# container: what changed from 0 to 1 - Product: container (https://whatsnew.fyi/product/container) - Vendor: container - Range: changelog entries numbered after 0.12.3 up to and including 1.3.1, stable releases only - Entries below: 7 releases (newest first) - Resolved: 0 is 0.12.3 and 1 is 1.3.1, the newest stable release of each major we track - Carrying security changes: 2 · CVEs mentioned: 4 · Mentioning breaking changes: 0 · Removing or deprecating something: 3 - Page: https://whatsnew.fyi/product/container/compare/0...1 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## What changed (65 changes, grouped by kind) ### Added #### 1.3.1 (2026-08-29) - Add container skill #### 1.2.1 (2026-08-07) - k8s plugin for turnkey local Kubernetes cluster (also in 1.2.0) - container export command for live containers (also in 1.2.0) - --ssh option for container build (also in 1.2.0) - --read-only-path and --masked-path options for container run for Kubernetes, Docker, and similar containers (also in 1.2.0) #### 1.2.0 (2026-07-29) - Allow custom kernel boot args via --kernel-arg #### 1.1.0 (2026-07-06) - Add checksum validation to hawkeye installation #### 1.0.0 (2026-06-09) - Add `container machine` feature for long-lived Linux environments with tight host integration - Add `--stop-signal` option for `container run` - Add `container cp` command - Add support for `--shm-size` option - Add support for layered and plugin configurations - Add `variant` support ### Changed #### 1.3.0 (2026-08-24) - Default Kata kernel is now 3.32.0-debug - Documentation has been expanded and reorganized - Relax maskedPaths and readonlyPaths for container machines #### 1.2.1 (2026-08-07) - Adjust overcommit and max_map_count vm defaults in guest VMs - Enable ssh forwarding for container build #### 1.2.0 (2026-07-29) - Use ordered journal mode for unpacked images - Use enum for warmup images #### 1.1.0 (2026-07-06) - Always update default network with system configuration values - Add collection capacity hints to known-size loops in parser #### 1.0.0 (2026-06-09) - Replace UserDefault-backed system properties with TOML configuration file - Clean up structured output shape for container, image, network, and volume `ls` and `inspect` commands ### Fixed #### 1.3.1 (2026-08-29) - Fix tmpfs mount source field left empty for --mount type=tmpfs #### 1.3.0 (2026-08-24) - Update sudoers file to not include dots - Refactor tmpfsMounts() to process tmpfs path correctly - Validate volume name in volume disk usage call - Fix k8s integration test with scoped domain - Fix a compilation error #### 1.2.2 (2026-08-08) - Fix glitch that prevented `container k8s` working when installed from the release package #### 1.2.1 (2026-08-07) - Increase testExecDetachProcessRunning sleep margin to avoid CI flake - Add readiness signal to DirectoryWatcher and fix DirectoryWatcherTest #### 1.2.0 (2026-07-29) - Image environment variables are now correctly handled #### 1.1.0 (2026-07-06) - Unix domain socket mounts now work in non-root containers - Fix container cp failures with relative source paths - Fix duplicate "(default: 3)" in --max-concurrent-downloads help text - Propagate permissions for all host-to-container socket mounts - Replace try! with try? for stdout/stderr writes in ProcessIO - Remove force-unwrap on session dictionary in DefaultNetworkService - Log the graceful-stop error instead of silently discarding it in gracefulStopContainer - Fix exec empty arguments crash - Propagate error from createDirectory in system start - Route container image save reference list to stderr in stdout mode #### 1.0.0 (2026-06-09) - Fix `container help subcommand...` - Fix output formatting for several commands - Use XPC-connection-as-lease to fix IP address leaks - Fix accounting errors in `system df` - Fix inconsistent volume createdAt JSON encoding - Fix image list alignment with other commands when format should ignore quiet ### Removed #### 1.3.0 (2026-08-24) - Removed --scheme auto for image operations, default is now https #### 1.1.0 (2026-07-06) - Remove network variant computation from API server #### 1.0.0 (2026-06-09) - Remove `container system property` `get` and `set` subcommands - Remove compatibility with application major version 0 XPC APIs ### Security #### 1.3.1 (2026-08-29) - Fix unchecked id that could allow creating a container or executing a container process to delete files outside its bundle - Fix ContainerizationOCI accepting unvalidated OCI descriptor