[container]: add clean command - #1949

@saehejkang It looks like the root fs gets cleaned but not a mounted named volume?

I'm testing your branch locally and doing this (the --cap-add is only so I can run fstrim):

container volume create scratch
container run -it --rm --name clean-test --cap-add ALL -v scratch:/mnt/data ubuntu:noble

Baseline measurement from the host shell:

du -sm ~/Library/Application\ Support/com.apple.container/containers/clean-test/rootfs.ext4
du -sm ~/Library/Application\ Support/com.apple.container/volumes/scratch/volume.img

In the container:

dd if=/dev/urandom of=/test.dat bs=65536 count=4096
dd if=/dev/urandom of=/mnt/data/test.dat bs=65536 count=4096
sync

The measured sizes of the files should be larger now.

Then, in the container:

rm /test.dat
rm /mnt/data/test.dat
sync

Measured sizes should not decrease yet.

From the host:

container clean clean-test

At this point the measured sizes should be close to the original (or less even, for the root volume).

What I'm seeing is that the root fs decreases but the volume does not. If I run fstrim in the container on the mount point I do see the decrease:

fstrim /mnt/data

With a debugger attached, I see a filesystemOperation call for .trim with the paths:

• /run/container/clean-test/rootfs
• /run/container/clean-test/rootfs/mnt/data

I investigated the named-volume behavior while updating this PR against the current main. The remaining issue is that filesystem operations are resolved in vminitd's mount namespace, while OCI block mounts such as named volumes exist only in the workload container's mount namespace.

I opened apple/containerization#830 as a draft companion change. It carries the workload container ID through the filesystem-operation RPC, pins the init process root to avoid PID-reuse races, and resolves canonical container paths with openat2(RESOLVE_IN_ROOT | RESOLVE_NO_MAGICLINKS).

I also opened #2068 as an upstream draft based on this PR's commit history. It preserves the original authorship, updates the branch to current main, resolves the current API/test-fixture conflicts, and adds runtime identity checks and integration coverage. I closed the temporary fork-targeted PR so review stays in the official Apple repositories.

The containerization PR is ready for review. #2068 remains a draft while its dependency revision and host allocated-size assertions are finalized. Maintainers and the original author can choose whether to continue in #2068 or fold those commits back into this PR.

Hey @recrack! Thanks for taking a look into this. You are correct in that "filesystem operations are resolved in vminitd's mount namespace" and that is causing issues with trimming volume mounts. I was working on changes that I was just able to push. Here is a solution that @jglogan and I came up with, if you want to take a look.

apple/containerization#838

@saehejkang I updated this to pick up your containerization fix. It looks like all that's needed now are some adjustments to accommodate changes to the test fixtures.

It looks like all that's needed now are some adjustments to accommodate changes to the test fixtures.

Should be fixed and ready

Seeing some test failures:

✔ Test testAnonymousVolumeMixedWithNamedVolume() passed after 1116.770 seconds.
✘ Test testCleanAfterFileCreation() recorded an issue at TestCLIClean.swift:63:9: Expectation failed: (writeAllocated → 0) > 0
✘ Test testCleanAfterFileCreation() recorded an issue at TestCLIClean.swift:66:9: Expectation failed: (reclaimed → 0) > 0
✘ Test testCleanAfterFileCreation() failed after 9.430 seconds with 2 issues.
◇ Test testCleanWithVolume() started.
✔ Test testMultipleAnonymousVolumes() passed after 1117.200 seconds.
✔ Suite TestCLIAnonymousVolumes passed after 1117.205 seconds.
✘ Test testCleanWithVolume() recorded an issue at TestCLIClean.swift:63:9: Expectation failed: (writeAllocated → 0) > 0
✘ Test testCleanWithVolume() recorded an issue at TestCLIClean.swift:66:9: Expectation failed: (reclaimed → 0) > 0
✘ Test testCleanWithVolume() failed after 8.275 seconds with 2 issues.
✘ Suite TestCLIClean failed after 1125.449 seconds with 4 issues.
✘ Test run with 280 tests in 33 suites failed after 1125.450 seconds with 4 issues.
Ensuring apiserver stopped after the CLI integration tests
make: *** [coverage-integration] Error 1

Code Coverage