Fix image env vars, build context checks, TCP/UDP port forward buffer, and validate plugin name - #2027
Merged
Merged
Conversation
Code Coverage
|
…uffer, and validate plugin name Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com> Co-authored-by: John Logan <john_logan@apple.com> Co-authored-by: Raj Aryan Singh <rajaryan_singh@apple.com>
jglogan
approved these changes
Jul 28, 2026
Merged
6 tasks
andrewkomkov
added a commit
to getgantry/gantry
that referenced
this pull request
Aug 1, 2026
…ot args (#14) apple/container **1.2.0** is out (previously tracked: `1.1.0`). Upstream notes: https://github.com/apple/container/releases/tag/1.2.0 — mirrored in `docs/upstream/apple-container-1.2.0.md`. ## Review checklist - [ ] New or changed CLI flags Gantry should surface (`container run/create/machine/build`) - [ ] Changed `--format json` shapes the DockerKit apple transport decodes - [ ] Fixed upstream bugs Gantry currently works around - [ ] `ContainerTooling.recommendedVersion` / feature gates need moving to `1.2.0` - [ ] MCP tools and App Intents that expose the affected commands - [ ] README and CHANGELOG entries for whatever is adopted Merging records the version as reviewed. Implement the adopted parts on this branch, or merge as-is and open follow-ups. --- <details><summary>Upstream release notes</summary> ## What's Changed * Add TestCLISystemLogs and TestCLITermIO integration tests in new integration test suite by @katiewasnothere in apple/container#1879 * Restore reverted migrations, migrate last tests. by @jglogan in apple/container#1880 * Removes obsolete CLITests directory. by @jglogan in apple/container#1886 * Integration coverage xpc helpers by @noah-thor in apple/container#1551 * Upgrade grpc-swift-nio-transport to 2.9.0 and remove HTTP2ConnectBuff… by @adityabagchi24 in apple/container#1790 * Updates containerization to 0.36.0. by @jglogan in apple/container#1912 * Use containerization version 0.37.0 by @adityaramani in apple/container#1932 * Verify kernel archive integrity by @haoruilee in apple/container#1703 * Add commit/issue alert to PR template. by @jglogan in apple/container#1945 * Remove `--skip-build` from test Makefile target. by @jglogan in apple/container#1951 * Restore `--skip-build`, enable `import testable` for release builds. by @jglogan in apple/container#1955 * [package]: bump container-builder-shim to 0.13.0 by @saehejkang in apple/container#1953 * Validate container ID from XPC requests by @katiewasnothere in apple/container#1956 * Remove force unwraps on XPC error set/get by @katiewasnothere in apple/container#1958 * Do not follow destination symlink when copying user configuration by @katiewasnothere in apple/container#1957 * Fix machine ID length test. by @jglogan in apple/container#1971 * Address flaky TestCLIKernelSetSerial suite. by @jglogan in apple/container#1976 * [gitignore]: ignore vscode workspace files by @saehejkang in apple/container#1966 * Update containerization dependency with new EXT4Unpacker func definition by @katiewasnothere in apple/container#1973 * Periodic dependency updates. by @jglogan in apple/container#1981 * Use ordered journal mode for unpacked images. by @jglogan in apple/container#1974 * Reword DNS container name resolution doc information by @katiewasnothere in apple/container#1960 * ci: bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in apple/container#1983 * Pass build config in when building protoc dependencies by @katiewasnothere in apple/container#1972 * Container test fixture package by @katiewasnothere in apple/container#1887 * Downgrade swift-collections to 1.5.1. by @jglogan in apple/container#1984 * Use `enum` for warmup images. by @jglogan in apple/container#1990 * Add missing dependencies to new ContainerTestSupport package by @katiewasnothere in apple/container#1994 * Add OCI maskedPaths and readonlyPaths support to Container API. by @jglogan in apple/container#1996 * Integration test - miscellaneous fixture and test refinements. by @jglogan in apple/container#1993 * Use log instead of print for system start status messages by @adityabagchi24 in apple/container#1889 * Fix BuilderStart race, parallelize `container build` tests. by @jglogan in apple/container#2002 * Allow custom kernel boot args via --kernel-arg by @arirubinstein in apple/container#1744 * fix: Increase XPC timeout for Machine API operations by @dev-kvt in apple/container#2006 * Update containerization import to latest 0.40.0 by @katiewasnothere in apple/container#2028 * Fix image env vars, build context checks, TCP/UDP port forward buffer, and validate plugin name by @katiewasnothere in apple/container#2027 * Update containerization import to 0.40.1 by @katiewasnothere in apple/container#2038 ## New Contributors * @haoruilee made their first contribution in apple/container#1703 * @arirubinstein made their first contribution in apple/container#1744 * @dev-kvt made their first contribution in apple/container#2006 **Full Changelog**: apple/container@1.1.0...1.2.0 </details> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew <Andrew.Komkov@gmail.com>
TakiTake
added a commit
to TakiTake/pall8t
that referenced
this pull request
Aug 8, 2026
1.2.0 is where apple/container#2027 stopped `Parser.allEnv` expanding a bare `ENV NAME` (no value) declared in an image config out of the host process's environment and injecting it into the container. That expansion happens host-side, before pall8t's argv exists, so on an older runtime a base image could pull a host token or path into the sandbox and pall8t's documented "forwards nothing from the host environment by default" could do nothing about it. State the baseline in the README and requirements, and add the guarantee itself to FR-1 — it lived only in a code comment on `RunSpec::env`, which is why the docs had no way to explain why the version matters. Warn rather than block: every command that actually talks to apple/container prints one stderr line when the installed CLI is older. The parse is a pure function over the version banner, tested against literal 1.2.2 output; an unreadable banner warns about nothing, since pall8t cannot tell "ancient" from "newer than this build knows" and a false alarm about a security boundary is what teaches users to ignore the true one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type of Change
Motivation and Context
This PR includes a number of fixes including:
Testing