digests that could enable path traversal in the local content store - Fix loading an OCI image layout that could read host files through a symlink - Fix RegistryClient following the WWW-Authenticate realm without validating its host or scheme - Fix unpacking a crafted image layer with a long invalid file name that could crash the unpacking process - Fix unpacking a crafted image layer with an invalid length extended-attribute name that could crash the unpacking process #### 1.2.0 (2026-07-29) - Bare-name image Config.Env entries no longer inherit values from the launching process's environment (CVE-2026-64786) - TCP port forwarder no longer buffers unbounded pre-connect data from published container ports (CVE-2026-64773) - Build filesystem sync no longer discloses host files outside the build context via symlinks (CVE-2026-64777) - BuildFSSync.walk() JSON response mode no longer reports the resolved host path of build-context symlinks that point outside the context - Special permission bits are now reset when extracting archives onto the host ## Release notes ### 1.3.1 - Date: 2026-08-29 - Version: 1.3.1 - Original notes: https://github.com/apple/container/releases/tag/1.3.1 - Permalink: https://whatsnew.fyi/product/container/releases/1.3.1 - **security** — Fix unchecked id that could allow creating a container or executing a container process to delete files outside its bundle - **security** — Fix ContainerizationOCI accepting unvalidated OCI descriptor digests that could enable path traversal in the local content store - **security** — Fix loading an OCI image layout that could read host files through a symlink - **security** — Fix RegistryClient following the WWW-Authenticate realm without validating its host or scheme - **security** — Fix unpacking a crafted image layer with a long invalid file name that could crash the unpacking process - **security** — Fix unpacking a crafted image layer with an invalid length extended-attribute name that could crash the unpacking process - **fixed** — Fix tmpfs mount source field left empty for --mount type=tmpfs - **added** — Add container skill This patch release addresses a number of security issues in the Containerization package: - [GHSA-x7pf-2jmj-pgcq](https://github.com/apple/containerization/security/advisories/GHSA-x7pf-2jmj-pgcq) - Creating a container or executing a container process can delete files outside its bundle through an unchecked id - [GHSA-f689-h8m7-3jp2](https://github.com/apple/containerization/security/advisories/GHSA-f689-h8m7-3jp2) - `ContainerizationOCI` accepts unvalidated OCI descriptor digests, enabling path traversal in the local content store - [GHSA-r3h2-rgqf-9hv9](https://github.com/apple/containerization/security/advisories/GHSA-r3h2-rgqf-9hv9) - Loading an OCI image layout can read host files through a symlink - [GHSA-mx96-5vvg-x2mg](https://github.com/apple/containerization/security/advisories/GHSA-mx96-5vvg-x2mg) - CVE-2026-65388 - `RegistryClient` follows the `WWW-Authenticate` realm without validating its host or scheme - [GHSA-697p-8837-37h3](https://github.com/apple/containerization/security/advisories/GHSA-697p-8837-37h3) - Unpacking a crafted image layer with a long(invalid) file name crashes the unpacking process - [GHSA-g3rx-2m58-rr63](https://github.com/apple/containerization/security/advisories/GHSA-g3rx-2m58-rr63) - Unpacking a crafted image layer with an invalid length extended-attribute name crashes the unpacking process ##### What's Changed * Add container skill by @crosbymichael in https://github.com/apple/container/pull/2154 * Fix tmpfs mount source field left empty for --mount type=tmpfs by @sivasath16 in https://github.com/apple/container/pull/2138 * Update to containerization 0.42.0 by @katiewasnothere in https://github.com/apple/container/pull/2207 ##### New Contributors * @sivasath16 made their first contribution in https://github.com/apple/container/pull/2138 **Full Changelog**: https://github.com/apple/container/compare/1.3.0...1.3.1 ### 1.3.0 - Date: 2026-08-24 - Version: 1.3.0 - Original notes: https://github.com/apple/container/releases/tag/1.3.0 - Permalink: https://whatsnew.fyi/product/container/releases/1.3.0 - **changed** — Default Kata kernel is now 3.32.0-debug - **changed** — Documentation has been expanded and reorganized - **changed** — Relax maskedPaths and readonlyPaths for container machines - **removed** — Removed --scheme auto for image operations, default is now https - **fixed** — Update sudoers file to not include dots - **fixed** — Refactor tmpfsMounts() to process tmpfs path correctly - **fixed** — Validate volume name in volume disk usage call - **fixed** — Fix k8s integration test with scoped domain - **fixed** — Fix a compilation error ##### Highlights ⌨️ denotes breaking CLI changes. 