close
Skip to content

Explicitly pass default subnets into network creation#1424

Open
noah-thor wants to merge 1 commit intoapple:mainfrom
noah-thor:network-plugin-explicit-defaults
Open

Explicitly pass default subnets into network creation#1424
noah-thor wants to merge 1 commit intoapple:mainfrom
noah-thor:network-plugin-explicit-defaults

Conversation

@noah-thor
Copy link
Copy Markdown
Contributor

This changes the semantics around ReservedVmnetNetwork and AllocationOnlyVmnetNetwork to only create ipv4/6 subnets for networks when the values are explicitly passed in the NetworkConfiguration. Previously if the values in the NetworkConfiguration were not present it would attempt to source them via DefaultsStore.

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update

Motivation and Context

The change solves an issue that caused container network create <name> to fail when UserDefaults was set to a value that is identical to the hard coded default ("192.168.64.1/24"/"fd00::/64"). It would fail because a network with these parameters would already exist, and thus could not be reserved.

Testing

  • Tested locally
  • Added/updated tests
  • Added/updated docs

Comment thread Sources/Services/ContainerNetworkService/Server/AllocationOnlyVmnetNetwork.swift Outdated
@jglogan
Copy link
Copy Markdown
Contributor

jglogan commented Apr 19, 2026

But that would open the door for macOS 15 users calling container network create which an issue.

The CLI excludes the network subcommand on macOS 15: https://github.com/apple/container/blob/main/Sources/ContainerCommands/Application.swift#L200.

Before we do any other checking in the client, we should probably guard macOS 26 availability in the API server for the network API calls. Create and delete for sure; we could allow list/inspect but today we don't have any way to provide useful runtime state for an allocation-only network.

@jglogan
Copy link
Copy Markdown
Contributor

jglogan commented Apr 19, 2026

I do still think we should remove the fallback to DefaultsStore.get(key: .defaultSubnet) and do that logic in the APIServer.Start.initializeNetwork service as done in this change.

Yes, but it should be getOptional (remember that we don't really support macOS 15 networking, vmnet there doesn't give us everything we need, and on macOS 26 the best usability comes when the user doesn't specify a subnet). We don't want to have some sort of special-casing in the API server like "if it's this network type, use getOptional but for this type, use get". There's no need for the allocation-only network helper to use the defaults store just to supply a fallback for this one case; a private constant in the helper is sufficient.

Comment thread Tests/ContainerNetworkServiceTests/AllocationOnlyVmnetNetworkTest.swift Outdated
@noah-thor noah-thor force-pushed the network-plugin-explicit-defaults branch from 24716a8 to e23e656 Compare April 20, 2026 21:37
Copy link
Copy Markdown
Contributor

@jglogan jglogan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One comment regarding the unit tests.


public actor AllocationOnlyVmnetNetwork: Network {
// The IPv4 subnet to be used if none explicitly passed in the `NetworkConfiguration`
private static let defaultIPv4Subnet = try! CIDRv4("192.168.64.1/24")
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should avoid force-try, though here it should always work. Fine for now though.

If we ever turn on lint checks we'll either have to add exclusions for these, or rework the code.

Unfortunately Prefix in ContainerizationExtras is init? or we could do something like:

    private static let defaultIPv4Subnet = CIDRv4(IPv4Address([192, 168, 64, 1]), prefix: .ipv4(24))

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

am in favor of leaving the forced unwrap for now, the string format reads better in my option and the surface area for errors should be caught in tests. If we do decide to make that a linter rule we should explore a standard way of handling such "known safe" constants and or have a override mechanism

Comment thread Tests/ContainerNetworkServiceTests/AllocationOnlyVmnetNetworkTest.swift Outdated
This changes the semantics around `ReservedVmnetNetwork` and
`AllocationOnlyVmnetNetwork` to only create ipv4/6 subnets for networks
when the values are explicitly passed in the `NetworkConfiguration`.
Previously if the values in the `NetworkConfiguration` were not present
it would attempt to source them via `DefaultsStore`.

The change solves an issue that caused `container network create <name>` to fail
when `UserDefaults` was set to a value that is identical to the hard coded default
("192.168.64.1/24"/"fd00::/64"). It would fail because a network with
these parameters would already exist, and thus could not be reserved.
@noah-thor noah-thor force-pushed the network-plugin-explicit-defaults branch from e23e656 to bdfbbc7 Compare April 21, 2026 05:57
@noah-thor
Copy link
Copy Markdown
Contributor Author

noah-thor commented Apr 21, 2026

In the latest commit

  • dropped the unit tests to avoid the state pollution pointed out

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants