applecontainer: properly wire named volume mounts#67
Merged
Conversation
The bridge's toFilesystem mapped MountType=volume to a virtiofs bind against the spec's source string. Apple's apiserver doesn't recognize that shape for named volumes and normalizes the source via URL(fileURLWithPath:), which resolves it relative to the launching process's CWD — yielding paths like /private/tmp/runner/<projname>_<vol> that don't exist, and surface as `errno 2` / "vminitd.log doesn't exist" when the VM tries to bootstrap. Fix: resolve the volume name through ClientVolume.inspect to fetch the backing image path and filesystem format, then construct a real Filesystem.volume(...) — matching the shape apple/container's own CLI emits for `container run -v <name>:/dest`. toFilesystem becomes async since ClientVolume.inspect is async; the call site loops instead of map. Surfaced while bringing up a compose-source devcontainer (crunchloop/dap) on the applecontainer backend through compose.Orchestrator — the app service's claude-config named volume hit this path. Add TestRunContainer_NamedVolume as a regression guard: creates a volume via the CLI, runs a container with MountVolume against it, asserts the inspect path round-trips a MountVolume mount with a non-empty source. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR converts mount resolution in runContainer to async, updates toFilesystem to be async throws, and changes named-volume handling to inspect the named volume (ClientVolume.inspect) and construct a Filesystem.volume; it adds an end-to-end test verifying named-volume mounts. ChangesAsync Named-Volume Resolution
Sequence DiagramsequenceDiagram
participant runContainer
participant toFilesystem
participant ClientVolume
participant Filesystem
runContainer->>toFilesystem: await toFilesystem(mountSpec)
toFilesystem->>ClientVolume: inspect(volumeName) [for volume mounts]
ClientVolume-->>toFilesystem: volume metadata (name, format, source)
toFilesystem->>Filesystem: construct Filesystem.volume from metadata
toFilesystem-->>runContainer: return Filesystem
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@runtime/applecontainer/lifecycle_darwin_arm64_test.go`:
- Around line 224-230: The test currently only asserts m.Source is non-empty but
omits the "not launcher CWD" check described in the comment; fetch the test's
current working directory (e.g., via os.Getwd()) and add an explicit assertion
that m.Source is not equal to that launcher CWD (use the same t.Errorf style as
the existing check), referencing m.Source and the obtained cwd value so the test
fails if the source is exactly the launcher's working directory.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 55ca24a4-6a60-496b-9798-2f63283f3f2d
📒 Files selected for processing (2)
applecontainer-bridge/Sources/ACBridge/lifecycle.swiftruntime/applecontainer/lifecycle_darwin_arm64_test.go
The original bug produced a non-empty source — the failing path was "/private/tmp/<launcher cwd>/<volname>" — so the existing "Source != ''" check would have passed it. Add an explicit "source isn't CWD-prefixed" guard so this test catches the exact shape of the regression. Per CodeRabbit review on PR #67. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
toFilesystemwas treatingMountType=volumeas a virtiofs bind. Apple's apiserver normalizes the source viaURL(fileURLWithPath:), which resolves relative paths against the launching process's CWD — yielding paths like/private/tmp/runner/<project>_<vol>that don't exist and surface aserrno 2at VM bootstrap.ClientVolume.inspect(name)to fetch the backing image path + filesystem format, then construct a properFilesystem.volume(...)— same shape apple/container's own CLI emits.TestRunContainer_NamedVolumeregression guard.How it was found
Bringing up a compose-source devcontainer (crunchloop/dap) on the applecontainer backend via
compose.Orchestrator. Theappservice'sclaude-confignamed volume hit this code path. With the fix, all 7 services started cleanly under apple/container.Test plan
go test ./runtime/applecontainer/... -run TestRunContainer_NamedVolumego test ./runtime/applecontainer/... -run "TestRunContainer_BindMount|TestLifecycle_EndToEnd|TestInspectContainer"(no regression)🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
Tests