👩‍💻 denotes breaking API changes. - Core - [Default Kata kernel is now 3.32.0-debug](https://github.com/apple/container/pull/2143) - [Documentation has been expanded and reorganized](https://github.com/apple/container/pull/2032). - [Relax maskedPaths and readonlyPaths for container machines](https://github.com/apple/container/pull/2137) - Images - ⌨️ [Removed `--scheme auto` for image operations, default is now `https`](https://github.com/apple/container/issues/2099). ##### What's Changed * Update sudoers file to not include dots by @tumd in https://github.com/apple/container/pull/2080 * Refactor tmpfsMounts() to process tmpfs path correctly by @LevelVoid in https://github.com/apple/container/pull/2103 * Remove `auto` registry scheme. by @jglogan in https://github.com/apple/container/pull/2100 * Validate volume name in volume disk usage call by @katiewasnothere in https://github.com/apple/container/pull/2107 * Topic/docs refactor by @egernst in https://github.com/apple/container/pull/2032 * Integration test: fix k8s test with scoped domain. by @jglogan in https://github.com/apple/container/pull/2104 * Extracts createPluginLoader() for use by container k8s. by @jglogan in https://github.com/apple/container/pull/2115 * Fix a compilation error by @dkovba in https://github.com/apple/container/pull/2119 * Split K8sHelper, add WorkerProvisioner protocol, and add LinuxWorker … by @jshi991 in https://github.com/apple/container/pull/2110 * Do not set default maskedPaths and readonlyPaths for container machines by @katiewasnothere in https://github.com/apple/container/pull/2137 * Remove AsyncParsableCommand conformance from ContainerCLI by @noah-thor in https://github.com/apple/container/pull/2140 * Add identifier validation tests for the disk-usage routes by @realrajaryan in https://github.com/apple/container/pull/2136 * Update default kernel to Kata Containers 3.32.0 debug build by @agamdua in https://github.com/apple/container/pull/2143 ##### New Contributors * @tumd made their first contribution in https://github.com/apple/container/pull/2080 * @LevelVoid made their first contribution in https://github.com/apple/container/pull/2103 * @agamdua made their first contribution in https://github.com/apple/container/pull/2143 **Full Changelog**: https://github.com/apple/container/compare/1.2.2...1.3.0 ### 1.2.2 - Date: 2026-08-08 - Version: 1.2.2 - Original notes: https://github.com/apple/container/releases/tag/1.2.2 - Permalink: https://whatsnew.fyi/product/container/releases/1.2.2 - **fixed** — Fix glitch that prevented `container k8s` working when installed from the release package This release fixes a glitch that prevented `container k8s` working when installed from the release package. ##### What's Changed * Integration test: fix username/uid flake. by @jglogan in https://github.com/apple/container/pull/2086 * refactor: extract K8s logic into ContainerK8s library target by @jshi991 in https://github.com/apple/container/pull/2079 * Refactor `container k8s` to use plugin resource management. by @jglogan in https://github.com/apple/container/pull/2097 * Migrate ProgressBarTests to Swift Testing by @VictorPuga in https://github.com/apple/container/pull/2085 ##### New Contributors * @VictorPuga made their first contribution in https://github.com/apple/container/pull/2085 **Full Changelog**: https://github.com/apple/container/compare/1.2.1...1.2.2 ### 1.2.1 - Date: 2026-08-07 - Version: 1.2.1 - Original notes: https://github.com/apple/container/releases/tag/1.2.1 - Permalink: https://whatsnew.fyi/product/container/releases/1.2.1 - **added** — k8s plugin for turnkey local Kubernetes cluster - **added** — container export command for live containers - **added** — --ssh option for container build - **added** — --read-only-path and --masked-path options for container run for Kubernetes, Docker, and similar containers - **changed** — Adjust overcommit and max_map_count vm defaults in guest VMs - **changed** — Enable ssh forwarding for container build - **fixed** — Increase testExecDetachProcessRunning sleep margin to avoid CI flake - **fixed** — Add readiness signal to DirectoryWatcher and fix DirectoryWatcherTest ##### Highlights ⌨️ denotes breaking CLI changes. 