Skip to content

Implement container prune#904

Merged
jglogan merged 6 commits intoapple:mainfrom
tico88612:feat/container-prune
Jan 27, 2026
Merged

Implement container prune#904
jglogan merged 6 commits intoapple:mainfrom
tico88612:feat/container-prune

Conversation

@tico88612
Copy link
Contributor

@tico88612 tico88612 commented Nov 20, 2025 •
edited
Loading

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update

Motivation and Context

Fixed #892

I'm a new contributor here. If there are any better ways to write it, please let me know.

Part of the function references content from PR #902. This PR will be rebased after that PR is merged.

Testing

  • Tested locally
  • Added/updated tests
  • Added/updated docs

@tico88612 tico88612 force-pushed the feat/container-prune branch 2 times, most recently from 104bdd2 to 589061e Compare November 20, 2025 18:21
@tico88612 tico88612 marked this pull request as ready for review November 20, 2025 18:22
@tico88612
Copy link
Contributor Author

tico88612 commented Nov 21, 2025

cc @jglogan @realrajaryan

saehejkang
saehejkang reviewed Nov 21, 2025
View reviewed changes
@saehejkang
Copy link
Contributor

saehejkang commented Nov 21, 2025

This is also missing integration tests. Again, here is a good PR you can use to help make those.

@tico88612 tico88612 force-pushed the feat/container-prune branch from 589061e to 46d4018 Compare November 21, 2025 04:28
@tico88612
Copy link
Contributor Author

tico88612 commented Nov 21, 2025

This is also missing integration tests. Again, here is a good PR you can use to help make those.

Uh, thanks. I just wonder how to write the testcase.

@tico88612 tico88612 force-pushed the feat/container-prune branch 5 times, most recently from 829c989 to 0f959a7 Compare November 21, 2025 15:57
@tico88612
Copy link
Contributor Author

tico88612 commented Nov 21, 2025

Ok, testcases are ready.

@tico88612 tico88612 mentioned this pull request Nov 22, 2025
Closed
1 task
@tico88612 tico88612 force-pushed the feat/container-prune branch from 0f959a7 to d6379bf Compare November 22, 2025 02:59
saehejkang
saehejkang reviewed Nov 23, 2025
View reviewed changes
saehejkang
saehejkang reviewed Nov 23, 2025
View reviewed changes
@tico88612 tico88612 force-pushed the feat/container-prune branch from d6379bf to a327ffb Compare November 23, 2025 13:39
@saehejkang saehejkang mentioned this pull request Dec 3, 2025
Merged
7 tasks
@tico88612 tico88612 force-pushed the feat/container-prune branch from a327ffb to b50f515 Compare December 4, 2025 04:31
@saehejkang
Copy link
Contributor

saehejkang commented Dec 9, 2025

After a lengthy discussion with maintainers, on #914, we are going to be focusing on refactoring any prune commands to take a client-side approach. Looks like you took a server-side approach (which is inherently not wrong), but this PR should be updated to reflect the new approach. Take a look at #914 and #940 for a template/reference. Feel free to ping me or the maintainers with any questions.

@tico88612 tico88612 force-pushed the feat/container-prune branch from b50f515 to 8a28cd5 Compare December 13, 2025 16:54
@tico88612
Copy link
Contributor Author

tico88612 commented Dec 16, 2025

Hi @jglogan @realrajaryan, could you take a look on this? I believe this's refactor prune commands to client-side approach.

@jglogan jglogan self-requested a review December 17, 2025 08:31
saehejkang
saehejkang approved these changes Jan 9, 2026
View reviewed changes
Copy link
Contributor

@saehejkang saehejkang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making updates to follow the client-side approach! Changes LGTM, so hopefully this will be reviewed/merged by a maintainer soon. Might need to run make fmt one more time as the headings on some files are out of date.

@tico88612 tico88612 force-pushed the feat/container-prune branch from 8a28cd5 to e809063 Compare January 9, 2026 14:11
@tico88612
Copy link
Contributor Author

tico88612 commented Jan 9, 2026

Only update the header (2025 => 2026)

@tico88612 tico88612 force-pushed the feat/container-prune branch from e809063 to a289d78 Compare January 17, 2026 08:09
@tico88612 tico88612 force-pushed the feat/container-prune branch from a289d78 to 38d9772 Compare January 17, 2026 08:11
jglogan
jglogan requested changes Jan 27, 2026
View reviewed changes
Copy link
Contributor

@jglogan jglogan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tico88612 Could you rebase this one to pick up the changes to work on the Tahoe CI runners?

