Use new IP/CIDR types from Containerization. (apple#957)

jglogan · saehejkang · commit 8eb8cca311a8 · 2026-01-26T19:58:15.000-08:00
- Part of work for apple#460. - With CZ release 0.17.0, the IP and CIDR address types changed from String to IPv4Address and CIDRv4, respectively. This PR applies the corresponding adaptations to container.
diff --git a/Package.resolved b/Package.resolved
diff --git a/Package.swift b/Package.swift
@@ -23,7 +23,7 @@ import PackageDescription
 let releaseVersion = ProcessInfo.processInfo.environment["RELEASE_VERSION"] ?? "0.0.0"
 let gitCommit = ProcessInfo.processInfo.environment["GIT_COMMIT"] ?? "unspecified"
 let builderShimVersion = "0.7.0"
-let scVersion = "0.16.2"
+let scVersion = "0.17.0"
 
 let package = Package(
     name: "container",
@@ -146,6 +146,7 @@ let package = Package(
             dependencies: [
                 .product(name: "Logging", package: "swift-log"),
                 .product(name: "Containerization", package: "containerization"),
+                .product(name: "ContainerizationExtras", package: "containerization"),
                 .product(name: "ContainerizationOS", package: "containerization"),
                 .product(name: "ArgumentParser", package: "swift-argument-parser"),
                 "ContainerClient",
diff --git a/Sources/ContainerCommands/Builder/BuilderStart.swift b/Sources/ContainerCommands/Builder/BuilderStart.swift
@@ -230,8 +230,8 @@ extension Application {
                 throw ContainerizationError(.invalidState, message: "default network is not running")
             }
             config.networks = [AttachmentConfiguration(network: network.id, options: AttachmentOptions(hostname: id))]
-            let subnet = try CIDRAddress(networkStatus.address)
-            let nameserver = IPv4Address(fromValue: subnet.lower.value + 1).description
+            let subnet = networkStatus.ipv4Subnet
+            let nameserver = IPv4Address(subnet.lower.value + 1).description
             let nameservers = [nameserver]
             config.dns = ContainerConfiguration.DNSConfiguration(nameservers: nameservers)
 
diff --git a/Sources/ContainerCommands/Builder/BuilderStatus.swift b/Sources/ContainerCommands/Builder/BuilderStatus.swift
@@ -94,7 +94,7 @@ extension ClientContainer {
             self.id,
             self.configuration.image.reference,
             self.status.rawValue,
-            self.networks.compactMap { try? CIDRAddress($0.address).address.description }.joined(separator: ","),
+            self.networks.compactMap { $0.ipv4Address.description }.joined(separator: ","),
             "\(self.configuration.resources.cpus)",
             "\(self.configuration.resources.memoryInBytes / (1024 * 1024)) MB",
         ]
diff --git a/Sources/ContainerCommands/Container/ContainerList.swift b/Sources/ContainerCommands/Container/ContainerList.swift
@@ -94,7 +94,7 @@ extension ClientContainer {
             self.configuration.platform.os,
             self.configuration.platform.architecture,
             self.status.rawValue,
-            self.networks.compactMap { try? CIDRAddress($0.address).address.description }.joined(separator: ","),
+            self.networks.compactMap { $0.ipv4Address.description }.joined(separator: ","),
             "\(self.configuration.resources.cpus)",
             "\(self.configuration.resources.memoryInBytes / (1024 * 1024)) MB",
         ]
diff --git a/Sources/ContainerCommands/Network/NetworkCreate.swift b/Sources/ContainerCommands/Network/NetworkCreate.swift
@@ -18,6 +18,7 @@ import ArgumentParser
 import ContainerClient
 import ContainerNetworkService
 import ContainerizationError
+import ContainerizationExtras
 import Foundation
 import TerminalProgress
 