👩‍💻 denotes breaking API changes. - Core - [`k8s` plugin for turnkey local Kubernetes cluster](https://github.com/apple/container/issues/2043) - [`container export` for live containers](https://github.com/apple/container/issues/1400). - [`--ssh` option for `container build`](https://github.com/apple/container/issues/1472). - [`--read-only-path` and `--masked-path` for `container run` for Kubernetes, Docker, and similar containers](https://github.com/apple/container/issues/2041). ##### What's Changed * [container]: add `container export` for live containers by @saehejkang in https://github.com/apple/container/pull/1630 * Adjust overcommit and max_map_count vm defaults in guest VMs by @adityabagchi24 in https://github.com/apple/container/pull/2055 * [package]: bump container-builder-shim to 0.13.1 by @saehejkang in https://github.com/apple/container/pull/2056 * [builder]: enable ssh forwarding for container build by @saehejkang in https://github.com/apple/container/pull/1508 * Move SSH builder test to Serialized tests by @JaewonHur in https://github.com/apple/container/pull/2061 * Increase testExecDetachProcessRunning sleep margin to avoid CI flake by @jglogan in https://github.com/apple/container/pull/2063 * Add readiness signal to DirectoryWatcher, fix DirectoryWatcherTest. by @jglogan in https://github.com/apple/container/pull/2066 * Log core counts in CI for perf analysis. by @jglogan in https://github.com/apple/container/pull/2070 * Add `--read-only-path` and `--masked-path` option to container run / create by @adityaramani in https://github.com/apple/container/pull/2069 * Simplify correlation of test prefix to test ID. by @jglogan in https://github.com/apple/container/pull/2071 * Integration test: cache warmup image tarfiles. by @jglogan in https://github.com/apple/container/pull/2074 * K8s plugin by @jshi991 in https://github.com/apple/container/pull/2044 ##### New Contributors * @jshi991 made their first contribution in https://github.com/apple/container/pull/2044 **Full Changelog**: https://github.com/apple/container/compare/1.2.0...1.2.1 ### 1.2.0 - Date: 2026-07-29 - Version: 1.2.0 - Original notes: https://github.com/apple/container/releases/tag/1.2.0 - Permalink: https://whatsnew.fyi/product/container/releases/1.2.0 - **security** — Bare-name image Config.Env entries no longer inherit values from the launching process's environment (CVE-2026-64786) - **security** — TCP port forwarder no longer buffers unbounded pre-connect data from published container ports (CVE-2026-64773) - **security** — Build filesystem sync no longer discloses host files outside the build context via symlinks (CVE-2026-64777) - **security** — BuildFSSync.walk() JSON response mode no longer reports the resolved host path of build-context symlinks that point outside the context - **security** — Special permission bits are now reset when extracting archives onto the host - **added** — k8s plugin for turnkey local Kubernetes cluster - **added** — container export command for live containers - **added** — --ssh option for container build - **added** — --read-only-path and --masked-path options for container run for Kubernetes, Docker, and similar containers - **added** — Allow custom kernel boot args via --kernel-arg - **fixed** — Image environment variables are now correctly handled - **changed** — Use ordered journal mode for unpacked images - **changed** — Use enum for warmup images ##### Highlights ⌨️ denotes breaking CLI changes. 👩‍💻 denotes breaking API changes. - SECURITY FIXES - [GHSA-xwgf-4rc5-p4m4](https://github.com/apple/container/security/advisories/GHSA-xwgf-4rc5-p4m4) - CVE-2026-64786 - bare-name image `Config.Env` entries should not inherit values from the launching process's environment - [GHSA-wg28-286f-56v6](https://github.com/apple/container/security/advisories/GHSA-wg28-286f-56v6) - CVE-2026-64773 - TCP port forwarder buffers unbounded pre-connect data from published container ports - [GHSA-2v2q-4q35-h585](https://github.com/apple/container/security/advisories/GHSA-2v2q-4q35-h585) - CVE-2026-64777 - Build filesystem sync discloses host files outside the build context via symlinks - [GHSA-g57j-434g-5xj2](https://github.com/apple/container/security/advisories/GHSA-g57j-434g-5xj2) - `BuildFSSync.walk()`'s JSON response mode reports the resolved host path of build-context symlinks that point outside the context. - [GHSA-5h49-6pr7-9mv4](https://github.com/apple/containerization/security/advisories/GHSA-5h49-6pr7-9mv4) - reset