Add OCI maskedPaths and readonlyPaths support to Container API. - #1996
Merged
Conversation
katiewasnothere
approved these changes
Jul 22, 2026
Code Coverage
|
Merged
6 tasks
andrewkomkov
added a commit
to getgantry/gantry
that referenced
this pull request
Aug 1, 2026
…ot args (#14) apple/container **1.2.0** is out (previously tracked: `1.1.0`). Upstream notes: https://github.com/apple/container/releases/tag/1.2.0 — mirrored in `docs/upstream/apple-container-1.2.0.md`. ## Review checklist - [ ] New or changed CLI flags Gantry should surface (`container run/create/machine/build`) - [ ] Changed `--format json` shapes the DockerKit apple transport decodes - [ ] Fixed upstream bugs Gantry currently works around - [ ] `ContainerTooling.recommendedVersion` / feature gates need moving to `1.2.0` - [ ] MCP tools and App Intents that expose the affected commands - [ ] README and CHANGELOG entries for whatever is adopted Merging records the version as reviewed. Implement the adopted parts on this branch, or merge as-is and open follow-ups. --- <details><summary>Upstream release notes</summary> ## What's Changed * Add TestCLISystemLogs and TestCLITermIO integration tests in new integration test suite by @katiewasnothere in apple/container#1879 * Restore reverted migrations, migrate last tests. by @jglogan in apple/container#1880 * Removes obsolete CLITests directory. by @jglogan in apple/container#1886 * Integration coverage xpc helpers by @noah-thor in apple/container#1551 * Upgrade grpc-swift-nio-transport to 2.9.0 and remove HTTP2ConnectBuff… by @adityabagchi24 in apple/container#1790 * Updates containerization to 0.36.0. by @jglogan in apple/container#1912 * Use containerization version 0.37.0 by @adityaramani in apple/container#1932 * Verify kernel archive integrity by @haoruilee in apple/container#1703 * Add commit/issue alert to PR template. by @jglogan in apple/container#1945 * Remove `--skip-build` from test Makefile target. by @jglogan in apple/container#1951 * Restore `--skip-build`, enable `import testable` for release builds. by @jglogan in apple/container#1955 * [package]: bump container-builder-shim to 0.13.0 by @saehejkang in apple/container#1953 * Validate container ID from XPC requests by @katiewasnothere in apple/container#1956 * Remove force unwraps on XPC error set/get by @katiewasnothere in apple/container#1958 * Do not follow destination symlink when copying user configuration by @katiewasnothere in apple/container#1957 * Fix machine ID length test. by @jglogan in apple/container#1971 * Address flaky TestCLIKernelSetSerial suite. by @jglogan in apple/container#1976 * [gitignore]: ignore vscode workspace files by @saehejkang in apple/container#1966 * Update containerization dependency with new EXT4Unpacker func definition by @katiewasnothere in apple/container#1973 * Periodic dependency updates. by @jglogan in apple/container#1981 * Use ordered journal mode for unpacked images. by @jglogan in apple/container#1974 * Reword DNS container name resolution doc information by @katiewasnothere in apple/container#1960 * ci: bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in apple/container#1983 * Pass build config in when building protoc dependencies by @katiewasnothere in apple/container#1972 * Container test fixture package by @katiewasnothere in apple/container#1887 * Downgrade swift-collections to 1.5.1. by @jglogan in apple/container#1984 * Use `enum` for warmup images. by @jglogan in apple/container#1990 * Add missing dependencies to new ContainerTestSupport package by @katiewasnothere in apple/container#1994 * Add OCI maskedPaths and readonlyPaths support to Container API. by @jglogan in apple/container#1996 * Integration test - miscellaneous fixture and test refinements. by @jglogan in apple/container#1993 * Use log instead of print for system start status messages by @adityabagchi24 in apple/container#1889 * Fix BuilderStart race, parallelize `container build` tests. by @jglogan in apple/container#2002 * Allow custom kernel boot args via --kernel-arg by @arirubinstein in apple/container#1744 * fix: Increase XPC timeout for Machine API operations by @dev-kvt in apple/container#2006 * Update containerization import to latest 0.40.0 by @katiewasnothere in apple/container#2028 * Fix image env vars, build context checks, TCP/UDP port forward buffer, and validate plugin name by @katiewasnothere in apple/container#2027 * Update containerization import to 0.40.1 by @katiewasnothere in apple/container#2038 ## New Contributors * @haoruilee made their first contribution in apple/container#1703 * @arirubinstein made their first contribution in apple/container#1744 * @dev-kvt made their first contribution in apple/container#2006 **Full Changelog**: apple/container@1.1.0...1.2.0 </details> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew <Andrew.Komkov@gmail.com>
3 tasks
This was referenced Aug 4, 2026
henrywang
added a commit
to henrywang/Berthly
that referenced
this pull request
Aug 5, 2026
…gap (#100) ## Summary Spike (#80): confirmed what containerization's 1.2.0 API actually exposes for OCI `maskedPaths`/`readonlyPaths` overrides, and decided whether it belongs in the Run/Create sheet or `PARITY.md`'s Deliberate gaps. - `ContainerConfiguration.maskedPaths`/`.readonlyPaths` (`[String]?`) were added via [apple/container#1996](apple/container#1996); `RuntimeService.swift` applies them server-side. - That PR only touched `ContainerConfiguration` and `RuntimeService` — no `ContainerCommands` change, confirmed by tracing the merge commit into Berthly's pinned checkout. The `container` CLI has **no flag** for this. - `Utility.containerConfigFromFlags` (what `LiveContainerService.runContainer` calls) never sets these fields. No CLI flag surface to have parity with, and no identified Berthly use case for exposing expert-level, security-sensitive sandbox tuning ahead of upstream — recorded as a Deliberate gap rather than building UI, matching what #77 itself anticipated. Closes #80 ## Test plan - Documentation-only change, no code touched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
maskedPathsandreadonlyPathssupport to Container API. #1995.Type of Change
Motivation and Context
Allow override of default values defined in containerization.
Testing