Apple Container

Sissejuhatus

Apple Container https://github.com/apple/container on MacOS töökohaarvutis kasutamiseks mõeldud virtualiseerimise lahendus.

Tööpõhimõte

TODO

Väited

• apple-container lahendus võimaldab kasutada amd64 ja arm64 virtuaalset arvutit
• virtuaalne arvuti võib esineda nii nö oci-konteineri kujul kui täielise virtuaalse arvuti kujul
• paigaldamine toimub kasutajana root
• container lahenduse käivitmaine toimub tavakasutajana

Lahenduse töötamist kirjeldab selline joonis

kus

• keskne komponent on container-apiserver - ühel pool teda on container haldusprogramm (klient) ja teisel pool pluginad - kõik kolm töötavad tavakasutaja privileegides
• pluginate abil käivitatakse virtuaalne arvuti ja selle külge kuuluv konteiner, seadistatakse võrk, tegeldaks tõmmistega jne
• pluginaid aitavad privilegeeritud helperid - helperite kätega tehakse nö kernel kihis muudatused (nt virtuaalse võrguliidese moodustamine ja bridge külge kinnitamine)

Paigaldamine

TODO

Kopeerimiseks sobib öelda

Imres-MacBook-Air:20260809 root# curl -L --output container-1.2.2-installer-signed.pkg https://github.com/apple/container/releases/download/1.2.2/container-1.2.2-installer-signed.pkg

Kontrollimiseks

Imres-MacBook-Air:20260809 root# pkgutil --check-signature /Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg
Package "container-1.2.2-installer-signed.pkg":
   Status: signed by a developer certificate issued by Apple for distribution
   Notarization: trusted by the Apple notary service
   Signed with a trusted timestamp on: 2026-08-08 01:47:20 +0000
   Certificate Chain:
    1. Developer ID Installer: Apple Inc. - Containerization (UPBK2H6LZM)
       Expires: 2030-06-04 16:44:29 +0000
       SHA256 Fingerprint:
           45 19 B4 3D 00 F5 5E C6 31 38 D4 03 DE 1F 3C 54 23 90 EA E3 D8 2E
           59 C1 84 38 46 FB DF E1 4F 5B
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2031-09-17 00:00:00 +0000
       SHA256 Fingerprint:
           F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F
           D1 44 71 5F 35 06 43 D2 DF 3A
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
           68 C5 BE 91 B5 A1 10 01 F0 24

Imres-MacBook-Air:20260809 root# spctl -a -t install -v /Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg
/Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg: accepted
source=Notarized Developer ID

Paigaldamiseks

Imres-MacBook-Air:20260809 root# installer -pkg container-1.2.2-installer-signed.pkg -target /
installer: Package name is container-1.2.2-installer-signed
installer: Installing at base path /
installer: The install was successful.

Failisüsteemi tekivad

imreoolberg@Imres-MacBook-Air ~ % pkgutil --pkgs | grep conta
com.apple.container-installer

imreoolberg@Imres-MacBook-Air ~ % pkgutil --files com.apple.container-installer --only-files
bin/container
bin/container-apiserver
bin/uninstall-container.sh
bin/update-container.sh
libexec/container/plugins/container-core-images/bin/container-core-images
libexec/container/plugins/container-core-images/config.toml
libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet
libexec/container/plugins/container-network-vmnet/config.toml
libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux
libexec/container/plugins/container-runtime-linux/config.toml
libexec/container/plugins/k8s/bin/k8s
libexec/container/plugins/k8s/config.toml
libexec/container/plugins/k8s/resources/kindnet.yaml
libexec/container/plugins/machine-apiserver/bin/machine-apiserver
libexec/container/plugins/machine-apiserver/config.toml
libexec/container/plugins/machine-apiserver/resources/create-user.sh
libexec/container/plugins/machine-apiserver/resources/init

