What’s New

container

Operating Systems

container release notes.

Latest 1.2.0 · by containerWebsiteapple/container

Changelog

1.2.0

Added
  • Add OCI maskedPaths and readonlyPaths support to Container API
  • Allow custom kernel boot args via --kernel-arg
  • Add TestCLISystemLogs and TestCLITermIO integration tests in new integration test suite
Changed
  • Use containerization version 0.40.1
  • Upgrade grpc-swift-nio-transport to 2.9.0
  • Use ordered journal mode for unpacked images
  • Use log instead of print for system start status messages
  • Use enum for warmup images
Fixed
  • Verify kernel archive integrity
  • Validate container ID from XPC requests
  • Remove force unwraps on XPC error set/get
  • Do not follow destination symlink when copying user configuration
  • Fix machine ID length test
  • Address flaky TestCLIKernelSetSerial suite
  • Fix image env vars, build context checks, TCP/UDP port forward buffer, and validate plugin name
  • Increase XPC timeout for Machine API operations
  • Fix BuilderStart race, parallelize container build tests
Removed
  • Remove force unwraps on XPC error set/get
  • Removes obsolete CLITests directory
What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/1.1.0...1.2.0

View originalPermalink

1.1.0

Added
  • Add checksum validation to hawkeye installation
Changed
  • Always update default network with system configuration values
  • Add collection capacity hints to known-size loops in parser
Fixed
  • Unix domain socket mounts now work in non-root containers
  • Fix container cp failures with relative source paths
  • Fix duplicate "(default: 3)" in --max-concurrent-downloads help text
  • Propagate permissions for all host-to-container socket mounts
  • Replace try! with try? for stdout/stderr writes in ProcessIO
  • Remove force-unwrap on session dictionary in DefaultNetworkService
  • Log the graceful-stop error instead of silently discarding it in gracefulStopContainer
  • Fix exec empty arguments crash
  • Propagate error from createDirectory in system start
  • Route container image save reference list to stderr in stdout mode
Removed
  • Remove network variant computation from API server
Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/1.0.0...1.1.0

View originalPermalink

1.0.0

Added
  • Add `container machine` feature for long-lived Linux environments with tight host integration
  • Add `--stop-signal` option for `container run`
  • Add `container cp` command
  • Add support for `--shm-size` option
  • Add support for layered and plugin configurations
  • Add `variant` support
Changed
  • Replace UserDefault-backed system properties with TOML configuration file
  • Clean up structured output shape for container, image, network, and volume `ls` and `inspect` commands
Fixed
  • Fix `container help subcommand...`
  • Fix output formatting for several commands
  • Use XPC-connection-as-lease to fix IP address leaks
  • Fix accounting errors in `system df`
  • Fix inconsistent volume createdAt JSON encoding
  • Fix image list alignment with other commands when format should ignore quiet
Removed
  • Remove `container system property` `get` and `set` subcommands
  • Remove compatibility with application major version 0 XPC APIs

:birthday: container is one year old!

Try out the new container machine feature and let us know what you think!

[!NOTE] The UserProperty-backed system settings have been replaced by a TOML configuration file. See the tutorial for details.

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/0.12.3...1.0.0

View originalPermalink

0.12.3

Changed
  • ImagePush prints image reference to stdout on success
Fixed
  • Fix RequestScheme formatting
  • ensure-container-stopped.sh does not fail on launchctl errors
Security
  • Prevent HTTP downgrade in registry-related commands
  • Prevent path and rule injection in container system dns commands

This patch release includes two security fixes:

What's Changed

Full Changelog: https://github.com/apple/container/compare/0.12.2...0.12.3

View originalPermalink

0.12.0

Added
  • Plain progress output
  • Color progress output
  • YAML output format support
  • Support --cap-add and --cap-drop for containers
  • Use TOML for plugin configuration files
  • Journal option for container volume create
Changed
  • Use plain progress output if stderr is not a TTY
  • Consolidated output format handling
  • Update kernel to kata-3.28.0
  • Default set of Linux capabilities has been reduced
Fixed
  • Pass SSH_AUTH_SOCK properly if its value changes after user login
  • Fix unable to write data to the archive, code 0 error during build
  • Fix errors with Dockerfile-specific ignore file and read-only build context
  • Fix ARG parsing bugs
  • Fix unreliable single file mounts
  • User-friendly platform error message for image save
Removed
  • Removes unused Archiver.uncompress()
Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/0.11.0...0.12.0

