container

This release addresses two security issues in the Containerization package:

• GHSA-4587-w9mm-xxvh - OCI image load follows symlinks for oci-layout and index.json outside the extraction directory
• GHSA-rgqp-277h-gcwj - UnixType.init(path:) uses a macOS length limit longer than the sockaddr_un.sun_path buffer it copies into

There was no 1.4.0 release, we had to discard that tag so this release contains every change since 1.3.1.

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • New container clean command
  • 👩‍💻 container system status now reports host, client, paths, and resources
  • JSON output no longer escapes forward slashes
  • Updated Containerization to 0.45.0

What's Changed

• Avoid escaping slashes in JSON output by @taljeon in https://github.com/apple/container/pull/2205
• Enhance container system status command output by @muk2 in https://github.com/apple/container/pull/1769
• Updates containerization to 0.43.0. by @jglogan in https://github.com/apple/container/pull/2208
• [container]: add clean command by @saehejkang in https://github.com/apple/container/pull/1949
• fix: handle container clean failing on read-only named volume mounts by @zdk in https://github.com/apple/container/pull/2228
• ci: bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the github-actions group by @dependabot[bot] in https://github.com/apple/container/pull/2226
• Fix a compilation error by @dkovba in https://github.com/apple/container/pull/2234
• Remove security markdown in favor of inherited security guidelines by @katiewasnothere in https://github.com/apple/container/pull/2249
• docs: remove broken troubleshooting.md link in technical overview by @zdk in https://github.com/apple/container/pull/2227
• Fix compilation warnings by @dkovba in https://github.com/apple/container/pull/2235
• docs: Add k8s plugin reference by @egernst in https://github.com/apple/container/pull/2244
• Bump CZ to 0.45.0 by @realrajaryan in https://github.com/apple/container/pull/2250

New Contributors

• @taljeon made their first contribution in https://github.com/apple/container/pull/2205
• @muk2 made their first contribution in https://github.com/apple/container/pull/1769

Full Changelog: https://github.com/apple/container/compare/1.3.1...1.4.1

This patch release addresses a number of security issues in the Containerization package:

• GHSA-x7pf-2jmj-pgcq - Creating a container or executing a container process can delete files outside its bundle through an unchecked id
• GHSA-f689-h8m7-3jp2 - ContainerizationOCI accepts unvalidated OCI descriptor digests, enabling path traversal in the local content store
• GHSA-r3h2-rgqf-9hv9 - Loading an OCI image layout can read host files through a symlink
• GHSA-mx96-5vvg-x2mg - CVE-2026-65388 - RegistryClient follows the WWW-Authenticate realm without validating its host or scheme
• GHSA-697p-8837-37h3 - Unpacking a crafted image layer with a long(invalid) file name crashes the unpacking process
• GHSA-g3rx-2m58-rr63 - Unpacking a crafted image layer with an invalid length extended-attribute name crashes the unpacking process

What's Changed

• Add container skill by @crosbymichael in https://github.com/apple/container/pull/2154
• Fix tmpfs mount source field left empty for --mount type=tmpfs by @sivasath16 in https://github.com/apple/container/pull/2138
• Update to containerization 0.42.0 by @katiewasnothere in https://github.com/apple/container/pull/2207

New Contributors

• @sivasath16 made their first contribution in https://github.com/apple/container/pull/2138

Full Changelog: https://github.com/apple/container/compare/1.3.0...1.3.1

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • Default Kata kernel is now 3.32.0-debug
  • Documentation has been expanded and reorganized.
  • Relax maskedPaths and readonlyPaths for container machines
• Images
  • ⌨️ Removed --scheme auto for image operations, default is now https.

What's Changed

• Update sudoers file to not include dots by @tumd in https://github.com/apple/container/pull/2080
• Refactor tmpfsMounts() to process tmpfs path correctly by @LevelVoid in https://github.com/apple/container/pull/2103
• Remove auto registry scheme. by @jglogan in https://github.com/apple/container/pull/2100
• Validate volume name in volume disk usage call by @katiewasnothere in https://github.com/apple/container/pull/2107
• Topic/docs refactor by @egernst in https://github.com/apple/container/pull/2032
• Integration test: fix k8s test with scoped domain. by @jglogan in https://github.com/apple/container/pull/2104
• Extracts createPluginLoader() for use by container k8s. by @jglogan in https://github.com/apple/container/pull/2115
• Fix a compilation error by @dkovba in https://github.com/apple/container/pull/2119
• Split K8sHelper, add WorkerProvisioner protocol, and add LinuxWorker … by @jshi991 in https://github.com/apple/container/pull/2110
• Do not set default maskedPaths and readonlyPaths for container machines by @katiewasnothere in https://github.com/apple/container/pull/2137
• Remove AsyncParsableCommand conformance from ContainerCLI by @noah-thor in https://github.com/apple/container/pull/2140
• Add identifier validation tests for the disk-usage routes by @realrajaryan in https://github.com/apple/container/pull/2136
• Update default kernel to Kata Containers 3.32.0 debug build by @agamdua in https://github.com/apple/container/pull/2143

New Contributors

• @tumd made their first contribution in https://github.com/apple/container/pull/2080
• @LevelVoid made their first contribution in https://github.com/apple/container/pull/2103
• @agamdua made their first contribution in https://github.com/apple/container/pull/2143

Full Changelog: https://github.com/apple/container/compare/1.2.2...1.3.0

This release fixes a glitch that prevented container k8s working when installed from the release package.

What's Changed

• Integration test: fix username/uid flake. by @jglogan in https://github.com/apple/container/pull/2086
• refactor: extract K8s logic into ContainerK8s library target by @jshi991 in https://github.com/apple/container/pull/2079
• Refactor container k8s to use plugin resource management. by @jglogan in https://github.com/apple/container/pull/2097
• Migrate ProgressBarTests to Swift Testing by @VictorPuga in https://github.com/apple/container/pull/2085

New Contributors

• @VictorPuga made their first contribution in https://github.com/apple/container/pull/2085

Full Changelog: https://github.com/apple/container/compare/1.2.1...1.2.2

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • k8s plugin for turnkey local Kubernetes cluster
  • container export for live containers.
  • --ssh option for container build.
  • --read-only-path and --masked-path for container run for Kubernetes, Docker, and similar containers.