@tico88612
Implement container prune
a8e259a 
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
@tico88612
Add container prune docs
c44507e 
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
@tico88612
Test: add getContainerId in CLITest.swift
5b9b147 
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
@tico88612
Add container prune testcases
d2251e7 
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
@tico88612
Refactor: client side prune container
faac62d 
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
@tico88612 tico88612 force-pushed the feat/container-prune branch from 38d9772 to faac62d Compare January 27, 2026 11:37
@tico88612
Copy link
Contributor Author

tico88612 commented Jan 27, 2026

@jglogan Rebased.

@tico88612
Update ContainerPrune to AsyncLoggableCommand and change import name
06ec76c 
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
@jglogan jglogan mentioned this pull request Jan 27, 2026
Closed
7 tasks
jglogan
jglogan approved these changes Jan 27, 2026
View reviewed changes
Copy link
Contributor

@jglogan jglogan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm:

% container ls
Warning! Running debug build. Performance may be degraded.
ID        IMAGE                                               OS     ARCH   STATE    ADDR             CPUS  MEMORY    STARTED
buildkit  ghcr.io/apple/container-builder-shim/builder:0.7.0  linux  arm64  running  192.168.64.2/24  8     16384 MB  2026-01-27T20:18:51Z
% container stop buildkit
Warning! Running debug build. Performance may be degraded.
buildkit
% container prune
Warning! Running debug build. Performance may be degraded.
buildkit
Reclaimed 1.91 GB in disk space

@jglogan jglogan merged commit 24cbed5 into apple:main Jan 27, 2026
2 checks passed
@jglogan
Copy link
Contributor

jglogan commented Jan 27, 2026

@tico88612 merged, thanks!

@tico88612 tico88612 deleted the feat/container-prune branch January 28, 2026 02:56
@BrewTestBot BrewTestBot mentioned this pull request Feb 3, 2026
Closed
Mcrich23 added a commit to Mcrich23/container that referenced this pull request Feb 4, 2026
@Mcrich23
Squashed commit of the following:
8b79ec5 
commit a65c6f4
Merge: 9d32bc5 ce1b629
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Tue Feb 3 20:08:38 2026 -0800

    Merge branch 'apple:main' into main

commit ce1b629
Author: Manoj Mahapatra <mahaplipsa@gmail.com>
Date:   Tue Feb 3 13:43:07 2026 -0800

    [Docs] Fix typo in BUILDING.md: launchd -> launchctl (apple#1146)

    ## Type of Change
    - [ ] Bug fix
    - [ ] New feature
    - [ ] Breaking change
    - [x] Documentation update

    ## Motivation and Context
    The debug instructions in `BUILDING.md` incorrectly reference launchd
    list instead of `launchctl` list. `launchd` is the daemon itself and
    cannot be invoked directly.

    ## Testing
    - [ ] Tested locally
    - [ ] Added/updated tests
    - [x] Added/updated docs

commit 3e49dce
Author: Danny Canter <danny_canter@apple.com>
Date:   Tue Feb 3 00:45:01 2026 -0800

    Add in missing rlimits (apple#1140)

    Containerization didn't have these defined until a recent tag.

commit c4c2e85
Author: J Logan <john_logan@apple.com>
Date:   Tue Feb 3 00:27:09 2026 -0800

    Upgrade kernel to Kata 3.26.0. (apple#1134)

    - Upgrade to containerization 0.24.5 to pick up zstd decompression
    enhancement.
    - Closes apple#767.
    - Closes apple#988.
    - Closes apple#1132.
    - Requires apple/containerization#508.

commit 5c86337
Author: William Laverty <developer@william-laverty.com>
Date:   Mon Feb 2 13:57:59 2026 -0800

    Add explanatory message before admin password prompt in uninstall script (apple#1118)

    - Added message: "This script requires an administrator password to
    remove the application files from system directories."
    - Fixes apple#1111

commit 7da25e1
Author: Danny Canter <danny_canter@apple.com>
Date:   Mon Feb 2 13:35:02 2026 -0800

    Deps: Bump Containerization to 0.24.0 (apple#1127)

