chore: import upstream snapshot with attribution

.github/ISSUE_TEMPLATE/01-bug.yml

@@ -0,0 +1,71 @@
+name: Bug report
+description: File a bug report.
+title: "[Bug]: "
+type: "Bug"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+  - type: checkboxes
+    id: prereqs
+    attributes:
+      label: I have done the following
+      description: Select that you have completed the following prerequisites. 
+      options:
+        - label: I have searched the existing issues
+          required: true
+        - label: If possible, I've reproduced the issue using the 'main' branch of this project
+          required: false
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Explain how to reproduce the incorrect behavior. 
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: Current behavior
+      description: A concise description of what you're experiencing.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: A concise description of what you expected to happen.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Environment 
+      description: |
+        Examples: 
+          - **OS**: macOS 26.0 (25A354)
+          - **Xcode**: Version 26.0 (17A324)
+          - **Swift**: Apple Swift version 6.2 (swift-6.2-RELEASE)
+      value: |
+        - OS: 
+        - Xcode: 
+        - Swift: 
+      render: markdown
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
+      value: |
+        N/A
+      render: shell
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Code of Conduct
+      description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/apple/.github/blob/main/CODE_OF_CONDUCT.md).
+      options:
+        - label: I agree to follow this project's Code of Conduct
+          required: true

.github/ISSUE_TEMPLATE/02-feature.yml

@@ -0,0 +1,24 @@
+name: Feature or enhancement request
+description: File a request for a feature or enhancement
+title: "[Request]: "
+type: "Feature"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for contributing to the containerization project!
+  - type: textarea
+    id: request
+    attributes:
+      label: Feature or enhancement request details
+      description: Describe your proposed feature or enhancement. Code samples that show what's missing, or what new capabilities will be possible, are very helpful! Provide links to existing issues or external references/discussions, if appropriate.
+    validations:
+      required: true
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Code of Conduct
+      description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/apple/.github/blob/main/CODE_OF_CONDUCT.md). 
+      options:
+        - label: I agree to follow this project's Code of Conduct
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Containerization community support
+    url: https://github.com/apple/container/discussions
+    about: Please ask and answer questions here.

.github/workflows/build-test-images.yml

@@ -0,0 +1,77 @@
+name: Build and publish containerization test images
+
+permissions:
+  contents: read
+
+on: 
+  workflow_dispatch: 
+    inputs: 
+      publish: 
+        type: boolean
+        description: "Publish the built image"
+        default: false
+      version: 
+        type: string
+        description: "Version of the image to create"
+        default: "test"
+      image:
+        type: choice
+        description: Test image to build
+        options:
+          - dockermanifestimage
+          - emptyimage
+        default: 'dockermanifestimage'
+      useBuildx:
+        type: boolean
+        description: "Use docker buildx to build the image"
+        default: false
+
+jobs: 
+  image: 
+    name: Build test images
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write 
+    steps:
+      - name: Check branch
+        env:
+          GH_REF: ${{ github.ref }}
+          PUBLISH: ${{ inputs.publish }}
+        run: |
+          if [[ "${GH_REF}" != "refs/heads/main" ]] && [[ "${GH_REF}" != refs/heads/release* ]] && [[ "${PUBLISH}" == "true" ]]; then
+            echo "❌ Cannot publish an image if we are not on main or a release branch."
+            exit 1
+          fi
+      - name: Check inputs
+        env:
+          IMAGE: ${{ inputs.image }}
+          USE_BUILDX: ${{ inputs.useBuildx }}
+        run: |
+          if [[ "${IMAGE}" == "dockermanifestimage" ]] && [[ "${USE_BUILDX}" == "true" ]]; then
+            echo "❌ dockermanifestimage cannot be built with buildx"
+            exit 1
+          fi
+
+          if [[ "${IMAGE}" == "emptyimage" ]] && [[ "${USE_BUILDX}" != "true" ]]; then
+            echo "❌ emptyimage should be built with buildx"
+            exit 1
+          fi
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6 
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set up Docker Buildx
+        if: ${{ inputs.useBuildx }} 
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+      - name: Build dockerfile and push image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6
+        with:
+          push: ${{ inputs.publish }}
+          context: Tests/TestImages/${{ inputs.image }}
+          tags: ghcr.io/apple/containerization/${{ inputs.image }}:${{ inputs.version }}