What's Changed

• [container]: add container export for live containers by @saehejkang in https://github.com/apple/container/pull/1630
• Adjust overcommit and max_map_count vm defaults in guest VMs by @adityabagchi24 in https://github.com/apple/container/pull/2055
• [package]: bump container-builder-shim to 0.13.1 by @saehejkang in https://github.com/apple/container/pull/2056
• [builder]: enable ssh forwarding for container build by @saehejkang in https://github.com/apple/container/pull/1508
• Move SSH builder test to Serialized tests by @JaewonHur in https://github.com/apple/container/pull/2061
• Increase testExecDetachProcessRunning sleep margin to avoid CI flake by @jglogan in https://github.com/apple/container/pull/2063
• Add readiness signal to DirectoryWatcher, fix DirectoryWatcherTest. by @jglogan in https://github.com/apple/container/pull/2066
• Log core counts in CI for perf analysis. by @jglogan in https://github.com/apple/container/pull/2070
• Add --read-only-path and --masked-path option to container run / create by @adityaramani in https://github.com/apple/container/pull/2069
• Simplify correlation of test prefix to test ID. by @jglogan in https://github.com/apple/container/pull/2071
• Integration test: cache warmup image tarfiles. by @jglogan in https://github.com/apple/container/pull/2074
• K8s plugin by @jshi991 in https://github.com/apple/container/pull/2044

New Contributors

• @jshi991 made their first contribution in https://github.com/apple/container/pull/2044

Full Changelog: https://github.com/apple/container/compare/1.2.0...1.2.1

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• SECURITY FIXES
  • GHSA-xwgf-4rc5-p4m4 - CVE-2026-64786 - bare-name image Config.Env entries should not inherit values from the launching process's environment
  • GHSA-wg28-286f-56v6 - CVE-2026-64773 - TCP port forwarder buffers unbounded pre-connect data from published container ports
  • GHSA-2v2q-4q35-h585 - CVE-2026-64777 - Build filesystem sync discloses host files outside the build context via symlinks
  • GHSA-g57j-434g-5xj2 - BuildFSSync.walk()'s JSON response mode reports the resolved host path of build-context symlinks that point outside the context.
  • GHSA-5h49-6pr7-9mv4 - reset special permission bits when extracting archives onto the host.
• Core
  • k8s plugin for turnkey local Kubernetes cluster
  • container export for live containers.
  • --ssh option for container build.
  • --read-only-path and --masked-path for container run for Kubernetes, Docker, and similar containers.

What's Changed

• Add TestCLISystemLogs and TestCLITermIO integration tests in new integration test suite by @katiewasnothere in https://github.com/apple/container/pull/1879
• Restore reverted migrations, migrate last tests. by @jglogan in https://github.com/apple/container/pull/1880
• Removes obsolete CLITests directory. by @jglogan in https://github.com/apple/container/pull/1886
• Integration coverage xpc helpers by @noah-thor in https://github.com/apple/container/pull/1551
• Upgrade grpc-swift-nio-transport to 2.9.0 and remove HTTP2ConnectBuff… by @adityabagchi24 in https://github.com/apple/container/pull/1790
• Updates containerization to 0.36.0. by @jglogan in https://github.com/apple/container/pull/1912
• Use containerization version 0.37.0 by @adityaramani in https://github.com/apple/container/pull/1932
• Verify kernel archive integrity by @haoruilee in https://github.com/apple/container/pull/1703
• Add commit/issue alert to PR template. by @jglogan in https://github.com/apple/container/pull/1945
• Remove --skip-build from test Makefile target. by @jglogan in https://github.com/apple/container/pull/1951
• Restore --skip-build, enable import testable for release builds. by @jglogan in https://github.com/apple/container/pull/1955
• [package]: bump container-builder-shim to 0.13.0 by @saehejkang in https://github.com/apple/container/pull/1953
• Validate container ID from XPC requests by @katiewasnothere in https://github.com/apple/container/pull/1956
• Remove force unwraps on XPC error set/get by @katiewasnothere in https://github.com/apple/container/pull/1958
• Do not follow destination symlink when copying user configuration by @katiewasnothere in https://github.com/apple/container/pull/1957
• Fix machine ID length test. by @jglogan in https://github.com/apple/container/pull/1971
• Address flaky TestCLIKernelSetSerial suite. by @jglogan in https://github.com/apple/container/pull/1976
• [gitignore]: ignore vscode workspace files by @saehejkang in https://github.com/apple/container/pull/1966
• Update containerization dependency with new EXT4Unpacker func definition by @katiewasnothere in https://github.com/apple/container/pull/1973
• Periodic dependency updates. by @jglogan in https://github.com/apple/container/pull/1981
• Use ordered journal mode for unpacked images. by @jglogan in https://github.com/apple/container/pull/1974
• Reword DNS container name resolution doc information by @katiewasnothere in https://github.com/apple/container/pull/1960
• ci: bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/apple/container/pull/1983
• Pass build config in when building protoc dependencies by @katiewasnothere in https://github.com/apple/container/pull/1972
• Container test fixture package by @katiewasnothere in https://github.com/apple/container/pull/1887
• Downgrade swift-collections to 1.5.1. by @jglogan in https://github.com/apple/container/pull/1984
• Use enum for warmup images. by @jglogan in https://github.com/apple/container/pull/1990
• Add missing dependencies to new ContainerTestSupport package by @katiewasnothere in https://github.com/apple/container/pull/1994
• Add OCI maskedPaths and readonlyPaths support to Container API. by @jglogan in https://github.com/apple/container/pull/1996
• Integration test - miscellaneous fixture and test refinements. by @jglogan in https://github.com/apple/container/pull/1993
• Use log instead of print for system start status messages by @adityabagchi24 in https://github.com/apple/container/pull/1889
• Fix BuilderStart race, parallelize container build tests. by @jglogan in https://github.com/apple/container/pull/2002
• Allow custom kernel boot args via --kernel-arg by @arirubinstein in https://github.com/apple/container/pull/1744
• fix: Increase XPC timeout for Machine API operations by @dev-kvt in https://github.com/apple/container/pull/2006
• Update containerization import to latest 0.40.0 by @katiewasnothere in https://github.com/apple/container/pull/2028
• Fix image env vars, build context checks, TCP/UDP port forward buffer, and validate plugin name by @katiewasnothere in https://github.com/apple/container/pull/2027
• Update containerization import to 0.40.1 by @katiewasnothere in https://github.com/apple/container/pull/2038

New Contributors

• @haoruilee made their first contribution in https://github.com/apple/container/pull/1703
• @arirubinstein made their first contribution in https://github.com/apple/container/pull/1744
• @dev-kvt made their first contribution in https://github.com/apple/container/pull/2006

Full Changelog: https://github.com/apple/container/compare/1.1.0...1.2.0

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • Unix domain socket mounts now work in non-root containers.
• Storage
  • Fix container cp failures with relative source paths