Logis

# tail -f /var/log/install.log

...
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Referenced component packages (1) trustLevel=350
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFPKGDerivedDocument sortedPackageLocations]: result = (
            "file://localhost"
        )
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: location = file://localhost
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Set authorization level to root for session
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Authorization is being checked, waiting until authorization arrives.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Administrator authorization granted.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Packages have been authorized for installation.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Will use PK session
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Using authorization level of root for IFPKInstallElement
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Starting installation:
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Configuring volume "Macintosh HD"
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Preparing disk for local booted install.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Free space on "Macintosh HD": 32.78 GB (32778833920 bytes).
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Create temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.78940FDpYBc"
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: IFPKInstallElement (1 packages)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/sbin/installer
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /bin/bash
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/bin/sudo
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/bin/sudo
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Adding client PKInstallDaemonClient pid=78940, uid=0 (/usr/sbin/installer)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: PackageKit: Enqueuing install with framework-specified quality of service (utility)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Set reponsibility for install to 1490
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Hosted team responsibility for install set to team:(UPBK2H6LZM)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: ----- Begin install -----
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: request=PKInstallRequest <1 packages, destination=/>
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: packages=(
            "PKLeopardPackage <id=com.apple.container-installer, version=1.2.2, url=file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg>"
        )
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Extracting file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg (destination=/Library/InstallerSandboxes/.PKInstal
lSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox/Root/usr/local, uid=0)
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: prevent user idle system sleep
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: suspending backupd
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Using trashcan path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/PKInstallSandboxTrash/5C274BE5-0952-4A13-AEDC-87828C0B0E74.sandboxTrash
for sandbox /Library/InstallerSandboxes/.PKInstallSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Shoving /Library/InstallerSandboxes/.PKInstallSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox/Root (1 items) to /
2026-08-10 01:37:59+03 Imres-MacBook-Air install_monitor[78949]: Temporarily excluding: /Applications, /Library, /System, /bin, /private, /sbin, /usr
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Writing receipt for com.apple.container-installer to /
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: No Intel binaries to translate.
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: Installed "container-1.2.2-installer-signed" ()
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: Successfully wrote install history to /Library/Receipts/InstallHistory.plist
2026-08-10 01:37:59+03 Imres-MacBook-Air install_monitor[78949]: Re-included: /Applications, /Library, /System, /bin, /private, /sbin, /usr
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: releasing backupd
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: allow user idle system sleep
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: ----- End install -----
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: 1.5s elapsed install time
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Cleared responsibility for install from 78940.
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Hosted team responsible for install has been cleared.
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Running idle tasks
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Removing client PKInstallDaemonClient pid=78940, uid=0 (/usr/sbin/installer)
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Done with sandbox removals
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Removing temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.78940FDpYBc"
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Finalize disk "Macintosh HD"
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Notifying system of updated components
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: **** Summary Information ****
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:   Operation      Elapsed time
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: -----------------------------
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:        zero      0.00 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:        disk      0.00 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:     install      2.22 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:     -total-      2.22 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:

Linux kopeerimine jms

imreoolberg@Imres-MacBook-Air ~ % container system start
Launching container-apiserver...
Testing access to container-apiserver...
Verifying machine API server is running...
No default kernel configured.
Install the recommended default kernel from [https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst]? [Y/n]:
Installing kernel...
imreoolberg@Imres-MacBook-Air ~ %

Tekivad neli protsessi

imreoolberg      24167   0.0  0.1 435366080  11376   ??  S    11:21PM   0:00.03 /usr/local/libexec/container/plugins/container-core-images/bin/container-core-images start
imreoolberg      24166   0.0  0.1 435366160  11072   ??  S    11:21PM   0:00.03 /usr/local/libexec/container/plugins/machine-apiserver/bin/machine-apiserver start --resources /usr/local/libexec/container/plugins/machine-apiserver/resources
imreoolberg      24165   0.0  0.1 435359488  10784   ??  S    11:21PM   0:00.03 /usr/local/libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet start --id default --service-identifier com.apple.container.network.container-network-vmnet.default --mode nat
imreoolberg      24158   0.0  0.1 435377296  15264   ??  S    11:21PM   0:00.42 /usr/local/bin/container-apiserver start

kus

• kõik protsessid on tavakasutajate privileegides - ka nt võrgundusega seotud
• võrgunduse seadistamiseks kasutatakse nn süsteemseid privilegeeritud helpereid (üle xpc vms)