@@ -43,7 +44,8 @@ extension Application {
 
         public func run() async throws {
             let parsedLabels = Utility.parseKeyValuePairs(labels)
-            let config = try NetworkConfiguration(id: self.name, mode: .nat, subnet: subnet, labels: parsedLabels)
+            let ipv4Subnet = try subnet.map { try CIDRv4($0) }
+            let config = try NetworkConfiguration(id: self.name, mode: .nat, ipv4Subnet: ipv4Subnet, labels: parsedLabels)
             let state = try await ClientNetwork.create(configuration: config)
             print(state.id)
         }
diff --git a/Sources/ContainerCommands/Network/NetworkList.swift b/Sources/ContainerCommands/Network/NetworkList.swift
@@ -83,7 +83,7 @@ extension NetworkState {
         case .created(_):
             return [self.id, self.state, "none"]
         case .running(_, let status):
-            return [self.id, self.state, status.address]
+            return [self.id, self.state, status.ipv4Subnet.description]
         }
     }
 }
diff --git a/Sources/ContainerCommands/System/Property/PropertySet.swift b/Sources/ContainerCommands/System/Property/PropertySet.swift
@@ -70,7 +70,7 @@ extension Application {
                 DefaultsStore.set(value: value, key: key)
                 return
             case .defaultSubnet:
-                guard (try? CIDRAddress(value)) != nil else {
+                guard (try? CIDRv4(value)) != nil else {
                     throw ContainerizationError(.invalidArgument, message: "invalid CIDRv4 address: \(value)")
                 }
                 DefaultsStore.set(value: value, key: key)
diff --git a/Sources/Helpers/APIServer/ContainerDNSHandler.swift b/Sources/Helpers/APIServer/ContainerDNSHandler.swift
@@ -94,15 +94,9 @@ struct ContainerDNSHandler: DNSHandler {
         guard let ipAllocation = try await networkService.lookup(hostname: question.name) else {
             return nil
         }
-
-        let components = ipAllocation.address.split(separator: "/")
-        guard !components.isEmpty else {
-            throw DNSResolverError.serverError("invalid IP format: empty address")
-        }
-
-        let ipString = String(components[0])
-        guard let ip = IPv4(ipString) else {
-            throw DNSResolverError.serverError("failed to parse IP address: \(ipString)")
+        let ipv4 = ipAllocation.ipv4Address.address.description
+        guard let ip = IPv4(ipv4) else {
+            throw DNSResolverError.serverError("failed to parse IP address: \(ipv4)")
         }
 
         return HostRecord<IPv4>(name: question.name, ttl: ttl, ip: ip)
diff --git a/Sources/Helpers/NetworkVmnet/NetworkVmnetHelper+Start.swift b/Sources/Helpers/NetworkVmnet/NetworkVmnetHelper+Start.swift
@@ -50,8 +50,8 @@ extension NetworkVmnetHelper {
 
             do {
                 log.info("configuring XPC server")
-                let subnet = try self.subnet.map { try CIDRAddress($0) }
-                let configuration = try NetworkConfiguration(id: id, mode: .nat, subnet: subnet?.description)
+                let ipv4Subnet = try self.subnet.map { try CIDRv4($0) }
+                let configuration = try NetworkConfiguration(id: id, mode: .nat, ipv4Subnet: ipv4Subnet)
                 let network = try Self.createNetwork(configuration: configuration, log: log)
                 try await network.start()
                 let server = try await NetworkService(network: network, log: log)
diff --git a/Sources/Helpers/RuntimeLinux/IsolatedInterfaceStrategy.swift b/Sources/Helpers/RuntimeLinux/IsolatedInterfaceStrategy.swift
@@ -24,7 +24,7 @@ import Containerization
 /// works for macOS Sequoia.
 struct IsolatedInterfaceStrategy: InterfaceStrategy {
     public func toInterface(attachment: Attachment, interfaceIndex: Int, additionalData: XPCMessage?) -> Interface {
-        let gateway = interfaceIndex == 0 ? attachment.gateway : nil
-        return NATInterface(address: attachment.address, gateway: gateway, macAddress: attachment.macAddress)
+        let ipv4Gateway = interfaceIndex == 0 ? attachment.ipv4Gateway : nil
+        return NATInterface(ipv4Address: attachment.ipv4Address, ipv4Gateway: ipv4Gateway, macAddress: attachment.macAddress)
     }
 }
diff --git a/Sources/Helpers/RuntimeLinux/NonisolatedInterfaceStrategy.swift b/Sources/Helpers/RuntimeLinux/NonisolatedInterfaceStrategy.swift
@@ -43,7 +43,7 @@ struct NonisolatedInterfaceStrategy: InterfaceStrategy {
         }
 
