let opts = ContainerStopOptions(timeoutInSeconds: Self.stopTimeoutSeconds, signal: signal)
-                    let failed = try await ContainerStop.stopContainers(client: client, containers: containers, stopOptions: opts, log: log)
-                    if !failed.isEmpty {
-                        log.warning("some containers could not be stopped gracefully", metadata: ["ids": "\(failed)"])
-                    }
+                    try await ContainerStop.stopContainers(
+                        client: client,
+                        containers: containers,
+                        stopOptions: opts,
+                    )
                 } catch {
                     log.warning("failed to stop all containers", metadata: ["error": "\(error)"])
                 }
diff --git a/Sources/Services/ContainerAPIService/Client/Archiver.swift b/Sources/Services/ContainerAPIService/Client/Archiver.swift
@@ -16,10 +16,11 @@
 
 import ContainerizationArchive
 import ContainerizationOS
+import CryptoKit
 import Foundation
 
 public final class Archiver: Sendable {
-    public struct ArchiveEntryInfo: Sendable {
+    public struct ArchiveEntryInfo: Sendable, Codable {
         public let pathOnHost: URL
         public let pathInArchive: URL
 
@@ -48,13 +49,15 @@ public final class Archiver: Sendable {
         followSymlinks: Bool = false,
         writerConfiguration: ArchiveWriterConfiguration = ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip),
         closure: (URL) -> ArchiveEntryInfo?
-    ) throws {
+    ) throws -> SHA256.Digest {
         let source = source.standardizedFileURL
         let destination = destination.standardizedFileURL
 
         let fileManager = FileManager.default
         try? fileManager.removeItem(at: destination)
 
+        var hasher = SHA256()
+
         do {
             let directory = destination.deletingLastPathComponent()
             try fileManager.createDirectory(at: directory, withIntermediateDirectories: true)
@@ -71,7 +74,8 @@ public final class Archiver: Sendable {
                     entryInfo.append(info)
                 }
             } else {
-                while let relPath = enumerator.nextObject() as? String {
+                let relPaths = enumerator.compactMap { $0 as? String }
+                for relPath in relPaths.sorted(by: { $0 < $1 }) {
                     let url = source.appending(path: relPath).standardizedFileURL
                     guard let info = closure(url) else {
                         continue
@@ -85,17 +89,23 @@ public final class Archiver: Sendable {
             )
             try archiver.open(file: destination)
 
+            let encoder = JSONEncoder()
+            encoder.outputFormatting = .sortedKeys
+
             for info in entryInfo {
                 guard let entry = try Self._createEntry(entryInfo: info) else {
                     throw Error.failedToCreateEntry
                 }
-                try Self._compressFile(item: info.pathOnHost, entry: entry, archiver: archiver)
+                hasher.update(data: try encoder.encode(info))
+                try Self._compressFile(item: info.pathOnHost, entry: entry, archiver: archiver, hasher: &hasher)
             }
             try archiver.finishEncoding()
         } catch {
             try? fileManager.removeItem(at: destination)
             throw error
         }
+
+        return hasher.finalize()
     }
 
     public static func uncompress(source: URL, destination: URL) throws {
@@ -186,7 +196,7 @@ public final class Archiver: Sendable {
     }
 
     // MARK: private functions
-    private static func _compressFile(item: URL, entry: WriteEntry, archiver: ArchiveWriter) throws {
+    private static func _compressFile(item: URL, entry: WriteEntry, archiver: ArchiveWriter, hasher: inout SHA256) throws {
         guard let stream = InputStream(url: item) else {
             return
         }
@@ -204,6 +214,7 @@ public final class Archiver: Sendable {
                 break
             } else {
                 let data = Data(bytes: readBuffer, count: byteRead)
+                hasher.update(data: data)
                 try data.withUnsafeBytes { pointer in
                     try writer.writeChunk(data: pointer)
                 }
diff --git a/Sources/Services/ContainerAPIService/Client/Flags.swift b/Sources/Services/ContainerAPIService/Client/Flags.swift
@@ -221,6 +221,9 @@ public struct Flags {
 
         @Flag(name: .long, help: "Mount the container's root filesystem as read-only")
         public var readOnly = false
+
+        @Option(name: .long, help: "Set the runtime handler for the container (default: container-runtime-linux)")
+        public var runtime: String?
     }
 
     public struct Progress: ParsableArguments {
diff --git a/Sources/Services/ContainerAPIService/Client/Parser.swift b/Sources/Services/ContainerAPIService/Client/Parser.swift
@@ -316,18 +316,18 @@ public struct Parser {
         return result
     }
 
-    public static func mounts(_ rawMounts: [String]) throws -> [VolumeOrFilesystem] {
+    public static func mounts(_ rawMounts: [String], relativeTo basePath: URL? = nil) throws -> [VolumeOrFilesystem] {
         var mounts: [VolumeOrFilesystem] = []
         let rawMounts = rawMounts.dedupe()
         for mount in rawMounts {
-            let m = try Parser.mount(mount)
+            let m = try Parser.mount(mount, relativeTo: basePath)
             try validateMount(m)
             mounts.append(m)
         }
         return mounts
     }
 
-    public static func mount(_ mount: String) throws -> VolumeOrFilesystem {
+    public static func mount(_ mount: String, relativeTo basePath: URL? = nil) throws -> VolumeOrFilesystem {
         let parts = mount.split(separator: ",")
         if parts.count == 0 {
             throw ContainerizationError(.invalidArgument, message: "invalid mount format: \(mount)")
@@ -407,7 +407,7 @@ public struct Parser {
                 switch type {
                 case "virtiofs", "bind":
                     // For bind mounts, resolve both absolute and relative paths
-                    let url = URL(filePath: val)
+                    let url = basePath?.appending(path: val).standardizedFileURL ?? URL(filePath: val)
                     let absolutePath = url.absoluteURL.path
 
                     var isDirectory: ObjCBool = false
@@ -458,17 +458,17 @@ public struct Parser {
             ))
     }
 
-    public static func volumes(_ rawVolumes: [String]) throws -> [VolumeOrFilesystem] {
+    public static func volumes(_ rawVolumes: [String], relativeTo basePath: URL? = nil) throws -> [VolumeOrFilesystem] {
         var mounts: [VolumeOrFilesystem] = []
         for volume in rawVolumes {
-            let m = try Parser.volume(volume)
+            let m = try Parser.volume(volume, relativeTo: basePath)
             try Parser.validateMount(m)
             mounts.append(m)
         }
         return mounts
     }
 
-    public static func volume(_ volume: String) throws -> VolumeOrFilesystem {
+    public static func volume(_ volume: String, relativeTo basePath: URL? = nil) throws -> VolumeOrFilesystem {
         var vol = volume
         vol.trimLeft(char: ":")
 
@@ -508,7 +508,7 @@ public struct Parser {
                         options: options
                     ))
             }
-            let url = URL(filePath: src)
+            let url = basePath?.appending(path: src).standardizedFileURL ?? URL(filePath: src)
             let absolutePath = url.absoluteURL.path
 
             var isDirectory: ObjCBool = false
diff --git a/Sources/Services/ContainerAPIService/Client/Utility.swift b/Sources/Services/ContainerAPIService/Client/Utility.swift
diff --git a/Sources/Services/ContainerSandboxService/Server/SandboxService.swift b/Sources/Services/ContainerSandboxService/Server/SandboxService.swift
diff --git a/Tests/CLITests/Subcommands/Build/CLIBuilderTest.swift b/Tests/CLITests/Subcommands/Build/CLIBuilderTest.swift
diff --git a/Tests/ContainerAPIClientTests/ParserTest.swift b/Tests/ContainerAPIClientTests/ParserTest.swift
diff --git a/docs/command-reference.md b/docs/command-reference.md