.github/workflows/containerization-build-template.yml

@@ -0,0 +1,130 @@
+name: Build containerization template
+
+permissions:
+  contents: read
+
+on: 
+  workflow_call:
+    inputs:
+      release:
+        type: boolean
+        description: "Create a release"
+        default: false
+      version: 
+        type: string
+        description: Version of containerization 
+        default: test
+
+jobs: 
+  buildAndTest: 
+    name: Build and Test repo
+    if: github.repository == 'apple/containerization'
+    timeout-minutes: 60
+    runs-on: [self-hosted, macos, tahoe, ARM64]
+    permissions:
+      contents: read
+      packages: write
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode_swift_6.3.app/Contents/Developer"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6
+        with:
+          fetch-depth: 0
+
+      - name: Activate Swiftly
+        run: |
+          source ~/.swiftly/env.sh
+          cat ~/.swiftly/env.sh
+
+      - name: Check formatting
+        run: | 
+          ./scripts/install-hawkeye.sh
+          make fmt
+          git diff
+          if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi
+
+      - name: Check protobufs
+        run: | 
+          make protos
+          if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi
+
+      - name: Make containerization, examples, and docs
+        run: |
+          make clean containerization examples docs
+          tar cfz _site.tgz _site
+        env:
+          BUILD_CONFIGURATION: ${{ inputs.release && 'release' || 'debug' }}
+
+      - name: Make vminitd image
+        run: |
+          source ~/.swiftly/env.sh
+          make -C vminitd swift linux-sdk
+          make init
+        env:
+          BUILD_CONFIGURATION: ${{ inputs.release && 'release' || 'debug' }}
+
+      - name: Test containerization
+        run: | 
+          make fetch-default-kernel
+          make test integration
+        env:
+          REGISTRY_TOKEN: ${{ github.token }}
+          REGISTRY_USERNAME: ${{ github.actor }}
+
+      - name: Push vminitd image
+        if: ${{ inputs.release }}
+        env:
+          REGISTRY_TOKEN: ${{ github.token }}
+          REGISTRY_USERNAME: ${{ github.actor }}
+          REGISTRY_HOST: ghcr.io
+          VERSION: ${{ inputs.version }}
+        run: |
+          bin/cctl images tag vminit:latest "ghcr.io/apple/containerization/vminit:${VERSION}"
+          bin/cctl images push "ghcr.io/apple/containerization/vminit:${VERSION}"
+
+      - name: Create image tar 
+        if: ${{ !inputs.release }}
+        run: |
+          bin/cctl images save vminit:latest -o vminit.tar
+
+      - name: Save vminit artifact
+        if: ${{ !inputs.release }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
+        with:
+          name: vminit
+          path: vminit.tar
+
+      - name: Save documentation artifact
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
+        with:
+          name: api-docs
+          path: "./_site.tgz"
+          retention-days: 14
+
+  uploadPages:
+    # Separate upload step required because upload-pages-artifact needs
+    # gtar which is not on the macOS runner.
+    name: Upload artifact for GitHub Pages
+    needs: buildAndTest
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Setup Pages
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5
+
+      - name: Download a single artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7
+        with:
+          name: api-docs
+
+      - name: Add API docs to documentation
+        run: |
+          tar xfz _site.tgz
+
+      - name: Upload Artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4
+        with:
+          path: "./_site"

.github/workflows/containerization-build.yml

@@ -0,0 +1,53 @@
+name: Build containerization
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  push:
+    branches:
+      - main
+      - release/*
+
+jobs:
+  verify-signatures:
+    name: Verify commit signatures
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Check all commits are signed
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          commits=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/commits" --paginate)
+          unsigned_commits=""
+
+          while IFS='|' read -r sha author verified; do
+            if [ "$verified" != "true" ]; then
+              unsigned_commits="$unsigned_commits  - $sha by $author\n"
+            fi
+          done < <(echo "$commits" | jq -r '.[] | "\(.sha)|\(.commit.author.name)|\(.commit.verification.verified)"')
+
+          if [ -n "$unsigned_commits" ]; then
+            echo "::error::The following commits are not signed:"
+            echo -e "$unsigned_commits"
+            echo ""
+            echo "Please sign your commits. See:"
+            echo  "  - https://github.com/apple/containerization/blob/main/CONTRIBUTING.md#pull-requests"
+            echo  "  - https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+            exit 1
+          fi
+
+          echo "All commits are signed!"
+
+  containerization:
+    permissions:
+      contents: read
+      packages: write
+      pages: write
+    uses: ./.github/workflows/containerization-build-template.yml
+    secrets: inherit

.github/workflows/docs-release.yaml

@@ -0,0 +1,46 @@
+# Manual workflow for releasing docs ad-hoc. Workflow can only be run for main or release branches. 
+# Workflow does NOT publish a release of containerization.
+name: Deploy application website
+
+permissions:
+  contents: read
+
+on: 
+  workflow_dispatch:
+
+jobs: 
+  checkBranch:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags') || startsWith(github.ref, 'refs/heads/release')
+    steps:
+      - name: Branch validation
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: echo "Branch ${REF_NAME} is allowed"
+
+  buildSite:
+    name: Build application website
+    needs: checkBranch
+    uses: ./.github/workflows/containerization-build-template.yml
+    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      pages: write
+
+  deployDocs:
+    runs-on: ubuntu-latest
+    needs: [checkBranch, buildSite]
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4

.github/workflows/linux-build.yml

@@ -0,0 +1,60 @@
+name: Linux build
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  push:
+    branches:
+      - main
+      - release/*
+
+jobs:
+  swift-version:
+    name: Determine Swift version
+    runs-on: ubuntu-24.04
+    outputs:
+      image: ${{ steps.version.outputs.image }}
+    steps:
+      - name: Checkout .swift-version
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6
+        with:
+          sparse-checkout: .swift-version
+          sparse-checkout-cone-mode: false
+
+      - name: Read Swift version
+        id: version
+        run: echo "image=swift:$(cat .swift-version)-noble" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Linux compile check
+    needs: swift-version
+    timeout-minutes: 30
+    runs-on: ubuntu-24.04
+    container: ${{ needs.swift-version.outputs.image }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6
+        with:
+          fetch-depth: 0
+
+      - name: Install system dependencies
+        run: apt-get update && apt-get install -y curl make libarchive-dev libbz2-dev liblzma-dev libssl-dev
+
+      - name: Build containerization
+        run: make containerization
+
+      - name: Build vminitd (glibc)
+        run: make -C vminitd SWIFT_CONFIGURATION="--disable-automatic-resolution -Xswiftc -warnings-as-errors"
+
+      - name: Install Static Linux SDK
+        run: make -C vminitd linux-sdk
+
+      - name: Build vminitd (musl)
+        run: make -C vminitd
+
+      - name: Run unit tests
+        run: swift test --disable-automatic-resolution -Xswiftc -warnings-as-errors

.github/workflows/release.yml

@@ -0,0 +1,57 @@
+name: Release containerization
+
+permissions:
+  contents: read
+
+on: 
+  push: 
+    tags:
+      - "[0-9]+\\.[0-9]+\\.[0-9]+"
+
+jobs: 
+  containerization:
+    uses: ./.github/workflows/containerization-build-template.yml
+    with: 
+      release: true
+      version: ${{ github.ref_name }}
+    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      pages: write
+
+  deployDocs:
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    needs: containerization
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4
+
+  release: 
+    if: startsWith(github.ref, 'refs/tags/')
+    name: Publish release
+    timeout-minutes: 30
+    needs: containerization
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - name: Create release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
+        with:
+          token: ${{ github.token }}
+          name: ${{ github.ref_name }}-prerelease
+          draft: true
+          make_latest: false
+          prerelease: true
+          fail_on_unmatched_files: true