What's Changed

• Bump containerization to 0.33.4 by @dkovba in https://github.com/apple/container/pull/1650
• add standalone container machine document by @crosbymichael in https://github.com/apple/container/pull/1674
• Adds container machine example. by @jglogan in https://github.com/apple/container/pull/1676
• Always update default network with system configuration values by @katiewasnothere in https://github.com/apple/container/pull/1686
• ci: bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group across 1 directory by @dependabot[bot] in https://github.com/apple/container/pull/1640
• Fix duplicate "(default: 3)" in --max-concurrent-downloads help text by @CharlieTLe in https://github.com/apple/container/pull/1725
• add container machine nested virt by @crosbymichael in https://github.com/apple/container/pull/1742
• Pin xcode swift version in CI to 6.3 by @katiewasnothere in https://github.com/apple/container/pull/1746
• Propagate permissions for all host-to-container socket mounts. by @jglogan in https://github.com/apple/container/pull/1751
• Fix CLITest when run in xcode by @mareksapota in https://github.com/apple/container/pull/1775
• [package]: bump containerization to 0.34.0 by @saehejkang in https://github.com/apple/container/pull/1774
• fix(cp): resolve relative host paths against current directory by @adityabagchi24 in https://github.com/apple/container/pull/1741
• fix: replace try! with try? for stdout/stderr writes in ProcessIO by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1784
• fix: remove force-unwrap on session dictionary in DefaultNetworkService by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1787
• Log the graceful-stop error instead of silently discarding it in gracefulStopContainer by @radheradhe01 in https://github.com/apple/container/pull/1782
• Disable flaky CLI test temporarily. by @jglogan in https://github.com/apple/container/pull/1828
• Fix/exec empty arguments crash by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1783
• Remove network variant computation from API server. by @jglogan in https://github.com/apple/container/pull/1814
• Remove duplicate release workflow that double-builds and races on every tag by @radheradhe01 in https://github.com/apple/container/pull/1781
• perf(parser): add collection capacity hints to known-size loops by @hluaguo in https://github.com/apple/container/pull/1791
• fix: propagate error from createDirectory in system start by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1785
• ci: bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/apple/container/pull/1792
• Route container image save reference list to stderr in stdout mode by @costajohnt in https://github.com/apple/container/pull/1804
• Enhanced test fixtures for integration tests. by @jglogan in https://github.com/apple/container/pull/1834
• Migrate some container tests, remove concurrent demo tests. by @jglogan in https://github.com/apple/container/pull/1840
• Update containerization import to 0.35.0 by @katiewasnothere in https://github.com/apple/container/pull/1842
• Adds build fixture and migrates build CLI tests. by @jglogan in https://github.com/apple/container/pull/1848
• Migrates container machine tests. by @jglogan in https://github.com/apple/container/pull/1856
• Migrate basic system tests to new test support types. by @jglogan in https://github.com/apple/container/pull/1841
• Migrates network integration tests. by @jglogan in https://github.com/apple/container/pull/1858
• Migrate registry tests to new test support types. by @jglogan in https://github.com/apple/container/pull/1845
• Add checksum validation to hawkeye installation by @katiewasnothere in https://github.com/apple/container/pull/1869
• Migrate image, volume and miscellaneous system tests. by @jglogan in https://github.com/apple/container/pull/1868
• Migrates container create, run-lifecycle, exec, remove, copy. by @jglogan in https://github.com/apple/container/pull/1844
• Migrates container run integration tests. by @jglogan in https://github.com/apple/container/pull/1857
• Ensure test filenames match test suite names and each file has a single suite defined by @katiewasnothere in https://github.com/apple/container/pull/1877
• Finalize Makefile for integration test rework. by @jglogan in https://github.com/apple/container/pull/1878

New Contributors

• @CharlieTLe made their first contribution in https://github.com/apple/container/pull/1725
• @mareksapota made their first contribution in https://github.com/apple/container/pull/1775
• @adityabagchi24 made their first contribution in https://github.com/apple/container/pull/1741
• @SEPURI-SAI-KRISHNA made their first contribution in https://github.com/apple/container/pull/1784
• @radheradhe01 made their first contribution in https://github.com/apple/container/pull/1782
• @hluaguo made their first contribution in https://github.com/apple/container/pull/1791
• @costajohnt made their first contribution in https://github.com/apple/container/pull/1804

Full Changelog: https://github.com/apple/container/compare/1.0.0...1.1.0

:birthday: container is one year old!

Try out the new container machine feature and let us know what you think!

[!NOTE] The UserProperty-backed system settings have been replaced by a TOML configuration file. See the tutorial for details.

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • container machine for long-lived Linux environments with tight host integration.
  • ⌨️ A TOML configuration file replaces UserDefault-backed system properties, removing the container system property get and set subcommands.
  • ⌨️ Cleaned up structured (JSON, YAML, TOML) output shape for container, image, network, and volume ls and inpect.
  • Fixed container help subcommand...
  • Fixed output formatting for several commands
  • Add --stop-signal option for container run
  • 👩‍💻 Removed compatibility with application major version 0 XPC APIs. A subsequent release will introduce a version on the API itself so that clients and server can check compatibility.
• Network
  • Use XPC-connection-as-lease to fix IP address leaks
• Storage
  • Add container cp command
  • Fixed accounting errors in system df

