Skip to content

Add network attachment aliases#1815

Open
thromel wants to merge 4 commits into
apple:mainfrom
thromel:codex/network-aliases
Open

Add network attachment aliases#1815
thromel wants to merge 4 commits into
apple:mainfrom
thromel:codex/network-aliases

Conversation

@thromel

@thromel thromel commented Jun 25, 2026

Copy link
Copy Markdown

Closes #1839

Summary

This PR adds explicit network attachment aliases so a container can register additional names on a network attachment.

  • adds aliases to AttachmentOptions and Attachment
  • parses repeated alias=NAME properties in --network, for example --network backend,alias=db
  • passes aliases over the network-helper XPC allocation request
  • registers aliases in the network allocator as additional names for the same address
  • releases all names for an allocation when the attachment is released
  • includes aliases in duplicate-name validation during container creation
  • adds coverage for alias serialization compatibility and client attachment-option plumbing

Related

This PR registers alias names in the hostname database. Resolution from inside containers still depends on a future container-facing DNS listener design; #1813 now intentionally does not start that listener after vmnet gateway bind validation failed.

This PR is stacked and currently includes the commits from #1810 and #1813. I can rebase once those land, or split/re-target however maintainers prefer.

Notes

The CLI shape follows the existing network property syntax:

container run --network backend,alias=db,alias=database ...

Aliases are currently validated for emptiness and normalized case/trailing-dot in the allocator, matching existing hostname lookup behavior. This keeps the change narrow and avoids introducing a stricter hostname validator than the existing primary-hostname path uses.

Testing

  • git diff --check origin/main..HEAD
  • swift test -c debug -Xswiftc -warnings-as-errors --filter 'ParserTest|UtilityTests|AttachmentAllocatorTest|NetworkConfigurationTest|ForwardingResolverTest|CompositeResolverTest|RecordsTests'

The focused test run passed 202 tests after rebasing onto current origin/main and linked the CLI, APIServer, runtime, and vmnet helper as part of the package test build.

@jglogan

jglogan commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

@thromel We won't have time to look at this in the next couple of days, but we should be able to get started on it in the next week sometime or the week after.

This is exactly the CLI shape I had in mind for this. Could you create an enhancement issue for this and then add a "Closes #issue" at the top of this PR? In the issue, provide a basic description of the feature use case, UX (CLI shape), and proposed design (mainly, how does our hostname database and the interactions with it change?)

Once that's in place we can have a discuss in the issue a couple other things I've had in mind relating to this capability.

Thank you for taking this on.

@jglogan

jglogan commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

@thromel Also, please configure commit signing and verification, as we can't merge unverified commits.

See: https://github.com/apple/containerization/blob/main/CONTRIBUTING.md#pull-requests

@thromel

thromel commented Jun 26, 2026

Copy link
Copy Markdown
Author

Thanks, done. I filed #1839 with the use case, CLI UX, and hostname database design notes, and updated this PR body to start with Closes #1839.

I also saw the signing note. I am setting up verified SSH commit signing and will force-push signed replacement commits once GitHub recognizes the signing key.

@thromel thromel force-pushed the codex/network-aliases branch from 620cfc3 to 638ad20 Compare June 26, 2026 19:09
@thromel

thromel commented Jun 26, 2026

Copy link
Copy Markdown
Author

Signed replacement commits have been force-pushed.

I verified the current PR commits on GitHub are all marked verified/valid:

@thromel thromel force-pushed the codex/network-aliases branch 2 times, most recently from 9d0ae2f to 04558b5 Compare June 27, 2026 00:45
@thromel

thromel commented Jun 27, 2026

Copy link
Copy Markdown
Author

Fixed. I force-pushed signed replacement commits after rebasing onto current origin/main.

GitHub verification reports valid signatures for the current PR commits:

  • 9286756
  • 712f517
  • e863833

The PR body still starts with Closes #1839, and I updated the testing/design text to remove stale live-DNS claims from the superseded listener design.

@thromel thromel force-pushed the codex/network-aliases branch from e863833 to f8f149b Compare June 28, 2026 04:14
@thromel

thromel commented Jun 28, 2026

Copy link
Copy Markdown
Author

Rebased this PR onto the updated #1813 stack after the DNS design-doc commit.

GitHub verification reports valid signatures for the current PR commits:

  • 9286756 - Normalize network hostname lookup
  • 712f517 - Add DNS forwarding groundwork
  • ff1da85 - Document DNS subsystem design
  • f8f149b - Add network attachment aliases

Focused validation after the rebase:

  • git diff --check origin/main..HEAD
  • swift test -c debug -Xswiftc -warnings-as-errors --filter 'ParserTest|UtilityTests|AttachmentAllocatorTest|NetworkConfigurationTest|ForwardingResolverTest|CompositeResolverTest|RecordsTests' - 202 tests passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Request]: Add network-scoped aliases for container network attachments

2 participants