starred/container
1
0
Fork 0
mirror of https://github.com/apple/container.git synced 2026-09-27 09:26:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

Verify kernel archive integrity (#1703)

Browse Source 
Closes https://github.com/apple/container/issues/1687

The default kernel archive is downloaded from a remote release URL
during first-run setup and via `container system kernel set
--recommended`. Previously, the archive contents were not verified after
download, so integrity depended on HTTPS and the release artifact
remaining unchanged.

This change adds digest verification for kernel archives. The
recommended/default kernel now has pinned digest metadata using an
algorithm-prefixed value such as `sha256:<hex>`. `container system
kernel set --tar` accepts `--digest`; remote tar URLs require it, and
local tar archives can also be verified before unpacking and
installation.

The system config also supports `kernel.digest`, and a custom
`kernel.url` must provide a digest for that archive.
This commit is contained in:
0x4C33
2026-07-13 13:04:39 -07:00
committed by GitHub
parent 5f277a9cbf
commit 57b07fa2ac
15 changed files with 460 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/command-reference.md
+2 -1
View File
@@ -1543,7 +1543,7 @@ Installs or updates the Linux kernel used by the container runtime on macOS host
**Usage**
```bash
container system kernel set [--arch <arch>] [--binary <binary>] [--force] [--recommended] [--tar <tar>] [--debug]
container system kernel set [--arch <arch>] [--binary <binary>] [--force] [--recommended] [--tar <tar>] [--digest <digest>] [--debug]
```
**Options**
@@ -1553,6 +1553,7 @@ container system kernel set [--arch <arch>] [--binary <binary>] [--force] [--rec
* `--force`: Overwrites an existing kernel with the same name
* `--recommended`: Download and install the recommended kernel as the default (takes precedence over all other flags)
* `--tar <tar>`: Filesystem path or remote URL to a tar archive containing a kernel file
* `--digest <digest>`: Expected digest for the tar archive, for example `sha256:<hex>`. Required when `--tar` is a remote URL.
### `container system property list (ls)`
docs/container-system-config.md
+6 -5
View File
@@ -15,7 +15,7 @@ Source of truth: [`Sources/ContainerPersistence/ContainerSystemConfig.swift`](..
[build] # builder VM resources and image
[container] # default per-container resources
[dns] # default DNS domain for DNS resolution on host
[kernel] # guest kernel binary path and download URL
[kernel] # guest kernel binary path, download URL, and digest
[network] # default subnets for new networks
[registry] # default registry domain
[vminit] # default vminitd image to use
@@ -54,10 +54,11 @@ Defaults applied when `container run` / `container create` is invoked without `-
Guest kernel used when launching container VMs. Defaults change per release as kernels are bumped — check the [source](../Sources/ContainerPersistence/ContainerSystemConfig.swift) for current values.
| Key | Type | Default | Description |
|--------------|----------|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|
| `binaryPath` | `String` | `"opt/kata/share/kata-containers/vmlinux-6.18.15-186"` | Path **inside** the downloaded kernel archive that points to the kernel binary. |
| `url` | `URL` | `"https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"` | Archive to download when no kernel is installed. Encoded and decoded as a plain string in TOML. |
| Key | Type | Default | Description |
|--------------|-----------|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|
| `binaryPath` | `String` | `"opt/kata/share/kata-containers/vmlinux-6.18.15-186"` | Path **inside** the downloaded kernel archive that points to the kernel binary. |
| `url` | `URL` | `"https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"` | Archive to download when no kernel is installed. Encoded and decoded as a plain string in TOML. |
| `digest` | `String` | `"sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"` | Expected digest for the archive, for example `sha256:<hex>`. Required when configuring a custom `url`. |
## `[network]`
docs/how-to.md
+3 -2
View File
@@ -659,8 +659,9 @@ memory = "1gb"
domain = "test"
[kernel]
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.5-177"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.26.0/kata-static-3.26.0-arm64.tar.zst"
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.15-186"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"
digest = "sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"
[network]
docs/tutorials/container-system-config-tutorial.md
+1
View File
@@ -77,6 +77,7 @@ domain = "test"
[kernel]
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.15-186"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"
digest = "sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"
[network]