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,8 @@ extension Application {`
`78`	`78`	`resource: resourceFlags,`
`79`	`79`	`registry: registryFlags,`
`80`	`80`	`imageFetch: imageFetchFlags,`
`81`		`- progressUpdate: progress.handler`
	`81`	`+ progressUpdate: progress.handler,`
	`82`	`+ log: log`
`82`	`83`	`)`
`83`	`84`
`84`	`85`	`let options = ContainerCreateOptions(autoRemove: managementFlags.remove)`
Original file line number	Diff line number	Diff line change
`@@ -81,11 +81,10 @@ extension Application {`
`81`	`81`	`}`
`82`	`82`	`}`
`83`	`83`
`84`		`- var failed = [String]()`
	`84`	`+ var errors: [any Error] = []`
`85`	`85`	`let force = self.force`
`86`	`86`	`let all = self.all`
`87`		`- let logger = log`
`88`		`- try await withThrowingTaskGroup(of: String?.self) { group in`
	`87`	`+ try await withThrowingTaskGroup(of: (any Error)?.self) { group in`
`89`	`88`	`for container in containers {`
`90`	`89`	`group.addTask {`
`91`	`90`	`do {`
`@@ -100,25 +99,20 @@ extension Application {`
`100`	`99`	`print(container.id)`
`101`	`100`	`return nil`
`102`	`101`	`} catch {`
`103`		`- logger.error("failed to delete container \(container.id): \(error)")`
`104`		`- return container.id`
	`102`	`+ return error`
`105`	`103`	`}`
`106`	`104`	`}`
`107`	`105`	`}`
`108`	`106`
`109`		`- for try await ctr in group {`
`110`		`- guard let ctr else {`
`111`		`- continue`
	`107`	`+ for try await error in group {`
	`108`	`+ if let error {`
	`109`	`+ errors.append(error)`
`112`	`110`	`}`
`113`		`- failed.append(ctr)`
`114`	`111`	`}`
`115`	`112`	`}`
`116`	`113`
`117`		`- if failed.count > 0 {`
`118`		`- throw ContainerizationError(`
`119`		`- .internalError,`
`120`		`- message: "delete failed for one or more containers: \(failed)"`
`121`		`- )`
	`114`	`+ if !errors.isEmpty {`
	`115`	`+ throw AggregateError(errors)`
`122`	`116`	`}`
`123`	`117`	`}`
`124`	`118`	`}`
Original file line number	Diff line number	Diff line change
`@@ -64,18 +64,17 @@ extension Application {`
`64`	`64`
`65`	`65`	`let signalNumber = try Signals.parseSignal(signal)`
`66`	`66`
`67`		`- var failed: [String] = []`
	`67`	`+ var errors: [any Error] = []`
`68`	`68`	`for container in containers {`
`69`	`69`	`do {`
`70`	`70`	`try await client.kill(id: container.id, signal: signalNumber)`
`71`	`71`	`print(container.id)`
`72`	`72`	`} catch {`
`73`		`- log.error("failed to kill container \(container.id): \(error)")`
`74`		`- failed.append(container.id)`
	`73`	`+ errors.append(error)`
`75`	`74`	`}`
`76`	`75`	`}`
`77`		`- if failed.count > 0 {`
`78`		`- throw ContainerizationError(.internalError, message: "kill failed for one or more containers \(failed.joined(separator: ","))")`
	`76`	`+ if !errors.isEmpty {`
	`77`	`+ throw AggregateError(errors)`
`79`	`78`	`}`
`80`	`79`	`}`
`81`	`80`	`}`
Original file line number	Diff line number	Diff line change
`@@ -103,7 +103,8 @@ extension Application {`
`103`	`103`	`resource: resourceFlags,`
`104`	`104`	`registry: registryFlags,`
`105`	`105`	`imageFetch: imageFetchFlags,`
`106`		`- progressUpdate: progress.handler`
	`106`	`+ progressUpdate: progress.handler,`
	`107`	`+ log: log`
`107`	`108`	`)`
`108`	`109`
`109`	`110`	`progress.set(description: "Starting container")`
Original file line number	Diff line number	Diff line change
`@@ -71,40 +71,38 @@ extension Application {`
`71`	`71`	`timeoutInSeconds: self.time,`
`72`	`72`	`signal: try Signals.parseSignal(self.signal)`
`73`	`73`	`)`
`74`		`- let failed = try await Self.stopContainers(client: client, containers: containers, stopOptions: opts, log: log)`
`75`		`- if failed.count > 0 {`
`76`		`- throw ContainerizationError(`
`77`		`- .internalError,`
`78`		`- message: "stop failed for one or more containers \(failed.joined(separator: ","))"`
`79`		`- )`
`80`		`- }`
	`74`	`+ try await Self.stopContainers(`
	`75`	`+ client: client,`
	`76`	`+ containers: containers,`
	`77`	`+ stopOptions: opts`
	`78`	`+ )`
`81`	`79`	`}`
`82`	`80`
`83`		`- static func stopContainers(client: ContainerClient, containers: [ContainerSnapshot], stopOptions: ContainerStopOptions, log: Logger) async throws -> [String] {`
`84`		`- var failed: [String] = []`
`85`		`- try await withThrowingTaskGroup(of: ContainerSnapshot?.self) { group in`
	`81`	`+ static func stopContainers(client: ContainerClient, containers: [ContainerSnapshot], stopOptions: ContainerStopOptions) async throws {`
	`82`	`+ var errors: [any Error] = []`
	`83`	`+ await withTaskGroup(of: (any Error)?.self) { group in`
`86`	`84`	`for container in containers {`
`87`	`85`	`group.addTask {`
`88`	`86`	`do {`
`89`	`87`	`try await client.stop(id: container.id, opts: stopOptions)`
`90`	`88`	`print(container.id)`
`91`	`89`	`return nil`
`92`	`90`	`} catch {`
`93`		`- log.error("failed to stop container \(container.id): \(error)")`
`94`		`- return container`
	`91`	`+ return error`
`95`	`92`	`}`
`96`	`93`	`}`
`97`	`94`	`}`
`98`	`95`
`99`		`- for try await ctr in group {`
`100`		`- guard let ctr else {`
`101`		`- continue`
	`96`	`+ for await error in group {`
	`97`	`+ if let error {`
	`98`	`+ errors.append(error)`
`102`	`99`	`}`
`103`		`- failed.append(ctr.id)`
`104`	`100`	`}`
`105`	`101`	`}`
`106`	`102`
`107`		`- return failed`
	`103`	`+ if !errors.isEmpty {`
	`104`	`+ throw AggregateError(errors)`
	`105`	`+ }`
`108`	`106`	`}`
`109`	`107`	`}`
`110`	`108`	`}`