Vendor apple/containerization with a VM-extensions forwarding patch

Switch the containerization dependency from the github URL to a vendored copy (third_party/containerization, upstream commit 6b7b42ca) referenced by path, so we can carry a small local patch that upstream lacks: LinuxContainer.Configuration gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream already supports VMConfiguration.extensions + the VZInstanceExtension hook, but LinuxContainer — our only entry point — never forwarded them, so there was no way to attach a device (e.g. a memory balloon) to a container's VM. Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed for footprint (we never build the dependency's tests). See PATCHES.md for the full diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras product to NucleicCore (AddressAllocator, named in the configureVZ signature). Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-21 20:22:21 -07:00
commit 11b9825e09
280 changed files with 75699 additions and 0 deletions
@@ -0,0 +1,77 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+import ContainerizationError
+import Foundation
+
+/// A small utility to resolve proxy settings (HTTP(S)_PROXY / NO_PROXY).
+public enum ProxyUtils {
+    /// Resolves the proxy URL for a given host based on environment variables.
+    /// Malformed http_proxy or https_proxy URLs are ignored.
+    /// Uses Go-style handling rules:
+    ///   - Uppercase environment variables take priority over lowercase counterparts.
+    ///   - Leading dot on no_proxy component implies prefix matching.
+    ///
+    /// - Parameters:
+    ///   - scheme: The request scheme.
+    ///   - host: The request hostname.
+    ///   - env: Environment variables to check, dafaulting to the process environment.
+    ///
+    /// - Returns: The proxy URL to use, or `nil` for transparent connection.
+    public static func proxyFromEnvironment(
+        scheme: String?,
+        host: String,
+        env: [String: String] = ProcessInfo.processInfo.environment
+    ) -> URL? {
+        guard let scheme else {
+            return nil
+        }
+
+        let httpProxy = env["HTTP_PROXY"] ?? env["http_proxy"]
+        let httpsProxy = env["HTTPS_PROXY"] ?? env["https_proxy"]
+        let noProxy = env["NO_PROXY"] ?? env["no_proxy"]
+
+        // If NO_PROXY matches → skip proxy
+        if let noProxy, shouldBypassProxy(host: host, noProxy: noProxy) {
+            return nil
+        }
+
+        // Select proxy based on scheme, defaulting to http.
+        let proxy = scheme == "https" ? httpsProxy : httpProxy
+        guard let proxy, let proxyUrl = URL(string: proxy) else {
+            return nil
+        }
+
+        return proxyUrl
+    }
+
+    /// Check if a host should bypass proxy according to NO_PROXY.
+    /// - Example: NO_PROXY=".example.com,localhost,127.0.0.1"
+    private static func shouldBypassProxy(host: String, noProxy: String) -> Bool {
+        let entries = noProxy.split(separator: ",").map { $0.trimmingCharacters(in: .whitespaces) }
+        for entry in entries {
+            if entry.isEmpty { continue }
+            if entry == "*" { return true }
+            if host == entry { return true }
+            if entry.hasPrefix("*.") {
+                let suffix = String(entry.dropFirst())
+                if host.hasSuffix(suffix) { return true }
+            }
+            if entry.hasPrefix(".") && host.hasSuffix(entry) { return true }
+        }
+        return false
+    }
+}