What's Changed

• Tests/CLITests: drain stdout/stderr concurrently in CLITest.run by @mvanhorn in https://github.com/apple/container/pull/1471
• Build output should just be tags/paths. by @jglogan in https://github.com/apple/container/pull/1478
• Use NetworkResource for network management in API server. by @jglogan in https://github.com/apple/container/pull/1421
• Use SystemPath for HostDNSResolver. by @jglogan in https://github.com/apple/container/pull/1480
• Update documents with note about container-to-host networking. by @jglogan in https://github.com/apple/container/pull/1482
• Sort networks by ID in API server list(). by @jglogan in https://github.com/apple/container/pull/1487
• CLI: Support --shm-size by @dcantah in https://github.com/apple/container/pull/1488
• Improve integration test speed by @noah-thor in https://github.com/apple/container/pull/1489
• Simplify the serial suite trait by @katiewasnothere in https://github.com/apple/container/pull/1497
• Switch NetworksService, VolumesService, EntityStore to FilePath. by @jglogan in https://github.com/apple/container/pull/1493
• [scripts]: add prompt for updating container with unsigned package by @saehejkang in https://github.com/apple/container/pull/1468
• Change PR build to generate coverage and comment it by @noah-thor in https://github.com/apple/container/pull/1474
• Deps: Bump CZ to 0.32.0 by @dcantah in https://github.com/apple/container/pull/1498
• Move to TOML configuration for defaults by @noah-thor in https://github.com/apple/container/pull/1425
• docs: fix typos and polish README wording by @12ya in https://github.com/apple/container/pull/1499
• De-duplicate building during testing by @noah-thor in https://github.com/apple/container/pull/1507
• Centralize utilities for configuration loading and path parsing by @noah-thor in https://github.com/apple/container/pull/1448
• Use SystemPath for PacketFilter. by @chrisgeo in https://github.com/apple/container/pull/1518
• swift-configuration decoder by @noah-thor in https://github.com/apple/container/pull/1447
• Fix PR coverage comment never posting by @noah-thor in https://github.com/apple/container/pull/1541
• Use SystemPath for DirectoryWatcher. by @chrisgeo in https://github.com/apple/container/pull/1522
• Adds XPC sessions with disconnect handlers. by @jglogan in https://github.com/apple/container/pull/1524
• Use allocate with session to automatically clean up IPs. by @jglogan in https://github.com/apple/container/pull/1544
• Use SystemPath for ContainerResource.Filesystem. by @chrisgeo in https://github.com/apple/container/pull/1523
• Add support for layered and plugin configurations by @noah-thor in https://github.com/apple/container/pull/1543
• Bump containerization to 0.32.1 by @JaewonHur in https://github.com/apple/container/pull/1549
• Remove IP allocation from API server. by @jglogan in https://github.com/apple/container/pull/1545
• Add variant Support by @ajemory in https://github.com/apple/container/pull/1548
• ci: bump actions/labeler from 6.0.1 to 6.1.0 in the github-actions group by @dependabot[bot] in https://github.com/apple/container/pull/1550
• Relax host-only network test. by @jglogan in https://github.com/apple/container/pull/1552
• Fix inconsistent volume createdAt JSON encoding by @realrajaryan in https://github.com/apple/container/pull/1556
• Fix: image list align with other commands when use format should ignore quiet by @tico88612 in https://github.com/apple/container/pull/1553
• Reject conflicting DNS flags by @LeSingh1 in https://github.com/apple/container/pull/1559
• Reject conflicting volume delete flags by @realrajaryan in https://github.com/apple/container/pull/1560
• Validate container system logs --last flag by @realrajaryan in https://github.com/apple/container/pull/1561
• Ensure read-only user config removed on every startup. by @jglogan in https://github.com/apple/container/pull/1567
• Rename config file to config.toml. by @jglogan in https://github.com/apple/container/pull/1568
• Make inspect error handling for missing resources consistent by @realrajaryan in https://github.com/apple/container/pull/1564
• Add container copy/cp command for host-container file transfer by @simone-panico in https://github.com/apple/container/pull/1190
• [images]: convert save to use FilePath by @saehejkang in https://github.com/apple/container/pull/1574
• [images]: fix image load error to write to stderr and use FilePath by @saehejkang in https://github.com/apple/container/pull/1570
• Reorganize runtime targets for scalable plugin support by @ajemory in https://github.com/apple/container/pull/1577
• Add more tests for container copy by @JaewonHur in https://github.com/apple/container/pull/1579
• Update container copy to use FilePath by @JaewonHur in https://github.com/apple/container/pull/1580
• Add notes regarding --log-root to the command reference. by @jglogan in https://github.com/apple/container/pull/1582
• cli: Add support for --stop-signal by @dcantah in https://github.com/apple/container/pull/1462
• fix: clamp ProgressBar barLength to non-negative value to avoid crash by @ErwanLegrand in https://github.com/apple/container/pull/1525
• Adds vertical space between groups in help. by @jglogan in https://github.com/apple/container/pull/1585
• Refine custom init how-to and BUILDING documentation. by @jglogan in https://github.com/apple/container/pull/1586
• Improve readability of progress bar width computation. by @jglogan in https://github.com/apple/container/pull/1584
• Bump containerization to 0.33.1 by @dkovba in https://github.com/apple/container/pull/1601
• Use FilePath for app, install, and log roots. by @jglogan in https://github.com/apple/container/pull/1558
• Support use of custom app root with system config in CLI commands by @katiewasnothere in https://github.com/apple/container/pull/1600
• Add shmSize to management flag's init by @katiewasnothere in https://github.com/apple/container/pull/1603
• cli: resolve subcommand path in container help by @0xMH in https://github.com/apple/container/pull/1587
• Add ability to configure integration test list at command line by @katiewasnothere in https://github.com/apple/container/pull/1608
• Align JSON output with shape for container resource. by @jglogan in https://github.com/apple/container/pull/1611
• Use ManagedResource for volumes in CLI commands by @katiewasnothere in https://github.com/apple/container/pull/1607
• Fix potential integer math crash on PublishPort. by @jglogan in https://github.com/apple/container/pull/1612
• Reorganize Swift package targets for network plugin. by @jglogan in https://github.com/apple/container/pull/1615
• [how-to]: fix documentation example by @saehejkang in https://github.com/apple/container/pull/1596
• Remove XPC compatibility code, simplify network model. by @jglogan in https://github.com/apple/container/pull/1616
• Use FilePath for PublishSocket by @chrisgeo in https://github.com/apple/container/pull/1594
• Fix system df to count content blobs and deduplicate shared storage by @realrajaryan in https://github.com/apple/container/pull/1555
• Create ImageResource conforming to ManagedResource by @katiewasnothere in https://github.com/apple/container/pull/1619
• Use a consistent container CLI path in integration tests by @zdk in https://github.com/apple/container/pull/1621
• Normalize JSON output for network and volume resources. by @jglogan in https://github.com/apple/container/pull/1624
• Fix TestCLIVersion build-type check for release CI by @zdk in https://github.com/apple/container/pull/1627
• Add NOTICE entry for swift-configuration-toml by @katiewasnothere in https://github.com/apple/container/pull/1629
• kill: Wait for container to exit after sigkill by @dcantah in https://github.com/apple/container/pull/1589
• Add an error message for dockerfile >= 16KB until #735 is resolved by @katiewasnothere in https://github.com/apple/container/pull/1634
• Write log/error output from commands to stderr. by @jglogan in https://github.com/apple/container/pull/1632
• Add docs on using container system configurations by @katiewasnothere in https://github.com/apple/container/pull/1636
• Fix make test SIGSEGV on Swift 6.2 by @ajemory in https://github.com/apple/container/pull/1638
• Fix type in memory size format for config docs by @katiewasnothere in https://github.com/apple/container/pull/1639
• Use name instead of id in NetworkConfiguration. by @jglogan in https://github.com/apple/container/pull/1648
• Make pre-commit hook installation and execution work in git worktrees by @harshitsinghbhandari in https://github.com/apple/container/pull/1643
• [Actions] Use commit sha for imported gh actions by @katiewasnothere in https://github.com/apple/container/pull/1649
• Rearrange shape of JSON output for images by @katiewasnothere in https://github.com/apple/container/pull/1652
• Fix --format yaml and toml output by @realrajaryan in https://github.com/apple/container/pull/1653
• Update command ref and how to docs by @realrajaryan in https://github.com/apple/container/pull/1654
• Auto-install hawkeye in ensure-hawkeye-exists.sh by @harshitsinghbhandari in https://github.com/apple/container/pull/1644
• [images]: fix image load/save to use FilePathOps utility by @saehejkang in https://github.com/apple/container/pull/1590
• Omit hash scheme from image.id. by @jglogan in https://github.com/apple/container/pull/1658
• Remove duplicated image name in image JSON output by @katiewasnothere in https://github.com/apple/container/pull/1655
• Conform containers to ManagedResource by @ajemory in https://github.com/apple/container/pull/1656
• Increase CI timeout to 75 minutes by @realrajaryan in https://github.com/apple/container/pull/1663
• Add container machine for managing persistent Linux environments by @realrajaryan in https://github.com/apple/container/pull/1662
• Add backward compat for ContainerConfig cpuOverhead. by @jglogan in https://github.com/apple/container/pull/1665

New Contributors

• @12ya made their first contribution in https://github.com/apple/container/pull/1499
• @chrisgeo made their first contribution in https://github.com/apple/container/pull/1518
• @LeSingh1 made their first contribution in https://github.com/apple/container/pull/1559
• @ErwanLegrand made their first contribution in https://github.com/apple/container/pull/1525
• @0xMH made their first contribution in https://github.com/apple/container/pull/1587
• @harshitsinghbhandari made their first contribution in https://github.com/apple/container/pull/1643

Full Changelog: https://github.com/apple/container/compare/0.12.3...1.0.0

This patch release includes two security fixes:

• Prevent HTTP downgrade in registry-related commands
• Prevent path and rule injection in container system dns commands

What's Changed

• Fix RequestScheme formatting. by @jglogan in https://github.com/apple/container/pull/1473
• ImagePush: print image reference to stdout on success by @mvanhorn in https://github.com/apple/container/pull/1470
• ensure-container-stopped.sh: don't fail on launchctl errors by @p-linnane in https://github.com/apple/container/pull/1461

Full Changelog: https://github.com/apple/container/compare/0.12.2...0.12.3

This patch release addresses an API compatibility fix that only surfaces on Sequoia. There are no functional changes.