Virtuaalsete arvutite failisüsteemidele vastavad ressursid asuvad kataloogis

/Users/imreoolberg/Library/Application Support/com.apple.container

Võrguressursid

imreoolberg@Imres-MacBook-Air ~ % lsof -nP -iUDP | grep conta
container 24564 imreoolberg   14u  IPv4 0xd7912f836fb45a0a      0t0  UDP 127.0.0.1:2053

Seadistamine

imreoolberg@Imres-MacBook-Air 20260810 % container system property ls

[build]
cpus = 2
image = "ghcr.io/apple/container-builder-shim/builder:0.13.1"
memory = "2048mb"
rosetta = true

[container]
cpus = 4
memory = "1gb"

[dns]

[kernel]
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.15-186"
digest = "sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"

[machine]
cpus = 5
homeMount = "rw"
memory = "8gb"
virtualization = false

[network]

[registry]
domain = "docker.io"

[vminit]
image = "ghcr.io/apple/containerization/vminit:0.40.1"

Kusjuures vaikimisi käivitatud konteineri sees paistab cpu arvu +1, peaks olema sellise mõtlemisega, et 4 on puhtalt konteineri workload jaoks ja 1 on süsteemne overhead

imreoolberg@Imres-MacBook-Air ~ % container exec -ti cn_claude-code bash
node@cn_claude-code:/workspace$ free -m
               total        used        free      shared  buff/cache   available
Mem:            1112         227         435           0         465         884
Swap:              0           0           0

node@cn_claude-code:/workspace$ lscpu | grep CPU\(s\)
CPU(s):                                  5
On-line CPU(s) list:                     0-4
NUMA node0 CPU(s):                       0-4

Default muutmiseks sobib kasutada ja kehtetamiseks öelda stop ja start

imreoolberg@Imres-MacBook-Air ~ % mkdir .config/container
imreoolberg@Imres-MacBook-Air ~ % cat .config/container/config.toml
[container]
cpus = 2
memory = "3gb"

kuid tagasipöördumiseks tehase defaultile tuleb tekitada tühi fail (ta tekitab .config faili alusel nö süsteemsema faili, mis ei ole kirjutatav)

imreoolberg@Imres-MacBook-Air ~ % rm .config/container/config.toml
imreoolberg@Imres-MacBook-Air ~ % touch .config/container/config.toml

imreoolberg@Imres-MacBook-Air ~ % ls -ld ~/Library/Application\ Support/com.apple.container/config/config.toml
-r--r--r--@ 1 imreoolberg  staff  0 Aug 12 10:08 /Users/imreoolberg/Library/Application Support/com.apple.container/config/config.tom

Kasutamine - tõmmise ehitamine

Machine image tekitamine

imreoolberg@Imres-MacBook-Air 20260810 % cat Dockerfile
FROM ubuntu:24.04
ENV container container
RUN apt-get update && \
    apt-get install -y \
      dbus systemd openssh-server net-tools iproute2 iputils-ping curl wget vim-tiny man sudo && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* && \
    yes | unminimize
RUN >/etc/machine-id
RUN >/var/lib/dbus/machine-id
RUN systemctl set-default multi-user.target
RUN systemctl mask \
    dev-hugepages.mount \
    sys-fs-fuse-connections.mount \
    systemd-update-utmp.service \
    systemd-tmpfiles-setup.service \
    console-getty.service
RUN systemctl disable \
    networkd-dispatcher.service
RUN sed -i -e 's/^AcceptEnv LANG LC_\*$/#AcceptEnv LANG LC_*/' /etc/ssh/sshd_config

imreoolberg@Imres-MacBook-Air 20260810 % container build -t local/ubuntu-machine:latest .
imreoolberg@Imres-MacBook-Air 20260810 % container machine create local/ubuntu-machine:latest --name dev