    Brings in some rlimit bumps/adjustments

commit 7dfe27d
Author: Danny Canter <danny_canter@apple.com>
Date:   Mon Feb 2 13:30:19 2026 -0800

    CLI: Add support for rlimits (apple#1129)

    Closes apple#1097.

commit b3b5c3e
Author: J Logan <john_logan@apple.com>
Date:   Mon Feb 2 12:24:27 2026 -0800

    Use labels instead of id to discriminate the builtin network. (apple#1123)

    - Closes apple#1122.
    - Adds placeholder ManagedResource and unit tests. Nothing is using
    these yet.
    - Adds system-defined resource labels for owning plugin and resource
    role. The system discriminates the builtin network using role "builtin".
    - Adds builtin role when creating builtin network at startup, and
    ensures that a preexisting network with ID "default" gets updated with
    the role label.
    - Replace all network ID checks for "default" with the builtin role
    check.
    - Adds "builder" role to builder VM.

    ## Type of Change
    - [ ] Bug fix
    - [x] New feature
    - [ ] Breaking change
    - [ ] Documentation update

    ## Motivation and Context
    Role and owner labels should make cross-cutting resource policy easier
    to implement.

    ## Testing
    - [x] Tested locally
    - [x] Added/updated tests
    - [ ] Added/updated docs

commit 1dae1cd
Author: w-ferg <43309695+w-ferg@users.noreply.github.com>
Date:   Sun Feb 1 18:14:41 2026 -0500

    Fix pfctl executable path in PacketFilter DNS reload (apple#1128)

    ## Summary

    The `reload()` method in `PacketFilter.swift` references
    `/sbin/reloadProcess` (the local variable name) instead of
    `/sbin/pfctl`. This causes all DNS create and delete operations to fail:

    ```
    Error: internalError: "pfctl reload exec failed: "Error Domain=NSCocoaErrorDomain Code=4 "The file "reloadProcess" doesn't exist.""
    ```

    ## Fix

    One-line change: `/sbin/reloadProcess` → `/sbin/pfctl`

    ## Testing

    Verified on macOS 26 (Tahoe) with Apple Silicon:
    - `sudo container system dns create test.sdc.internal --localhost
    203.0.113.1` succeeds without error
    - Container can resolve and reach host services through the DNS redirect

commit 113a6ec
Author: Ronit Sabhaya <ronitsabhaya75@gmail.com>
Date:   Fri Jan 30 21:54:57 2026 -0600

    Fix file descriptor leak in DirectoryWatcher (apple#1104)

    - `DirectoryWatcher` opens file descriptors for monitoring
      directories but never closes them, causing a file descriptor
      leak.
    - Adds `setCancelHandler` to properly close file descriptors
      when the `DispatchSource` is cancelled.

    Signed-off-by: Ronit Sabhaya <ronitsabhaya75@gmail.com>

commit 72f04b6
Author: Saehej Kang <saehej.kang@gmail.com>
Date:   Fri Jan 30 19:10:03 2026 -0800

    [docs]: update steps on building with containerization project (apple#1116)

    - Closes apple#1095
    - Just added a few more details about how to build with the local
      `containerization` dependency.

commit 3a0ad58
Author: Raj <rajaryan_singh@apple.com>
Date:   Fri Jan 30 16:17:43 2026 -0800

    Add resource.role label to builder container (apple#1120)

    Add resource.role label to builder container

commit 1c01d0c
Author: J Logan <john_logan@apple.com>
Date:   Fri Jan 30 11:07:49 2026 -0800

    Update to kata 3.20.0 kernel. (apple#1114)

    - Closes apple#1113.
    - This is the newest we can do until we address apple#767.
    - Slight change to PacketFilter error handling so unit tests work more
    reliably.
    - Try making CLINetworkTests serialized to see if parallel execution is
    causing flakes.

commit 3f2060e
Author: Danny Canter <danny_canter@apple.com>
Date:   Thu Jan 29 18:25:48 2026 -0800

    DirectoryWatcher: Small adjustments (apple#1112)

    - Have the handler throw
    - Log the failure at error level

commit 0a7fb07
Author: Danny Canter <danny_canter@apple.com>
Date:   Thu Jan 29 14:21:12 2026 -0800

    Set mtu to old Containerization default (apple#1110)

    The old mtu default in containerization was 1280 to account for some
    alpine/musl images that have issues with
    1500. This changed in the last couple tags to be modifiable, but the new
    default is the standard 1500. Ideally we eventually allow supplying the
    mtu to be used when you create a network (or possibly a container
    creation setting), but for now just default in here back to what CZ used
    to use.