What's Changed

• Allow macOS 15 to list and delete networks by @katiewasnothere in https://github.com/apple/container/pull/1464

Full Changelog: https://github.com/apple/container/compare/0.12.0...0.12.1

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • plain progress output
  • color progress output
  • Use plain if stderr is not a TTY
  • Consolidated output format handling
  • YAML output format support
  • ⌨️ Support --cap-add and --cap-drop for containers. The default set of capabilities has been reduced, so if you need the old behavior that grants all capabilities, you will need to delete and recreate your containers.
  • Use TOML for plugin configuration files
  • Pass SSH_AUTH_SOCK properly if its value changes after user login
  • Update kernel to kata-3.28.0
• Images
  • User-friendly platform error message for image save
• Build
  • Fix unable to write data to the archive, code 0 error during build
  • 👩‍💻Fix errors with Dockerfile-specific ignore file and read-only build context. This change modified the container-builder-shim gRPC protocol such that older clients cannot perform builds. Please file an issue if this adversely affects your project. We've going to attempt to keep the protocol compatible for subsequent major version 0 releases.
  • Fix ARG parsing bugs
• Storage
  • Fix unreliable single file mounts
  • Journal option for container volume create

What's Changed

• Removes unused Archiver.uncompress(). by @jglogan in https://github.com/apple/container/pull/1372
• Relocate Source/Helpers folders to sensible locations. by @jglogan in https://github.com/apple/container/pull/1363
• ci: bump the github-actions group with 2 updates by @dependabot[bot] in https://github.com/apple/container/pull/1374
• Add Plain Progress Output Mode by @nrthakur in https://github.com/apple/container/pull/1367
• Adding Bug Report Guide by @ajemory in https://github.com/apple/container/pull/1292
• Fixing issue template help paths by @ajemory in https://github.com/apple/container/pull/1382
• doc: Document plain clear-on finish behavior by @manojmahapatra in https://github.com/apple/container/pull/1379
• Remove XPC timeout based on SIGTERM timeout in container stop by @katiewasnothere in https://github.com/apple/container/pull/1387
• Dedupe user-supplied IDs for container delete. by @jglogan in https://github.com/apple/container/pull/1388
• feat: add help for cli plugin by @tico88612 in https://github.com/apple/container/pull/1068
• Bump containerization to 0.30.1 by @adityaramani in https://github.com/apple/container/pull/1396
• Consolidate CLI formatting infrastructure by @realrajaryan in https://github.com/apple/container/pull/1385
• Move exit status check into ExitWaiter register call by @katiewasnothere in https://github.com/apple/container/pull/1397
• Create ResourceLabels and use for ManagedResource, NetworkConfiguration. by @jglogan in https://github.com/apple/container/pull/1360
• Add capabilities support by @dcantah in https://github.com/apple/container/pull/1383
• API: Rename to NetworkClient, client as instance. by @jglogan in https://github.com/apple/container/pull/1405
• Write file data into archive only for regular files by @adityaramani in https://github.com/apple/container/pull/1403
• Add Color Progress Output Mode by @nrthakur in https://github.com/apple/container/pull/1384
• Fall back to simple text output when stdout is not a TTY by @knQzx in https://github.com/apple/container/pull/1392
• Fix ContainerResource build failure by @DePasqualeOrg in https://github.com/apple/container/pull/1408
• ci: bump the github-actions group with 3 updates by @dependabot[bot] in https://github.com/apple/container/pull/1419
• Move to TOML configuration for plugin configurations by @noah-thor in https://github.com/apple/container/pull/1422
• Fix ssh forwarding to use current SSH_AUTH_SOCK value by @JaewonHur in https://github.com/apple/container/pull/1420
• Update builder API to use grpc-swift-2. (#1309) by @jglogan in https://github.com/apple/container/pull/1416
• stats: restore terminal when streaming is interrupted by a signal by @Otoru in https://github.com/apple/container/pull/1355
• improve error message when image save platform is not available by @knQzx in https://github.com/apple/container/pull/1418
• Fix using docker specific ignore with read-only build context by @JaewonHur in https://github.com/apple/container/pull/1349
• Update kernel to kata-3.28.0. by @jglogan in https://github.com/apple/container/pull/1431
• Makes bootstrap env parameter compatible with older clients. by @jglogan in https://github.com/apple/container/pull/1434
• Add unit and integration coverage report make targets by @noah-thor in https://github.com/apple/container/pull/1427
• [build]: add tests for copy from by @saehejkang in https://github.com/apple/container/pull/1380
• Explicitly pass default subnets into network creation by @noah-thor in https://github.com/apple/container/pull/1424
• Updates containerization dependency to 0.31.0. by @jglogan in https://github.com/apple/container/pull/1435
• Fix: memory leak and silent read error in Archiver._compressFile causing build failures under /Users/ by @Ronitsabhaya75 in https://github.com/apple/container/pull/1432
• Adds journal option to container volume create. by @jglogan in https://github.com/apple/container/pull/1412
• Create a NOTICE file for apple/container's dependencies by @katiewasnothere in https://github.com/apple/container/pull/1436
• Make ProgressFlags.makeConfig() public. by @jglogan in https://github.com/apple/container/pull/1438
• Change guest ssh socket path by @JaewonHur in https://github.com/apple/container/pull/1441
• Add container system version with format yaml by @tico88612 in https://github.com/apple/container/pull/1353
• add plugin label to builder by @realrajaryan in https://github.com/apple/container/pull/1443
• Add yams to apple/container's notice file by @katiewasnothere in https://github.com/apple/container/pull/1442
• Fix "not installing shadowed plugin" startup log noise. by @jglogan in https://github.com/apple/container/pull/1451

New Contributors

• @nrthakur made their first contribution in https://github.com/apple/container/pull/1367
• @knQzx made their first contribution in https://github.com/apple/container/pull/1392
• @DePasqualeOrg made their first contribution in https://github.com/apple/container/pull/1408
• @noah-thor made their first contribution in https://github.com/apple/container/pull/1422

Full Changelog: https://github.com/apple/container/compare/0.11.0...0.12.0

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • Fix container lifecycle-related hangs
  • Set default CPUs and memory for regular containers via system properties
  • Set default CPUs and memory for builder via system properties
• Images
  • CONTAINER_DEFAULT_PLATFORM for default image platform selection
  • container export writes an OCI layout tar file for a stopped container
• Build
  • Build using Dockerfile-specific ignore files
  • Build using secrets
  • Fix ARG parsing bugs
• Networking
  • Adds mtu network attachment option