Tõmmiste nimekirja esitamine

imreoolberg@Imres-MacBook-Air 20260810 % container image list
NAME                  TAG     DIGEST
alpine                latest  28bd5fe8b56d
ubuntu                24.04   561618e2c15b
local/ubuntu-machine  latest  f470db19ef25

Konteiner tõmmise tekitamine

imreoolberg@Imres-MacBook-Air 20260810 % cat Dockerfile
FROM node:24-trixie

RUN apt-get update && \
  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
  less \
  git \
  procps \
  sudo \
  fzf \
  zsh \
  man-db \
  unzip \
  gnupg2 \
  gh \
  iptables \
  ipset \
  iproute2 \
  dnsutils \
  aggregate \
  jq \
  nano \
  vim \
  openssh-client \
  ripgrep \
  bash \
  fd-find \
  bat \
  tmux \
  tree \
  htop \
  iputils-ping \
  traceroute \
  net-tools \
  lsof \
  python3-pip \
  python3-venv \
  zip \
  rsync \
  tshark \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

RUN npm install -g @anthropic-ai/claude-code
WORKDIR /workspace
ENTRYPOINT ["claude"]

Ehitamiseks sobib öelda

imreoolberg@Imres-MacBook-Air 20260810 % container build -t local/trixie-claude-container:latest .

imreoolberg@Imres-MacBook-Air 20260810 % container image ls
NAME                           TAG        DIGEST
alpine                         latest     28bd5fe8b56d
nginx                          latest     8541484afbc9
node                           24-trixie  66bb8d36ae1d
nginxinc/nginx-unprivileged    latest     0371d6f99f39
local/trixie-claude-container  latest     09c7fd8b121f

Käsundamine

imreoolberg@Imres-MacBook-Air ~ % container ls
ID                                    IMAGE                            OS     ARCH   STATE    IP               CPUS  MEMORY   STARTED
dc85cd18-cb6f-4e52-a675-dca8ace06bff  docker.io/library/alpine:latest  linux  arm64  running  192.168.65.6/24  4     1024 MB  2026-08-10T06:14:40Z
5b4feb90-e8dd-4326-b6a8-809f50889b28  docker.io/library/alpine:latest  linux  arm64  running  192.168.65.3/24  4     1024 MB  2026-08-09T22:44:38Z

ning

imreoolberg@Imres-MacBook-Air ~ % container run -it --name persisttest-5 ubuntu bash

Kasutamine - Claude Code CLI

imreoolberg@Imres-MacBook-Air 20260810 % cat cn_claude-code.sh
container run --name cn_claude-code --rm --init --user node \
  --volume /Users/imreoolberg/ac-cc/volume/workspace:/workspace \
  --volume /Users/imreoolberg/ac-cc/volume/home/node:/home/node \
  --volume "$SSH_AUTH_SOCK:/ssh-agent" \
  --env SSH_AUTH_SOCK=/ssh-agent --env DISABLE_UPDATES=1 \
  --workdir /workspace -it local/trixie-claude-container

ja paketifiltri osa

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 192.168.1.240
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
   10.154.221.53
   10.154.221.54
   192.168.1.240

Imres-MacBook-Air:~ root# tcpdump -nei pflog0 port 22
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), snapshot length 524288 bytes
09:47:51.308116 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135796140 ecr 0,nop,wscale 8], length 0
09:47:52.329182 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135797161 ecr 0,nop,wscale 8], length 0
09:47:53.352717 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135798185 ecr 0,nop,wscale 8], length 0
09:47:54.376537 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135799209 ecr 0,nop,wscale 8], length 0

Kasulikud lisamaterjalid

• TODO