sandbox

type AutoEtc struct{ Prefix string }

type BindMount struct {
	Source, SourceFinal, Target string

	Flags int
}

type Container struct {

	// Cgroup fd, nil to disable.
	Cgroup *int
	// ExtraFiles passed through to initial process in the container,
	// with behaviour identical to its [exec.Cmd] counterpart.
	ExtraFiles []*os.File

	// Custom [exec.Cmd] initialisation function.
	CommandContext func(ctx context.Context) (cmd *exec.Cmd)

	Stdin  io.Reader
	Stdout io.Writer
	Stderr io.Writer

	Cancel    func(cmd *exec.Cmd) error
	WaitDelay time.Duration

	Params
	// contains filtered or unexported fields
}

type DefaultMsg struct {
	// contains filtered or unexported fields
}

type HardeningFlags uintptr

type Mkdir struct {
	Path string
	Perm os.FileMode
}

type MountDev string

type MountMqueue string

type MountProc string

type MountTmpfs struct {
	Path string
	Size int
	Perm os.FileMode
}

type Msg interface {
	IsVerbose() bool
	Verbose(v ...any)
	Verbosef(format string, v ...any)
	WrapErr(err error, a ...any) error
	PrintBaseErr(err error, fallback string)

	Suspend()
	Resume() bool

	BeforeExit()
}

type Op interface {
	Is(op Op) bool
	fmt.Stringer
	// contains filtered or unexported methods
}

type Ops []Op

type Params struct {
	// Working directory in the container.
	Dir string
	// Initial process environment.
	Env []string
	// Absolute path of initial process in the container. Overrides name.
	Path string
	// Initial process argv.
	Args []string

	// Mapped Uid in user namespace.
	Uid int
	// Mapped Gid in user namespace.
	Gid int
	// Hostname value in UTS namespace.
	Hostname string
	// Sequential container setup ops.
	*Ops
	// Extra seccomp options.
	Seccomp seccomp.FilterOpts
	// Permission bits of newly created parent directories.
	// The zero value is interpreted as 0755.
	ParentPerm os.FileMode
	// Retain CAP_SYS_ADMIN.
	Privileged bool

	Flags HardeningFlags
}

type Symlink [2]string

type Tmpfile struct {
	Path string
	Data []byte
}