View originalPermalink

0.11.0

Added
  • Set default CPUs and memory for regular containers via system properties
  • Set default CPUs and memory for builder via system properties
  • Add CONTAINER_DEFAULT_PLATFORM environment variable for default image platform selection
  • Make container export write an OCI layout tar file for a stopped container
  • Build using Dockerfile-specific ignore files
  • Build using secrets
  • Add mtu network attachment option
  • Add rootfs override
  • Add plugin resources
Changed
  • Update builder API to use grpc-swift-2
  • Allow "." in volumes
  • Stop and delete should error on not found containers
  • Extend signal handling scope to cover the unpack phase during build
Fixed
  • Fix container lifecycle-related hangs
  • Fix ARG parsing bugs
  • Fix container start hang on invalid executable
  • Fix race condition on SandboxService.waiters
  • Fix docker ignore
Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/0.10.0...0.11.0

View originalPermalink

0.10.0

Added
  • Support selecting VM init image on container create/run
  • Add a script for updating container to release package
  • Support exporting current container to image
  • Add --pull option for fetching latest image in build command
  • Add runtime flag to container create and run commands
  • Add container registry list command
  • Add support for filtering to list rpc in APIServer
  • Add minimum memory amount validation in ContainerService
  • Add --format option for system status command
  • Add --init flag to run and create commands
  • Warn user when a named volume is auto-created
Changed
  • Rework ClientContainer as a generic client
  • Update API calls to use correct form of the term "clean up"
  • Move container bundle creation from ContainerService to SandboxService
  • Support using multiple different network plugins
  • Downgrade the mapping of warnings to the default log level
Fixed
  • Fix kernel panic (selinux_inode_free_security) in container under load
  • Fix environment variables being duplicated on run
  • Fix directory watcher
  • Fix relative path mount tests
Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/0.9.0...0.10.0

View originalPermalink

0.9.0

Added
  • Unpack layer content compressed with zstd
  • Install kernels compressed with zstd
  • Configure resource limits
  • Access host services through hostnames like host.docker.internal
  • Create networks with host-only access
  • Add --dns support to build command for custom DNS resolution
  • Add option to stop services in all launchd domains
  • Add force option to container image delete
  • Add full size field to image-list json output
  • Implement container prune
  • Launch a service with waitForDebugger if specified
  • Add support for rlimits to CLI
  • Add explanatory message before admin password prompt in uninstall script
Changed
  • Use Kata 3.26.0 kernel
  • Use labels instead of id to discriminate the builtin network
  • Set mtu to old Containerization default
Fixed
  • Prevent delete default network
  • Place image store data correctly for app-root path
  • Fix file descriptor leak in DirectoryWatcher
  • Fix pfctl executable path in PacketFilter DNS reload
Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/0.8.0...0.9.0

View originalPermalink

0.8.0

Added
  • Add container system version command to show version info
  • Add --read-only flag for container create and run commands to mount root filesystem read-only
  • Add platform architecture aliases for amd64 and arm64
  • Add container network prune command to remove unused networks
  • Add IPv6 network configuration, container DNS, and port forwarding support
  • Add support for reading environment variables from named pipes
  • Support relative paths for --volume option
Changed
  • Improve stability for container start and stop operations
  • Reorganize client APIs
  • Improve volume filesystem performance
  • Translate block mount options correctly and use sync mode by default
Fixed
  • Fix panics and filesystem data integrity errors when stressing containers
  • Make the progress bar respect locale-specific decimal separator
  • Fix -it not being able to pipe stdout
  • Fix container auto-delete on rapid stop and start
  • Fix stop not signalling waiters
  • Fix port validation to allow same port for different protocols
Security
  • Prevent container image load from writing files outside the extraction directory, addressing CVE-2026-20613

[!IMPORTANT]

This release addresses a low severity security issue (CVE-2026-20613) in the containerization library whereby a poorly assembled or maliciously crafted image tar archive can write files to locations other than the extraction directory. The issue is present when a user runs the container image load command (or the `cctl image load command in containerization)

No privilege escalation is possible by exploiting the issue; the archive extractor can only write files that the user could write themselves.

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

What's Changed
New Contributors

Full Changelog: https://github.com/apple/container/compare/0.7.1...0.8.0

View originalPermalink