Vendor apple/containerization with a VM-extensions forwarding patch
Switch the containerization dependency from the github URL to a vendored copy (third_party/containerization, upstream commit 6b7b42ca) referenced by path, so we can carry a small local patch that upstream lacks: LinuxContainer.Configuration gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream already supports VMConfiguration.extensions + the VZInstanceExtension hook, but LinuxContainer — our only entry point — never forwarded them, so there was no way to attach a device (e.g. a memory balloon) to a container's VM. Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed for footprint (we never build the dependency's tests). See PATCHES.md for the full diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras product to NucleicCore (AddressAllocator, named in the configureVZ signature). Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Nucleic
@@ -0,0 +1,28 @@
|
||||
/*
|
||||
* Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef __CAPABILITY_H
|
||||
#define __CAPABILITY_H
|
||||
|
||||
#if defined(__linux__)
|
||||
|
||||
// Capability syscall wrappers
|
||||
int CZ_capget(void *header, void *data);
|
||||
int CZ_capset(void *header, void *data);
|
||||
|
||||
#endif
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,56 @@
|
||||
/*
|
||||
* Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef exec_command_h
|
||||
#define exec_command_h
|
||||
|
||||
#if defined(__linux__) || defined(__APPLE__)
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
|
||||
struct exec_command_attrs {
|
||||
int setpgid;
|
||||
/// parent group id
|
||||
pid_t pgid;
|
||||
/// set the controlling terminal
|
||||
int setctty;
|
||||
/// controlling terminal fd
|
||||
int ctty;
|
||||
/// set the process as session leader
|
||||
int setsid;
|
||||
/// set the process user id
|
||||
uid_t uid;
|
||||
/// set the process group id
|
||||
gid_t gid;
|
||||
/// signal mask for the child process
|
||||
int mask;
|
||||
/// parent death signal (Linux only, 0 to disable)
|
||||
int pdeathSignal;
|
||||
/// make the new process group the foreground process group
|
||||
int setfgpgrp;
|
||||
};
|
||||
|
||||
void exec_command_attrs_init(struct exec_command_attrs *attrs);
|
||||
|
||||
/// spawn a new child process with the provided attrs
|
||||
int exec_command(pid_t *result, const char *executable, char *const argv[],
|
||||
char *const envp[], const int file_handles[],
|
||||
const int file_handle_count, const char *working_directory,
|
||||
struct exec_command_attrs *attrs);
|
||||
|
||||
#endif /* defined(__linux__) || defined(__APPLE__) */
|
||||
#endif /* exec_command_h */
|
||||
@@ -0,0 +1,32 @@
|
||||
/*
|
||||
* Copyright © 2026 Apple Inc. and the Containerization project authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
// The below fall into two main categories:
|
||||
// 1. Aren't exposed by Swifts glibc modulemap.
|
||||
// 2. Don't have syscall wrappers/definitions in glibc/musl.
|
||||
|
||||
#ifndef __LINUX_SHIM_H
|
||||
#define __LINUX_SHIM_H
|
||||
|
||||
#if defined(__linux__)
|
||||
|
||||
#include <sys/epoll.h>
|
||||
#include <sys/eventfd.h>
|
||||
#include <sys/vfs.h>
|
||||
|
||||
#endif /* __linux__ */
|
||||
|
||||
#endif /* __LINUX_SHIM_H */
|
||||
@@ -0,0 +1,37 @@
|
||||
/*
|
||||
* Copyright © 2026 Apple Inc. and the Containerization project authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef __OPENAT2_H
|
||||
#define __OPENAT2_H
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#ifndef RESOLVE_IN_ROOT
|
||||
#define RESOLVE_IN_ROOT 0x10
|
||||
#endif
|
||||
|
||||
struct cz_open_how {
|
||||
unsigned long long flags;
|
||||
unsigned long long mode;
|
||||
unsigned long long resolve;
|
||||
};
|
||||
|
||||
/// openat2(2) wrapper. Musl does not provide openat2 so we invoke the syscall
|
||||
/// directly. Requires Linux 5.6+.
|
||||
int CZ_openat2(int dirfd, const char *pathname, struct cz_open_how *how,
|
||||
size_t size);
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,33 @@
|
||||
/*
|
||||
* Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef __PRCTL_H
|
||||
#define __PRCTL_H
|
||||
|
||||
#if defined(__linux__)
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
// Capability management prctl wrappers
|
||||
int CZ_prctl_set_keepcaps();
|
||||
int CZ_prctl_clear_keepcaps();
|
||||
int CZ_prctl_capbset_drop(unsigned int capability);
|
||||
int CZ_prctl_cap_ambient_clear_all();
|
||||
int CZ_prctl_cap_ambient_raise(unsigned int capability);
|
||||
|
||||
#endif
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,29 @@
|
||||
/*
|
||||
* Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef socket_helpers_h
|
||||
#define socket_helpers_h
|
||||
|
||||
#include <sys/socket.h>
|
||||
#include <stdint.h>
|
||||
|
||||
// Helper functions to access CMSG macros from Swift
|
||||
struct cmsghdr* CZ_CMSG_FIRSTHDR(struct msghdr *msg);
|
||||
void* CZ_CMSG_DATA(struct cmsghdr *cmsg);
|
||||
size_t CZ_CMSG_SPACE(size_t length);
|
||||
size_t CZ_CMSG_LEN(size_t length);
|
||||
|
||||
#endif /* socket_helpers_h */
|
||||
@@ -0,0 +1,33 @@
|
||||
/*
|
||||
* Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
//
|
||||
|
||||
#ifndef vsock_h
|
||||
#define vsock_h
|
||||
|
||||
#include <sys/ioctl.h>
|
||||
|
||||
#ifdef __APPLE__
|
||||
#include <sys/vsock.h>
|
||||
#else
|
||||
#include <sys/socket.h>
|
||||
#include <linux/vm_sockets.h>
|
||||
#endif /* __APPLE__ */
|
||||
|
||||
extern const unsigned long VsockLocalCIDIoctl;
|
||||
|
||||
#endif /* vsock_h */
|
||||
Reference in New Issue
Block a user