Exclude application data directory from backups

Sources/Services/ContainerAPIService/Server/Containers/ContainersService.swift

@@ -72,6 +72,19 @@ public actor ContainersService {
         log: Logger,
         debugHelpers: Bool = false
     ) throws {
+        try FileManager.default.createDirectory(at: appRoot, withIntermediateDirectories: true)
+        do {
+            var mutableAppRoot = appRoot
+            var resourceValues = URLResourceValues()
+            resourceValues.isExcludedFromBackup = true
+            try mutableAppRoot.setResourceValues(resourceValues)
+            log.info("excluded app root from backups", metadata: ["path": "\(appRoot.path)"])
+        } catch {
+            log.warning(
+                "failed to exclude app root from backups",
+                metadata: ["error": "\(error.localizedDescription)"]
+            )
+        }
         let containerRoot = appRoot.appendingPathComponent("containers")
         try FileManager.default.createDirectory(at: containerRoot, withIntermediateDirectories: true)
         self.exitMonitor = ExitMonitor(log: log)

Tests/ContainerAPIServiceTests/RuntimeConfigurationTests.swift

@@ -133,3 +133,24 @@ struct RuntimeConfigurationTests {
         #expect(decodedData.variant == "test-variant", "Variant should round-trip through RuntimeConfiguration")
     }
 }
+
+struct BackupExclusionTests {
+    @Test
+    func testExcludeFromBackupMarksDirectory() throws {
+        var root = FileManager.default.temporaryDirectory
+            .appendingPathComponent("app-root-\(UUID())")
+
+        defer {
+            try? FileManager.default.removeItem(at: root)
+        }
+
+        try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+
+        var resourceValues = URLResourceValues()
+        resourceValues.isExcludedFromBackup = true
+        try root.setResourceValues(resourceValues)
+
+        let readBack = try root.resourceValues(forKeys: [.isExcludedFromBackupKey])
+        #expect(readBack.isExcludedFromBackup == true)
+    }
+}