         log.info("creating NATNetworkInterface with network reference")
-        let gateway = interfaceIndex == 0 ? attachment.gateway : nil
-        return NATNetworkInterface(address: attachment.address, gateway: gateway, reference: networkRef, macAddress: attachment.macAddress)
+        let ipv4Gateway = interfaceIndex == 0 ? attachment.ipv4Gateway : nil
+        return NATNetworkInterface(ipv4Address: attachment.ipv4Address, ipv4Gateway: ipv4Gateway, reference: networkRef, macAddress: attachment.macAddress)
     }
 }
diff --git a/Sources/Services/ContainerAPIService/Networks/NetworksService.swift b/Sources/Services/ContainerAPIService/Networks/NetworksService.swift
@@ -283,19 +283,24 @@ public actor NetworksService {
             serviceIdentifier,
         ]
 
-        if let subnet = (try configuration.subnet.map { try CIDRAddress($0) }) {
-            var existingCidrs: [CIDRAddress] = []
+        if let ipv4Subnet = (configuration.ipv4Subnet.map { $0 }) {
+            var existingCidrs: [CIDRv4] = []
             for networkState in networkStates.values {
                 if case .running(_, let status) = networkState {
-                    existingCidrs.append(try CIDRAddress(status.address))
+                    existingCidrs.append(status.ipv4Subnet)
                 }
             }
-            let overlap = existingCidrs.first { $0.overlaps(cidr: subnet) }
+            let overlap = existingCidrs.first {
+                $0.contains(ipv4Subnet.lower)
+                    || $0.contains(ipv4Subnet.upper)
+                    || ipv4Subnet.contains($0.lower)
+                    || ipv4Subnet.contains($0.upper)
+            }
             if let overlap {
-                throw ContainerizationError(.exists, message: "subnet \(subnet) overlaps an existing network with subnet \(overlap)")
+                throw ContainerizationError(.exists, message: "IPv4 subnet \(ipv4Subnet) overlaps an existing network with subnet \(overlap)")
             }
 
-            args += ["--subnet", subnet.description]
+            args += ["--subnet", ipv4Subnet.description]
         }
 
         try await pluginLoader.registerWithLaunchd(
diff --git a/Sources/Services/ContainerNetworkService/AllocationOnlyVmnetNetwork.swift b/Sources/Services/ContainerNetworkService/AllocationOnlyVmnetNetwork.swift
@@ -35,8 +35,8 @@ public actor AllocationOnlyVmnetNetwork: Network {
             throw ContainerizationError(.unsupported, message: "invalid network mode \(configuration.mode)")
         }
 
-        guard configuration.subnet == nil else {
-            throw ContainerizationError(.unsupported, message: "subnet assignment is not yet implemented")
+        guard configuration.ipv4Subnet == nil else {
+            throw ContainerizationError(.unsupported, message: "IPv4 subnet assignment is not yet implemented")
         }
 
         self.log = log
@@ -65,9 +65,9 @@ public actor AllocationOnlyVmnetNetwork: Network {
         )
 
