') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); Let a service manager run as a container's init by MayCXC · Pull Request #866 · apple/containerization · GitHub
Skip to content

Let a service manager run as a container's init - #866

Closed
MayCXC wants to merge 4 commits into
apple:mainfrom
MayCXC:systemd-mode
Closed

Let a service manager run as a container's init#866
MayCXC wants to merge 4 commits into
apple:mainfrom
MayCXC:systemd-mode

Conversation

@MayCXC

@MayCXCMayCXC commented Aug 27, 2026

Copy link
Copy Markdown

Summary

An image built around a service manager expects to own the runtime state it keeps, and finds nowhere to write it: a container gets its image's filesystem and the mounts a single process needs, so the manager cannot start and takes the container down with it.

Give it somewhere to write, which is what podman gives such a container, and take the same paths to mean one is being asked for. The container says which of the three it wants: never, whenever the process it starts is a service manager, or whatever it starts. Never is the default, as it is for the runtimes that create cgroups themselves.

A mount the caller supplied for one of those places is left as they asked for it, and a pod's containers ask the same way.

Dependency and Merge Order

This targets stock apple/containerization:main and depends on #863. Please merge #863 first.

The head carries #863's three commits as prerequisites, because both PRs target stock main. After #863 merges this branch can take current main, leaving only the systemd-mode change and its test.

The dependency is real rather than incidental: a systemd container needs nf_tables in the guest, and #863 is what makes the suite run against the kernel release the shipped tool installs rather than an older one built without it.

Motivation and Context

The journal directory here is /var/log/journal, which is where systemd-journald writes persistent logs, with volatile logs going to /run/log/journal:
https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html

Worth noting for reviewers comparing against other runtimes: nerdctl's list names /var/lib/journal, which journald does not consult, so a container given that one has a tmpfs nothing writes to. podman uses /var/log/journal. This follows podman.

Testing

  • swift build and make check clean.
  • swift test: 603 tests in 83 suites passed.
  • Integration: container systemd boots a systemd image as init and asserts both that PID 1 is systemd and that it reaches a running or degraded state, rather than dying at start.

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update

@MayCXC
Resolve test directory paths before reaping per-test files
f10eaca
The reaper that runs at a concurrency of one deletes everything in the
test directory except the unpacked rootfs it means to preserve. It held
that rootfs path as FileManager reports it, under /var, and compared it
against the entries of contentsOfDirectory, which reports them under
/private/var, so the preserved path never matched any entry and the
rootfs was deleted along with the per-test files. The unpack coordinator
still held it as unpacked, so the next test opened a rootfs that was no
longer there and failed with a missing file error.
Resolve both sides with resolvingSymlinksInPathWithPrivate, which exists
for this difference between the two views of the same directory.
@MayCXC
Say how to run the tests that macOS skips
6499f7d
Tests guarded for Linux are compiled out on macOS, so `make test` reports
success without having run them, and nothing says so. The target that
does run them is not mentioned anywhere outside the makefile.
@MayCXC
Test against the kernel release the shipped tool installs
bf4d7dc
The default kernel the tests fetch had drifted from the one users run.
container installs kata 3.28.0 and its 6.18.15 kernel, while these tests
fetched 3.17.0, so the suite exercised a guest with a different feature
set to the one it is meant to represent. Nested runtimes are the visible
case: 3.17.0 was built without nf_tables, so a docker daemon inside a
container fails there and works on what ships.
Kata moved from xz to zstd between those releases, so the archive is no
longer named for its compression and tar is left to recognise it rather
than being told, which also holds if the format changes again.
@MayCXC
Let a service manager run as a container's init
2086043
An image built around a service manager expects to own the runtime state it
keeps, and finds nowhere to write it: a container gets its image's
filesystem and the mounts a single process needs, so the manager cannot
start and takes the container down with it.
Give it somewhere to write, which is what nerdctl and podman give such a
container, and take the same paths to mean one is being asked for. The
container says which of the three it wants: never, whenever the process it
starts is a service manager, or whatever it starts. Never is the default,
as it is for the runtimes that create cgroups themselves.
A mount the caller supplied for one of those places is left as they asked
for it, and a pod's containers ask the same way.
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MayCXC@crosbymichael