special permission bits when extracting archives onto the host. - Core - [`k8s` plugin for turnkey local Kubernetes cluster](https://github.com/apple/container/issues/2043) - [`container export` for live containers](https://github.com/apple/container/issues/1400). - [`--ssh` option for `container build`](https://github.com/apple/container/issues/1472). - [`--read-only-path` and `--masked-path` for `container run` for Kubernetes, Docker, and similar containers](https://github.com/apple/container/issues/2041). ##### What's Changed * Add TestCLISystemLogs and TestCLITermIO integration tests in new integration test suite by @katiewasnothere in https://github.com/apple/container/pull/1879 * Restore reverted migrations, migrate last tests. by @jglogan in https://github.com/apple/container/pull/1880 * Removes obsolete CLITests directory. by @jglogan in https://github.com/apple/container/pull/1886 * Integration coverage xpc helpers by @noah-thor in https://github.com/apple/container/pull/1551 * Upgrade grpc-swift-nio-transport to 2.9.0 and remove HTTP2ConnectBuff… by @adityabagchi24 in https://github.com/apple/container/pull/1790 * Updates containerization to 0.36.0. by @jglogan in https://github.com/apple/container/pull/1912 * Use containerization version 0.37.0 by @adityaramani in https://github.com/apple/container/pull/1932 * Verify kernel archive integrity by @haoruilee in https://github.com/apple/container/pull/1703 * Add commit/issue alert to PR template. by @jglogan in https://github.com/apple/container/pull/1945 * Remove `--skip-build` from test Makefile target. by @jglogan in https://github.com/apple/container/pull/1951 * Restore `--skip-build`, enable `import testable` for release builds. by @jglogan in https://github.com/apple/container/pull/1955 * [package]: bump container-builder-shim to 0.13.0 by @saehejkang in https://github.com/apple/container/pull/1953 * Validate container ID from XPC requests by @katiewasnothere in https://github.com/apple/container/pull/1956 * Remove force unwraps on XPC error set/get by @katiewasnothere in https://github.com/apple/container/pull/1958 * Do not follow destination symlink when copying user configuration by @katiewasnothere in https://github.com/apple/container/pull/1957 * Fix machine ID length test. by @jglogan in https://github.com/apple/container/pull/1971 * Address flaky TestCLIKernelSetSerial suite. by @jglogan in https://github.com/apple/container/pull/1976 * [gitignore]: ignore vscode workspace files by @saehejkang in https://github.com/apple/container/pull/1966 * Update containerization dependency with new EXT4Unpacker func definition by @katiewasnothere in https://github.com/apple/container/pull/1973 * Periodic dependency updates. by @jglogan in https://github.com/apple/container/pull/1981 * Use ordered journal mode for unpacked images. by @jglogan in https: _[Truncated at 4000 characters — full notes: https://github.com/apple/container/releases/tag/1.2.0]_ ### 1.1.0 - Date: 2026-07-06 - Version: 1.1.0 - Original notes: https://github.com/apple/container/releases/tag/1.1.0 - Permalink: https://whatsnew.fyi/product/container/releases/1.1.0 - **fixed** — Unix domain socket mounts now work in non-root containers - **fixed** — Fix container cp failures with relative source paths - **changed** — Always update default network with system configuration values - **fixed** — Fix duplicate "(default: 3)" in --max-concurrent-downloads help text - **fixed** — Propagate permissions for all host-to-container socket mounts - **fixed** — Replace try! with try? for stdout/stderr writes in ProcessIO - **fixed** — Remove force-unwrap on session dictionary in DefaultNetworkService - **fixed** — Log the graceful-stop error instead of silently discarding it in gracefulStopContainer - **fixed** — Fix exec empty arguments crash - **removed** — Remove network variant computation from API server - **changed** — Add collection capacity hints to known-size loops in parser - **fixed** — Propagate error from createDirectory in system start - **fixed** — Route container image save reference list to stderr in stdout mode - **added** — Add checksum validation to hawkeye installation ##### Highlights ⌨️ denotes breaking CLI changes. 