         let subnet = DefaultsStore.get(key: .defaultSubnet)
-        let subnetCIDR = try CIDRAddress(subnet)
-        let gateway = IPv4Address(fromValue: subnetCIDR.lower.value + 1)
-        self._state = .running(configuration, NetworkStatus(address: subnetCIDR.description, gateway: gateway.description))
+        let subnetCIDR = try CIDRv4(subnet)
+        let gateway = IPv4Address(subnetCIDR.lower.value + 1)
+        self._state = .running(configuration, NetworkStatus(ipv4Subnet: subnetCIDR, ipv4Gateway: gateway))
         log.info(
             "started allocation-only network",
             metadata: [
diff --git a/Sources/Services/ContainerNetworkService/Attachment.swift b/Sources/Services/ContainerNetworkService/Attachment.swift
@@ -14,24 +14,58 @@
 // limitations under the License.
 //===----------------------------------------------------------------------===//
 
+import ContainerizationExtras
+
 /// A snapshot of a network interface allocated to a sandbox.
 public struct Attachment: Codable, Sendable {
     /// The network ID associated with the attachment.
     public let network: String
     /// The hostname associated with the attachment.
     public let hostname: String
-    /// The subnet CIDR, where the address is the container interface IPv4 address.
-    public let address: String
+    /// The CIDR address describing the interface IPv4 address, with the prefix length of the subnet.
+    public let ipv4Address: CIDRv4
     /// The IPv4 gateway address.
-    public let gateway: String
+    public let ipv4Gateway: IPv4Address
     /// The MAC address associated with the attachment (optional).
     public let macAddress: String?
 
-    public init(network: String, hostname: String, address: String, gateway: String, macAddress: String? = nil) {
+    public init(network: String, hostname: String, ipv4Address: CIDRv4, ipv4Gateway: IPv4Address, macAddress: String? = nil) {
         self.network = network
         self.hostname = hostname
-        self.address = address
-        self.gateway = gateway
+        self.ipv4Address = ipv4Address
+        self.ipv4Gateway = ipv4Gateway
         self.macAddress = macAddress
     }
+
+    enum CodingKeys: String, CodingKey {
+        case network
+        case hostname
+        case ipv4Address
+        case ipv4Gateway
+        case macAddress
+    }
+
+    /// Create an attachment from the supplied Decoder.
+    public init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+
+        network = try container.decode(String.self, forKey: .network)
+        hostname = try container.decode(String.self, forKey: .hostname)
+        let addressText = try container.decode(String.self, forKey: .ipv4Address)
+        ipv4Address = try CIDRv4(addressText)
+        let gatewayText = try container.decode(String.self, forKey: .ipv4Gateway)
+        ipv4Gateway = try IPv4Address(gatewayText)
+        macAddress = try container.decodeIfPresent(String.self, forKey: .macAddress)
+    }
+
+    /// Encode the attachment to the supplied Encoder.
+    public func encode(to encoder: Encoder) throws {
+        var container = encoder.container(keyedBy: CodingKeys.self)
+
+        try container.encode(network, forKey: .network)
+        try container.encode(hostname, forKey: .hostname)
+        try container.encode(ipv4Address.description, forKey: .ipv4Address)
+        try container.encode(ipv4Gateway.description, forKey: .ipv4Gateway)
+        try container.encodeIfPresent(macAddress, forKey: .macAddress)
+    }
 }
diff --git a/Sources/Services/ContainerNetworkService/NetworkConfiguration.swift b/Sources/Services/ContainerNetworkService/NetworkConfiguration.swift
@@ -29,8 +29,8 @@ public struct NetworkConfiguration: Codable, Sendable, Identifiable {
     /// When the network was created.
     public let creationDate: Date
 
-    /// The preferred CIDR address for the subnet, if specified
-    public let subnet: String?
+    /// The preferred CIDR address for the IPv4 subnet, if specified
+    public let ipv4Subnet: CIDRv4?
 