What's Changed

• Bump containerization to 0.26.4 by @realrajaryan in https://github.com/apple/container/pull/1276
• Stabilize testBuildNetworkAccess. by @jglogan in https://github.com/apple/container/pull/1271
• Fix container start hang on invalid executable by @JaewonHur in https://github.com/apple/container/pull/1278
• [building]: add steps for using container-builder-shim locally by @saehejkang in https://github.com/apple/container/pull/1279
• Bump Containerization to 0.26.5 by @realrajaryan in https://github.com/apple/container/pull/1282
• GH actions: do not interpolate template variables in run blocks. by @jglogan in https://github.com/apple/container/pull/1284
• Capture container logs on failed CI runs. by @jglogan in https://github.com/apple/container/pull/1285
• Add mtu option for network attachments by @realrajaryan in https://github.com/apple/container/pull/1267
• ci: bump the github-actions group with 2 updates by @dependabot[bot] in https://github.com/apple/container/pull/1288
• Add container.cpus and container.memory system properties by @realrajaryan in https://github.com/apple/container/pull/1266
• Feat: add RegistryResource by @tico88612 in https://github.com/apple/container/pull/1195
• Fix race condition on SandboxService.waiters by @JaewonHur in https://github.com/apple/container/pull/1289
• Add build.cpus and build.memory system properties by @realrajaryan in https://github.com/apple/container/pull/1293
• Serialize network tests again by @JaewonHur in https://github.com/apple/container/pull/1294
• Move parser tests that rely on userdefault manipulation to TestCLINoP… by @realrajaryan in https://github.com/apple/container/pull/1299
• Tolerate container-builder-shim check fail by @JaewonHur in https://github.com/apple/container/pull/1297
• Give more time to DirectoryWatcherTest by @JaewonHur in https://github.com/apple/container/pull/1296
• Add fallback to CONTAINER_DEFAULT_PLATFORM for image architecture by @Willjianger9 in https://github.com/apple/container/pull/1286
• Bump to use containerization 0.27.0 by @adityaramani in https://github.com/apple/container/pull/1304
• Refactor: container export a tar archive by @tico88612 in https://github.com/apple/container/pull/1303
• Reap auto remove containers if there are running on system start by @JaewonHur in https://github.com/apple/container/pull/1290
• Remove trailing comma by @benediktjohannes in https://github.com/apple/container/pull/1315
• Update builder API to use grpc-swift-2. by @jglogan in https://github.com/apple/container/pull/1309
• Fix docker ignore by @JaewonHur in https://github.com/apple/container/pull/1273
• Add support for build secrets by @percontation in https://github.com/apple/container/pull/1300
• Remove user defaults on userdata uninstall. by @jglogan in https://github.com/apple/container/pull/1317
• [networks]: add decoder/encoder to Attachment and NetworkStatus by @saehejkang in https://github.com/apple/container/pull/1216
• Revert "Update builder API to use grpc-swift-2. (#1309)" by @egernst in https://github.com/apple/container/pull/1324
• volumes: Allow "." by @dcantah in https://github.com/apple/container/pull/1326
• Add rootfs override by @JaewonHur in https://github.com/apple/container/pull/1323
• Bump Containerization version to 0.29.0 by @adityaramani in https://github.com/apple/container/pull/1327
• Use Sendable DNS types. by @jglogan in https://github.com/apple/container/pull/1269
• make schemeFor public by @realrajaryan in https://github.com/apple/container/pull/1331
• README: Add logo by @dcantah in https://github.com/apple/container/pull/1339
• ci: bump actions/download-artifact from 8.0.0 to 8.0.1 in the github-actions group by @dependabot[bot] in https://github.com/apple/container/pull/1325
• Remove obsolete disableAllocator from network delete path by @manojmahapatra in https://github.com/apple/container/pull/1332
• Add TestCLIVersion to integration tests and fix assertions by @tico88612 in https://github.com/apple/container/pull/1312
• CLI: stop and delete should error on not found containers by @dcantah in https://github.com/apple/container/pull/878
• Fix a compilation error by @dkovba in https://github.com/apple/container/pull/1346
• Make ProcessConfiguration.User Equatable by @JaewonHur in https://github.com/apple/container/pull/1357
• Add plugin resources by @JaewonHur in https://github.com/apple/container/pull/1356
• Ensure that the bar length never exceeds the remaining width by @dkovba in https://github.com/apple/container/pull/1348
• build: extend signal handling scope to cover the unpack phase by @Otoru in https://github.com/apple/container/pull/1358
• Update builder to 0.11.0. by @jglogan in https://github.com/apple/container/pull/1369
• [build]: add tests for dockerfile arg parsing by @saehejkang in https://github.com/apple/container/pull/1342
• Don't bake DNS server into builder container config. by @jglogan in https://github.com/apple/container/pull/1370
• Add TestCLIStatus to integration tests and fix assertions by @tico88612 in https://github.com/apple/container/pull/1368

New Contributors

• @Willjianger9 made their first contribution in https://github.com/apple/container/pull/1286
• @benediktjohannes made their first contribution in https://github.com/apple/container/pull/1315
• @percontation made their first contribution in https://github.com/apple/container/pull/1300
• @Otoru made their first contribution in https://github.com/apple/container/pull/1358

Full Changelog: https://github.com/apple/container/compare/0.10.0...0.11.0

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • 👩‍💻Rework ClientContainer as client as a generic client
  • 👩‍💻Update API calls to use correct form of the term "clean up"
  • Fix kernel panic (selinux_inode_free_security) in container under load
  • Support selecting VM init image on container create/run
  • 👩‍💻Container bundle creation moved to SandboxService
  • Add a script for updating container to release package
  • Support exporting current container to image
• Networking
  • 👩‍💻Support using multiple different network plugins

What's Changed

• [Docs] Fix typo in BUILDING.md: launchd -> launchctl by @manojmahapatra in https://github.com/apple/container/pull/1146
• CI: Add signed commit check by @dcantah in https://github.com/apple/container/pull/1152
• CLI: Rework ClientContainer by @dcantah in https://github.com/apple/container/pull/1139
• Add debugging to the PR labeler CI flow by @katiewasnothere in https://github.com/apple/container/pull/1155
• Fix file path for the PR number in the PR labeler workflow by @katiewasnothere in https://github.com/apple/container/pull/1158
• [deps]: bump containerization to 0.25.0 by @saehejkang in https://github.com/apple/container/pull/1161
• [build-command]: Add --pull option for fetching latest image by @saehejkang in https://github.com/apple/container/pull/844
• chore: Replace force-unwrapped String(data:encoding:) with String(decoding:as:) by @manojmahapatra in https://github.com/apple/container/pull/1164
• CLI: Forego logging errors on multi-container operations by @dcantah in https://github.com/apple/container/pull/1163
• Send tar hash in the first BuildTransfer packet by @JaewonHur in https://github.com/apple/container/pull/1149
• Add builder tests by @JaewonHur in https://github.com/apple/container/pull/1154
• Don't enable selinux LSM on boot. by @jglogan in https://github.com/apple/container/pull/1166
• Warn user when a named volume is auto-created by @poetryofcode in https://github.com/apple/container/pull/1108
• Fix relative path mount tests by @dkovba in https://github.com/apple/container/pull/1168
• feat: Add runtime flag to container create and run commands (#1049) by @iko1 in https://github.com/apple/container/pull/1109
• feat: add --init-image flag for specifying custom init filesystem images per VM by @manuschillerdev in https://github.com/apple/container/pull/937
• Feat: add container registry list by @tico88612 in https://github.com/apple/container/pull/1119
• APIServer: Add support for filtering to list rpc by @dcantah in https://github.com/apple/container/pull/1175
• Fix persistent CI failures. by @jglogan in https://github.com/apple/container/pull/1205
• feat: Moving bundle creation from ContainerService to SandboxService by @ajemory in https://github.com/apple/container/pull/1076
• Support using multiple different network plugins by @katiewasnothere in https://github.com/apple/container/pull/1151
• ContainerService: Add minimum memory amount validation by @dcantah in https://github.com/apple/container/pull/1208
• Add init methods for all the members of the Flags type by @adityaramani in https://github.com/apple/container/pull/1203
• Support exporting current container to image by @JaewonHur in https://github.com/apple/container/pull/1172
• Fix CI integration test coldstart issues. by @jglogan in https://github.com/apple/container/pull/1230
• Add test for container export by @JaewonHur in https://github.com/apple/container/pull/1229
• bump to containerization 0.26.2 by @yibozhuang in https://github.com/apple/container/pull/1235
• CI observability enhancements. by @jglogan in https://github.com/apple/container/pull/1193
• added the other labels by @Ronitsabhaya75 in https://github.com/apple/container/pull/1125
• Downgrade the mapping of warnings to the default log level by @dkovba in https://github.com/apple/container/pull/1238
• Add --format option for system status. by @jglogan in https://github.com/apple/container/pull/1237
• Fix: Environment variables can be duplicated on run by @simone-panico in https://github.com/apple/container/pull/1218
• Minimal runtime variant plumbing. by @jglogan in https://github.com/apple/container/pull/1239
• Revert "Minimal runtime variant plumbing. (#1239)" by @jglogan in https://github.com/apple/container/pull/1255
• cli: Add --init to run/create by @dcantah in https://github.com/apple/container/pull/1244
• [scripts]: add update-container script for upgrade/downgrades by @saehejkang in https://github.com/apple/container/pull/1173
• Fix directory watcher by @JaewonHur in https://github.com/apple/container/pull/1234
• Try to trigger the network privacy alert on port publish. by @jglogan in https://github.com/apple/container/pull/1248