👩‍💻 denotes breaking API changes. - Core - [Unix domain socket mounts now work in non-root containers](https://github.com/apple/container/issues/1750). - Storage - [Fix `container cp` failures with relative source paths](https://github.com/apple/container/issues/1738) ##### What's Changed * Bump containerization to `0.33.4` by @dkovba in https://github.com/apple/container/pull/1650 * add standalone container machine document by @crosbymichael in https://github.com/apple/container/pull/1674 * Adds container machine example. by @jglogan in https://github.com/apple/container/pull/1676 * Always update default network with system configuration values by @katiewasnothere in https://github.com/apple/container/pull/1686 * ci: bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group across 1 directory by @dependabot[bot] in https://github.com/apple/container/pull/1640 * Fix duplicate "(default: 3)" in --max-concurrent-downloads help text by @CharlieTLe in https://github.com/apple/container/pull/1725 * add container machine nested virt by @crosbymichael in https://github.com/apple/container/pull/1742 * Pin xcode swift version in CI to 6.3 by @katiewasnothere in https://github.com/apple/container/pull/1746 * Propagate permissions for all host-to-container socket mounts. by @jglogan in https://github.com/apple/container/pull/1751 * Fix CLITest when run in xcode by @mareksapota in https://github.com/apple/container/pull/1775 * [package]: bump containerization to 0.34.0 by @saehejkang in https://github.com/apple/container/pull/1774 * fix(cp): resolve relative host paths against current directory by @adityabagchi24 in https://github.com/apple/container/pull/1741 * fix: replace try! with try? for stdout/stderr writes in ProcessIO by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1784 * fix: remove force-unwrap on session dictionary in DefaultNetworkService by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1787 * Log the graceful-stop error instead of silently discarding it in gracefulStopContainer by @radheradhe01 in https://github.com/apple/container/pull/1782 * Disable flaky CLI test temporarily. by @jglogan in https://github.com/apple/container/pull/1828 * Fix/exec empty arguments crash by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1783 * Remove network variant computation from API server. by @jglogan in https://github.com/apple/container/pull/1814 * Remove duplicate release workflow that double-builds and races on every tag by @radheradhe01 in https://github.com/apple/container/pull/1781 * perf(parser): add collection capacity hints to known-size loops by @hluaguo in https://github.com/apple/container/pull/1791 * fix: propagate error from createDirectory in system start by @SEPURI-SAI-KRISHNA in https://github.com/apple/container/pull/1785 * ci: bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/apple/container/pull/1792 * Route `container image save` reference list to stderr in stdout mode by @costajohnt in https://github.com/apple/container/pull/1804 * Enhanced test fixtures for integration tests. by @jglogan in https://github.com/apple/container/pull/1834 * Migrate some container tests, remove concurrent demo tests. by @jglogan in https://github.com/apple/container/pull/1840 * Update containerization import to 0.35.0 by @katiewasnothere in https://github.com/apple/container/pull/1842 * Adds build fixture and migrates build CLI tests. by @jglogan in https://github.com/apple/container/pull/1848 * Migrates container machine tests. by @jglogan in https://github.com/apple/container/pull/1856 * Migrate basic system tests to new test support types. by @jglogan in https://github.com/apple/container/pull/1841 * Migrates network integration tests. by @jglogan in https://github.com/apple/container/pull/1858 * Migrate registry t _[Truncated at 4000 characters — full notes: https://github.com/apple/container/releases/tag/1.1.0]_ ### 1.0.0 - Date: 2026-06-09 - Version: 1.0.0 - Original notes: https://github.com/apple/container/releases/tag/1.0.0 - Permalink: https://whatsnew.fyi/product/container/releases/1.0.0 - **added** — Add `container machine` feature for long-lived Linux environments with tight host integration - **added** — Add `--stop-signal` option for `container run` - **added** — Add `container cp` command - **added** — Add support for `--shm-size` option - **added** — Add support for layered and plugin configurations - **added** — Add `variant` support - **changed** — Replace UserDefault-backed system properties with TOML configuration file - **changed** — Clean up structured output shape for container, image, network, and volume `ls` and `inspect` commands - **fixed** — Fix `container help subcommand...