     /// Key-value labels for the network.
     public var labels: [String: String] = [:]
@@ -39,13 +39,13 @@ public struct NetworkConfiguration: Codable, Sendable, Identifiable {
     public init(
         id: String,
         mode: NetworkMode,
-        subnet: String? = nil,
+        ipv4Subnet: CIDRv4? = nil,
         labels: [String: String] = [:]
     ) throws {
         self.id = id
         self.creationDate = Date()
         self.mode = mode
-        self.subnet = subnet
+        self.ipv4Subnet = ipv4Subnet
         self.labels = labels
         try validate()
     }
@@ -54,8 +54,10 @@ public struct NetworkConfiguration: Codable, Sendable, Identifiable {
         case id
         case creationDate
         case mode
-        case subnet
+        case ipv4Subnet
         case labels
+        // TODO: retain for deserialization compatability for now, remove later
+        case subnet
     }
 
     /// Create a configuration from the supplied Decoder, initializing missing
@@ -66,20 +68,30 @@ public struct NetworkConfiguration: Codable, Sendable, Identifiable {
         id = try container.decode(String.self, forKey: .id)
         creationDate = try container.decodeIfPresent(Date.self, forKey: .creationDate) ?? Date(timeIntervalSince1970: 0)
         mode = try container.decode(NetworkMode.self, forKey: .mode)
-        subnet = try container.decodeIfPresent(String.self, forKey: .subnet)
+        let subnetText =
+            try container.decodeIfPresent(String.self, forKey: .ipv4Subnet)
+            ?? container.decodeIfPresent(String.self, forKey: .subnet)
+        ipv4Subnet = try subnetText.map { try CIDRv4($0) }
         labels = try container.decodeIfPresent([String: String].self, forKey: .labels) ?? [:]
         try validate()
     }
 
+    /// Encode the configuration to the supplied Encoder.
+    public func encode(to encoder: Encoder) throws {
+        var container = encoder.container(keyedBy: CodingKeys.self)
+
+        try container.encode(id, forKey: .id)
+        try container.encode(creationDate, forKey: .creationDate)
+        try container.encode(mode, forKey: .mode)
+        try container.encodeIfPresent(ipv4Subnet?.description, forKey: .ipv4Subnet)
+        try container.encode(labels, forKey: .labels)
+    }
+
     private func validate() throws {
         guard id.isValidNetworkID() else {
             throw ContainerizationError(.invalidArgument, message: "invalid network ID: \(id)")
         }
 
-        if let subnet {
-            _ = try CIDRAddress(subnet)
-        }
-
         for (key, value) in labels {
             try validateLabel(key: key, value: value)
         }
diff --git a/Sources/Services/ContainerNetworkService/NetworkService.swift b/Sources/Services/ContainerNetworkService/NetworkService.swift
@@ -35,7 +35,7 @@ public actor NetworkService: Sendable {
             throw ContainerizationError(.invalidState, message: "invalid network state - network \(state.id) must be running")
         }
 
-        let subnet = try CIDRAddress(status.address)
+        let subnet = status.ipv4Subnet
 
         let size = Int(subnet.upper.value - subnet.lower.value - 3)
         self.allocator = try AttachmentAllocator(lower: subnet.lower.value + 2, size: size)
@@ -61,21 +61,21 @@ public actor NetworkService: Sendable {
         let hostname = try message.hostname()
         let macAddress = message.string(key: NetworkKeys.macAddress.rawValue)
         let index = try await allocator.allocate(hostname: hostname)
-        let subnet = try CIDRAddress(status.address)
-        let ip = IPv4Address(fromValue: index)
+        let subnet = status.ipv4Subnet
+        let ip = IPv4Address(index)
         let attachment = Attachment(
             network: state.id,
             hostname: hostname,
-            address: try CIDRAddress(ip, prefixLength: subnet.prefixLength).description,
-            gateway: status.gateway,
+            ipv4Address: try CIDRv4(ip, prefix: subnet.prefix),
+            ipv4Gateway: status.ipv4Gateway,
             macAddress: macAddress
         )
         log?.info(
             "allocated attachment",
             metadata: [
                 "hostname": "\(hostname)",
-                "address": "\(attachment.address)",
-                "gateway": "\(attachment.gateway)",
+                "ipv4Address": "\(attachment.ipv4Address)",
+                "ipv4Gateway": "\(attachment.ipv4Gateway)",
                 "macAddress": "\(macAddress ?? "auto")",
             ])
         let reply = message.reply()
@@ -110,13 +110,13 @@ public actor NetworkService: Sendable {
             return reply
         }
 