commit 0bceb23
Author: Aditya Ramani <a_ramani@apple.com>
Date:   Thu Jan 29 12:08:42 2026 +0900

    Bump to use containerization 0.23.2 (apple#1106)

    Updating the package dependency on apple/containerization to pick up bug fixes

    Signed-off-by: Aditya Ramani <a_ramani@apple.com>
    Co-authored-by: J Logan <john_logan@apple.com>

commit d762fe5
Author: jwhur <57657645+JaewonHur@users.noreply.github.com>
Date:   Wed Jan 28 18:22:33 2026 -0800

    Launch a service with waitForDebugger if specified (apple#1101)

    This PR enables launching a service with `waitForDebugger` flag if the
    service label matches a given env variable `CONTAINER_DEBUG`.

commit 4f93e3e
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Wed Jan 28 18:21:08 2026 -0800

    ci: bump actions/checkout from 6.0.1 to 6.0.2 in the github-actions group (apple#1100)

    - Updates `actions/checkout` from 6.0.1 to 6.0.2

    Signed-off-by: dependabot[bot] <support@github.com>
    Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commit 371db6d
Author: jwhur <57657645+JaewonHur@users.noreply.github.com>
Date:   Wed Jan 28 17:17:08 2026 -0800

    Fix testExecOnExitingContainer (apple#1107)

    Check the container remains only, not its status as the status might not
    have been updated at the time checking.

commit d872270
Author: J Logan <john_logan@apple.com>
Date:   Wed Jan 28 09:04:58 2026 -0800

    Removes ArgumentParser import from NetworkMode. (apple#1102)

    - ContainerResources shouldn't need to know anything about CLI stuff.
    - Move ExpressibleByArgument protocol conformance to an extension in the
    package where it's needed.

commit 3abf81f
Author: Saehej Kang <saehej.kang@gmail.com>
Date:   Tue Jan 27 20:00:43 2026 -0800

    [image-list]: Add full size field to json output (apple#1098)

    - Refer to apple#862
    - Updated `SIZE` field to `FULL SIZE`, as it seemed more appropriate so
    it does not get mixed up with the `descriptor size` field
    - Closes apple#860

commit 24cbed5
Author: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
Date:   Wed Jan 28 06:55:49 2026 +0800

    Implement container prune (apple#904)

    - Fixed apple#892.
    - By contrast with `rm`, `prune` should display
      the amount of reclaimed storage, so added code
      to retrieve it.

    Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

commit a57527e
Author: jwhur <57657645+JaewonHur@users.noreply.github.com>
Date:   Tue Jan 27 11:15:22 2026 -0800

    Refactor container lifecycle functions to perform scoped rollback on failure (apple#1080)

    - Closes apple#977.
    - Closes apple#1058.
    - Prevents unexpected removal of containers on
      bootstrapping and starting failures, by reorganizing
      error handling for container `run`, `start`, and
      `exec` so that error handling only unwinds that
      which was done in the current scope.
    - Relies on apple/containerization#495.

commit 6244129
Author: c <claudeaceae@icloud.com>
Date:   Mon Jan 26 23:30:45 2026 -0500

    Fix grammar in BUILDING.md (apple#984)

    - Fixes a grammar error in the local Containerization development
    instructions.

commit 9d4cded
Author: jwhur <57657645+JaewonHur@users.noreply.github.com>
Date:   Mon Jan 26 19:35:41 2026 -0800

    Isolated network (apple#1079)

    - Closes apple#1037.
    - Adds a `--mode` flag that has `nat` and `hostOnly` options.
      The host-only option selects the vmnet host-only mode,
      where containers attached to the network can reach each
      other and the host, but not external systems.

commit 033c999
Author: J Logan <john_logan@apple.com>
Date:   Mon Jan 26 14:07:00 2026 -0800

    Make TerminalProgress a library. (apple#1093)

    - Closes apple#1092.
    - Allows 3rd party CLI plugins to use the progress indicator.

commit b371aee
Author: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
Date:   Tue Jan 27 05:07:05 2026 +0800

    Feat: container image delete force option (apple#1096)

    - Fixed apple#1087

    Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

commit ed1185d
Author: jwhur <57657645+JaewonHur@users.noreply.github.com>
Date:   Fri Jan 23 17:59:28 2026 -0800