New Contributors

• @manojmahapatra made their first contribution in https://github.com/apple/container/pull/1146
• @poetryofcode made their first contribution in https://github.com/apple/container/pull/1108
• @ajemory made their first contribution in https://github.com/apple/container/pull/1076
• @simone-panico made their first contribution in https://github.com/apple/container/pull/1218

Full Changelog: https://github.com/apple/container/compare/0.9.0...0.10.0

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • Use Kata 3.26.0 kernel
  • Unpack layer content compressed with zstd
  • Install kernels compressed with zstd
  • Configure resource limits
• Network
  • Access host services through hostnames like host.docker.internal
  • Create networks with host-only access

What's Changed

• [image-inspect]: stdout/stderr and logging refactor by @saehejkang in https://github.com/apple/container/pull/1044
• Fix: prevent delete default network by @tico88612 in https://github.com/apple/container/pull/1083
• Place image store data correctly for app-root path. by @jglogan in https://github.com/apple/container/pull/1085
• Add --dns support to build command for custom DNS resolution by @cympak2 in https://github.com/apple/container/pull/1067
• Add option to stop services in all launchd domains by @p-linnane in https://github.com/apple/container/pull/1077
• Host connection by @JaewonHur in https://github.com/apple/container/pull/1078
• Feat: container image delete force option by @tico88612 in https://github.com/apple/container/pull/1096
• Make TerminalProgress a library. by @jglogan in https://github.com/apple/container/pull/1093
• Isolated network by @JaewonHur in https://github.com/apple/container/pull/1079
• Fix grammar in BUILDING.md by @claudeaceae in https://github.com/apple/container/pull/984
• Refactor container lifecycle functions to perform scoped rollback on failure by @JaewonHur in https://github.com/apple/container/pull/1080
• Implement container prune by @tico88612 in https://github.com/apple/container/pull/904
• [image-list]: Add full size field to json output by @saehejkang in https://github.com/apple/container/pull/1098
• Removes ArgumentParser import from NetworkMode. by @jglogan in https://github.com/apple/container/pull/1102
• Fix testExecOnExitingContainer by @JaewonHur in https://github.com/apple/container/pull/1107
• ci: bump actions/checkout from 6.0.1 to 6.0.2 in the github-actions group by @dependabot[bot] in https://github.com/apple/container/pull/1100
• Launch a service with waitForDebugger if specified by @JaewonHur in https://github.com/apple/container/pull/1101
• Bump to use containerization 0.23.2 by @adityaramani in https://github.com/apple/container/pull/1106
• Set mtu to old Containerization default by @dcantah in https://github.com/apple/container/pull/1110
• DirectoryWatcher: Small adjustments by @dcantah in https://github.com/apple/container/pull/1112
• Update to kata 3.20.0 kernel. by @jglogan in https://github.com/apple/container/pull/1114
• Add resource.role label to builder container by @realrajaryan in https://github.com/apple/container/pull/1120
• [docs]: update steps on building with containerization project by @saehejkang in https://github.com/apple/container/pull/1116
• Fix file descriptor leak in DirectoryWatcher by @Ronitsabhaya75 in https://github.com/apple/container/pull/1104
• Fix pfctl executable path in PacketFilter DNS reload by @w-ferg in https://github.com/apple/container/pull/1128
• Use labels instead of id to discriminate the builtin network. by @jglogan in https://github.com/apple/container/pull/1123
• CLI: Add support for rlimits by @dcantah in https://github.com/apple/container/pull/1129
• Deps: Bump Containerization to 0.24.0 by @dcantah in https://github.com/apple/container/pull/1127
• Add explanatory message before admin password prompt in uninstall script by @William-Laverty in https://github.com/apple/container/pull/1118
• Upgrade kernel to Kata 3.26.0. by @jglogan in https://github.com/apple/container/pull/1134
• Add in missing rlimits by @dcantah in https://github.com/apple/container/pull/1140

New Contributors

• @cympak2 made their first contribution in https://github.com/apple/container/pull/1067
• @p-linnane made their first contribution in https://github.com/apple/container/pull/1077
• @dependabot[bot] made their first contribution in https://github.com/apple/container/pull/1100
• @w-ferg made their first contribution in https://github.com/apple/container/pull/1128
• @William-Laverty made their first contribution in https://github.com/apple/container/pull/1118

Full Changelog: https://github.com/apple/container/compare/0.8.0...0.9.0

[!IMPORTANT]

This release addresses a low severity security issue (CVE-2026-20613) in the containerization library whereby a poorly assembled or maliciously crafted image tar archive can write files to locations other than the extraction directory. The issue is present when a user runs the container image load command (or the `cctl image load command in containerization)

No privilege escalation is possible by exploiting the issue; the archive extractor can only write files that the user could write themselves.