-        let address = IPv4Address(fromValue: index)
-        let subnet = try CIDRAddress(status.address)
+        let address = IPv4Address(index)
+        let subnet = status.ipv4Subnet
         let attachment = Attachment(
             network: state.id,
             hostname: hostname,
-            address: try CIDRAddress(address, prefixLength: subnet.prefixLength).description,
-            gateway: status.gateway
+            ipv4Address: try CIDRv4(address, prefix: subnet.prefix),
+            ipv4Gateway: status.ipv4Gateway
         )
         log?.debug(
             "lookup attachment",
diff --git a/Sources/Services/ContainerNetworkService/NetworkState.swift b/Sources/Services/ContainerNetworkService/NetworkState.swift
diff --git a/Sources/Services/ContainerNetworkService/ReservedVmnetNetwork.swift b/Sources/Services/ContainerNetworkService/ReservedVmnetNetwork.swift
diff --git a/Sources/Services/ContainerSandboxService/SandboxService.swift b/Sources/Services/ContainerSandboxService/SandboxService.swift
diff --git a/Sources/SocketForwarder/ConnectHandler.swift b/Sources/SocketForwarder/ConnectHandler.swift
diff --git a/Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift b/Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift
diff --git a/Tests/CLITests/Subcommands/Run/TestCLIRunCommand.swift b/Tests/CLITests/Subcommands/Run/TestCLIRunCommand.swift
diff --git a/Tests/ContainerNetworkServiceTests/NetworkConfigurationTest.swift b/Tests/ContainerNetworkServiceTests/NetworkConfigurationTest.swift

Original file line number	Diff line number	Diff line change
`@@ -94,7 +94,7 @@ extension ClientContainer {`
`94`	`94`	`self.id,`
`95`	`95`	`self.configuration.image.reference,`
`96`	`96`	`self.status.rawValue,`
`97`		`- self.networks.compactMap { try? CIDRAddress($0.address).address.description }.joined(separator: ","),`
	`97`	`+ self.networks.compactMap { $0.ipv4Address.description }.joined(separator: ","),`
`98`	`98`	`"\(self.configuration.resources.cpus)",`
`99`	`99`	`"\(self.configuration.resources.memoryInBytes / (1024 * 1024)) MB",`
`100`	`100`	`]`
Original file line number	Diff line number	Diff line change
`@@ -83,7 +83,7 @@ extension NetworkState {`
`83`	`83`	`case .created(_):`
`84`	`84`	`return [self.id, self.state, "none"]`
`85`	`85`	`case .running(_, let status):`
`86`		`- return [self.id, self.state, status.address]`
	`86`	`+ return [self.id, self.state, status.ipv4Subnet.description]`
`87`	`87`	`}`
`88`	`88`	`}`
`89`	`89`	`}`
Original file line number	Diff line number	Diff line change
`@@ -70,7 +70,7 @@ extension Application {`
`70`	`70`	`DefaultsStore.set(value: value, key: key)`
`71`	`71`	`return`
`72`	`72`	`case .defaultSubnet:`
`73`		`- guard (try? CIDRAddress(value)) != nil else {`
	`73`	`+ guard (try? CIDRv4(value)) != nil else {`
`74`	`74`	`throw ContainerizationError(.invalidArgument, message: "invalid CIDRv4 address: \(value)")`
`75`	`75`	`}`
`76`	`76`	`DefaultsStore.set(value: value, key: key)`