    Container-to-host networking. (apple#1078)

    - Closes apple#346.
    - This PR enables connecting host's localhost ports from
      containers.
    - It adds an option `--localhost <localhost>` to DNS
      create command, after which the packets heading
      ip address in container are redirected to localhost in
      host machine. Packet filter rule is added and deleted
      along with the creation and deletion of localhost domain.

commit 14c279f
Author: Patrick Linnane <patrick@linnane.io>
Date:   Fri Jan 23 17:56:35 2026 -0800

    Add option to stop services in all launchd domains (apple#1077)

    - Services started from Terminal run in the `gui/$uid`
      launchd domain. When `ensure-container-stopped.sh`
      runs from a different context, `launchctl managername`
      may return a different domain, causing the script to
      check the wrong domain and miss running services.
      I noticed this after upgrading `container` via Homebrew.
    - Introduces a getopt option `-a` that allows booting out all
      domains explicitly. Also adds `-h` for a usage message.

    Signed-off-by: Patrick Linnane <patrick@linnane.io>

commit 751c1fc
Author: Stanislav Antonichev <cympak2@users.noreply.github.com>
Date:   Fri Jan 23 23:01:26 2026 +0200

    Add --dns support to build command for custom DNS resolution (apple#1067)

    This change adds --dns parameter support to the build command, matching
    the existing functionality in the run command. This allows users to
    specify custom DNS nameservers (like Google DNS 8.8.8.8) when building
    container images, which is essential when the host machine uses a local
    DNS resolver (e.g., 127.0.0.2) that doesn't work inside containers.

    Changes:
    - Added --dns option to BuildCommand to accept DNS nameserver IP
    addresses
    - Modified build logic to detect DNS configuration changes and recreate
    the builder container when DNS settings differ
    - Passed DNS configuration to BuilderStart.start() method
    - Updated builder container creation to use specified DNS nameservers or
    fall back to network gateway

    ## Type of Change
    - [ ] Bug fix
    - [X] New feature
    - [ ] Breaking change
    - [ ] Documentation update

    ## Motivation and Context
    This change adds --dns parameter support to the build command, matching
    the existing functionality in the run command. This allows users to
    specify custom DNS nameservers (like Google DNS 8.8.8.8) when building
    container images, which is essential when the host machine uses a local
    DNS resolver (e.g., 127.0.0.2) that doesn't work inside containers.

    ## Testing
    - [X] Tested locally
    - [ ] Added/updated tests
    - [ ] Added/updated docs

    ---------

    Co-authored-by: J Logan <sgtbakerrahulnet@yahoo.com>

commit 55f2112
Author: J Logan <john_logan@apple.com>
Date:   Fri Jan 23 11:35:10 2026 -0800

    Place image store data correctly for app-root path. (apple#1085)

    - Closes apple#1084.

commit 5746ec3
Author: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
Date:   Sat Jan 24 03:32:59 2026 +0800

    Fix: prevent delete default network (apple#1083)

    - Fixed apple#1073
    - Move the conditional check to the front; there's no need
      to check for a default network after filtering.

    Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

commit 9d32bc5
Merge: a2b4486 69445b9
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Mon Jan 19 19:20:12 2026 -0800

    Merge branch 'apple:main' into main

commit a2b4486
Merge: 27a94a0 bfc5ca9
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Fri Oct 3 23:03:02 2025 -0700

    Merge branch 'apple:main' into main

commit 27a94a0
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Thu Sep 18 17:07:12 2025 -0700

    chore(fmt): auto-format before push

commit 4a4d0a9
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Thu Sep 18 17:07:06 2025 -0700

    Update PropertySet.swift

commit 665d813
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Thu Sep 18 17:02:09 2025 -0700

    Update PropertySet.swift

commit 01a474e
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Thu Sep 18 16:57:41 2025 -0700

    chore(fmt): auto-format before push

commit e7c68b5
Author: Morris Richman <81453549+Mcrich23@users.noreply.github.com>
Date:   Thu Sep 18 16:57:01 2025 -0700

    Update SystemProperty.swift
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jglogan jglogan jglogan approved these changes

+1 more reviewer

@saehejkang saehejkang saehejkang approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Request]: Storage - Add container prune command to remove stopped containers

3 participants

@tico88612 @saehejkang @jglogan

Comments