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • Prevent container image load from writing files outside the extraction directory
  • Fixed panics filesystem data integrity errors when stressing containers
  • Numerous stability fixes for container start and stop.
  • container system version shows version info
  • `--read-only command for container create/run mounts root filesystem read-only
  • Add platform architecture aliases for amd64 and arm64
  • 👩‍💻 Reorganized client APIs and numerous other API changes
• Network
  • container network prune removes unused networks
  • IPv6 network configuration, container DNS, and port forwarding
• Storage
  • Improve volume filesystem performance
  • Translate block mount options correctly, use sync mode by default

What's Changed

• fix(TerminalProgress): make the progress bar respect locale-specific decimal separator by @TTtie in https://github.com/apple/container/pull/936
• Fix broken image integration tests. by @jglogan in https://github.com/apple/container/pull/944
• Update CONTRIBUTORS to MAINTAINERS and point at containerization by @katiewasnothere in https://github.com/apple/container/pull/942
• [volumes]: refactor prune command by @saehejkang in https://github.com/apple/container/pull/940
• Lowercase error messages by @dkovba in https://github.com/apple/container/pull/945
• Deps: Bump Containerization to 0.16.2 by @dcantah in https://github.com/apple/container/pull/947
• feat: implement version sub command by @fatelei in https://github.com/apple/container/pull/911
• CLI: Fix -it not being able to pipe stdout by @dcantah in https://github.com/apple/container/pull/951
• [images]: refactor prune command by @saehejkang in https://github.com/apple/container/pull/941
• Feat: customize console output with env variable by @karenheckel in https://github.com/apple/container/pull/952
• Upgrade GitHub Actions for Node 24 compatibility by @salmanmkc in https://github.com/apple/container/pull/958
• Add Dependabot for GitHub Actions updates by @salmanmkc in https://github.com/apple/container/pull/960
• Upgrade GitHub Actions to latest versions by @salmanmkc in https://github.com/apple/container/pull/959
• Use new IP/CIDR types from Containerization. by @jglogan in https://github.com/apple/container/pull/957
• [networks]: add prune command by @saehejkang in https://github.com/apple/container/pull/914
• Fix: Kubes Cluster in Container Crashing Container (IS#923) by @Michaelgathara in https://github.com/apple/container/pull/930
• Turn on oops=panic kernel cmdline by @dcantah in https://github.com/apple/container/pull/971
• Add support for reading env from named pipes by @Bortnyak in https://github.com/apple/container/pull/974
• Adds network IPv6 configuration. by @jglogan in https://github.com/apple/container/pull/975
• Fix container auto-delete on rapid stop/start by @realrajaryan in https://github.com/apple/container/pull/841
• Fix MAC address option typo in how-to documentation by @claudeaceae in https://github.com/apple/container/pull/980
• Fix bash completion source path in documentation by @claudeaceae in https://github.com/apple/container/pull/981
• CLI: Fix stop not signalling waiters by @dcantah in https://github.com/apple/container/pull/972
• Fix grammar in tutorial.md by @claudeaceae in https://github.com/apple/container/pull/985
• Clarify uninstall script location in README by @claudeaceae in https://github.com/apple/container/pull/982
• Use full path for uninstall script in upgrade instructions by @claudeaceae in https://github.com/apple/container/pull/983
• Fix OSS header dates that break CI checks. by @jglogan in https://github.com/apple/container/pull/1009
• Update OSS header in Package.swift. by @jglogan in https://github.com/apple/container/pull/1010
• Fix port validation to allow same port for different protocols (#992) by @iko1 in https://github.com/apple/container/pull/1000
• CLI: Small fixups for implicit envvars by @dcantah in https://github.com/apple/container/pull/1014
• Deps: Bump Containerization to 0.19.0 by @dcantah in https://github.com/apple/container/pull/1015
• Parser: Support relative paths for --volume by @dcantah in https://github.com/apple/container/pull/1013
• Update license header on all files to include the current year by @katiewasnothere in https://github.com/apple/container/pull/1024
• makefile: Add cli target by @dcantah in https://github.com/apple/container/pull/1022
• Reorganize client libraries. by @jglogan in https://github.com/apple/container/pull/1020
• Update to containerization 0.20.0. by @jglogan in https://github.com/apple/container/pull/1027
• Tests: Fix relative path mount tests by @dcantah in https://github.com/apple/container/pull/1028
• CLI: Add read-only flag to run/create by @dcantah in https://github.com/apple/container/pull/999
• Resolve IPv6 address queries for container names. by @jglogan in https://github.com/apple/container/pull/1016
• [container]: add startedDate field by @saehejkang in https://github.com/apple/container/pull/1018
• Adds IPv6 port forwarding. by @jglogan in https://github.com/apple/container/pull/1029
• ProgressBar: Various fixes by @dcantah in https://github.com/apple/container/pull/1025
• Add instructions for using locally built init filesystem. by @jglogan in https://github.com/apple/container/pull/1032
• fix: improve error message when binding to privileged ports (fixes #978) by @Ronitsabhaya75 in https://github.com/apple/container/pull/1031
• fix: extract hostname from FQDN (#1011) by @iko1 in https://github.com/apple/container/pull/1017
• Fix: Support x86_64 architecture alias to prevent silent pull failure… by @Ronitsabhaya75 in https://github.com/apple/container/pull/1036
• Fix relative path resolution in entrypoint by @ParkSeongGeun in https://github.com/apple/container/pull/987
• Fix the FS error when using Virtualization by @JaewonHur in https://github.com/apple/container/pull/1041
• Add support for aarch64 architecture alias by @Ronitsabhaya75 in https://github.com/apple/container/pull/1040
• fix: use pax instead of tar for pkg payload extraction by @manuschillerdev in https://github.com/apple/container/pull/1038
• Fix unstable integration tests. by @jglogan in https://github.com/apple/container/pull/1060
• Adds opt-in pre-commit hook for format and header checks. by @jglogan in https://github.com/apple/container/pull/1062
• Update for containerization 0.21.0. by @jglogan in https://github.com/apple/container/pull/1056
• fix: performance warning should not output ANSI codes if stderr redirected by @iko1 in https://github.com/apple/container/pull/1059
• ContainerSvc: Handle unexpected sandbox svc exits by @dcantah in https://github.com/apple/container/pull/1065
• Throw error when starting a container with invalid virtiofs source by @JaewonHur in https://github.com/apple/container/pull/1051
• Change behavior of the default arguments in the plugin config by @katiewasnothere in https://github.com/apple/container/pull/1063
• Use configuration subnet and fallback to default subnet in allocation only plugin by @katiewasnothere in https://github.com/apple/container/pull/1057
• Update to containerization 0.21.1. by @jglogan in https://github.com/apple/container/pull/1064
• Use StderrLogHandler for rich logging features. by @jglogan in https://github.com/apple/container/pull/1066
• Select macOS 26 CI runners. by @jglogan in https://github.com/apple/container/pull/1074

New Contributors

• @TTtie made their first contribution in https://github.com/apple/container/pull/936
• @fatelei made their first contribution in https://github.com/apple/container/pull/911
• @karenheckel made their first contribution in https://github.com/apple/container/pull/952
• @salmanmkc made their first contribution in https://github.com/apple/container/pull/958
• @Michaelgathara made their first contribution in https://github.com/apple/container/pull/930
• @Bortnyak made their first contribution in https://github.com/apple/container/pull/974
• @claudeaceae made their first contribution in https://github.com/apple/container/pull/980
• @iko1 made their first contribution in https://github.com/apple/container/pull/1000
• @ParkSeongGeun made their first contribution in https://github.com/apple/container/pull/987
• @JaewonHur made their first contribution in https://github.com/apple/container/pull/1041
• @manuschillerdev made their first contribution in https://github.com/apple/container/pull/1038

Full Changelog: https://github.com/apple/container/compare/0.7.1...0.8.0