` - **fixed** — Fix output formatting for several commands - **fixed** — Use XPC-connection-as-lease to fix IP address leaks - **fixed** — Fix accounting errors in `system df` - **fixed** — Fix inconsistent volume createdAt JSON encoding - **fixed** — Fix image list alignment with other commands when format should ignore quiet - **removed** — Remove `container system property` `get` and `set` subcommands - **removed** — Remove compatibility with application major version 0 XPC APIs :birthday: `container` is one year old! Try out the new [`container machine` feature](https://github.com/apple/container/blob/main/docs/container-machine.md) and let us know what you think! > [!NOTE] > The UserProperty-backed system settings have been replaced by a TOML configuration file. See [the tutorial](https://github.com/apple/container/blob/main/docs/tutorials/container-system-config-tutorial.md) for details. ##### Highlights ⌨️ denotes breaking CLI changes. 👩‍💻 denotes breaking API changes. - Core - [`container machine` for long-lived Linux environments with tight host integration](https://github.com/apple/container/pull/1662). - ⌨️ [A TOML configuration file replaces UserDefault-backed system properties](https://github.com/apple/container/pull/1425), removing the `container system property` `get` and `set` subcommands. - ⌨️ Cleaned up structured (JSON, YAML, TOML) output shape for [container](https://github.com/apple/container/pull/1656), [image](https://github.com/apple/container/pull/1652), [network](https://github.com/apple/container/issues/1623), and [volume](https://github.com/apple/container/issues/1607) `ls` and `inpect`. - [Fixed `container help subcommand...`](https://github.com/apple/container/issues/1509) - [Fixed output formatting for several commands](https://github.com/apple/container/issues/1528) - [Add `--stop-signal` option for `container run`](https://github.com/apple/container/issues/1581) - 👩‍💻 Removed compatibility with application major version 0 XPC APIs. A subsequent release will introduce a version on the API itself so that clients and server can check compatibility. - Network - [Use XPC-connection-as-lease to fix IP address leaks](https://github.com/apple/container/issues/1378) - Storage - [Add `container cp` command](https://github.com/apple/container/issues/232) - [Fixed accounting errors in `system df`](https://github.com/apple/container/pull/1555) ##### What's Changed * Tests/CLITests: drain stdout/stderr concurrently in CLITest.run by @mvanhorn in https://github.com/apple/container/pull/1471 * Build output should just be tags/paths. by @jglogan in https://github.com/apple/container/pull/1478 * Use NetworkResource for network management in API server. by @jglogan in https://github.com/apple/container/pull/1421 * Use SystemPath for HostDNSResolver. by @jglogan in https://github.com/apple/container/pull/1480 * Update documents with note about container-to-host networking. by @jglogan in https://github.com/apple/container/pull/1482 * Sort networks by ID in API server `list()`. by @jglogan in https://github.com/apple/container/pull/1487 * CLI: Support --shm-size by @dcantah in https://github.com/apple/container/pull/1488 * Improve integration test speed by @noah-thor in https://github.com/apple/container/pull/1489 * Simplify the serial suite trait by @katiewasnothere in https://github.com/apple/container/pull/1497 * Switch NetworksService, VolumesService, EntityStore to FilePath. by @jglogan in https://github.com/apple/container/pull/1493 * [scripts]: add prompt for updating container with unsigned package by @saehejkang in https://github.com/apple/container/pull/1468 * Change PR build to generate coverage and comment it by @noah-thor in https://github.com/apple/container/pull/1474 * Deps: Bump CZ to 0.32.0 by @dcantah in https://github.com/apple/container/pull/1498 * Move to TOML configuration for defaults by @noah-thor in https://github.com/apple/container/pull/1425 * docs: fix typos and polish README wording by @12ya in https://github.com/apple/container/pull/1499 * De-duplicate building during testing by @noah-thor in https://github.com/apple/container/pull/1507 * Centralize utilities for configuration loading and path parsing by @noah-thor in https://github.com/apple/container/pull/1448 * Use SystemPath for PacketFilter. by @chrisgeo in https://github.com/apple/container/pull/1518 * swift-configuration decoder _[Truncated at 4000 characters — full notes: https://github.com/apple/container/releases/tag/1.0.0]_