goclone

type Cmd struct {
	// This is the path to the binary that should be executed.
	Path string

	// This is the list of arguments that will be passed to exec, including
	// the command name as Args[0].
	Args []string

	// This is the environment of the process. If this is nil then the
	// environment of the calling process will be used.
	Env []string

	// The working directory of the command. If Dir is empty then the calling
	// processes working directory will be used.
	Dir string

	// This is the io.Reader that will be used as the processes stdin. If this
	// is a os.File object then writing to the descriptor will be done
	// directly, otherwise a goroutine will be started to copy data from the
	// real descriptor to the internal reader.
	Stdin io.Reader

	// These are the io.Writers for Stdout, and Stderr. These work like
	// Stdin in that an os.File object is treated specially and will continue
	// to work even after the golang process has died.
	Stdout io.Writer
	Stderr io.Writer

	// This is a list of extra files that will be passed into the process.
	// these will be mapped in as file  descriptor 3+i. Unlike Stdin these
	// MUST be os.File objects.
	ExtraFiles []*os.File

	// This is a list of system specific attributes. This will be translated
	// into system specific functionally.
	SysProcAttr *syscall.SysProcAttr

	// This is the underlying Process once started.
	Process *os.Process

	// This it the processes state information about the running process.
	ProcessState *os.ProcessState

	// This is a list of cgroups tasks files that should have the new processes
	// pid written into. This is used to ensure that the new process is a
	// member of a specific set of cgroups. If any of these files can not
	// be written to then the child will not be executed.
	CgroupsTasksFiles []string

	// If this is set to true then the clone cycle will double fork. This
	// leaves the new process as a child of initd but means that Wait()
	// will return only when the first child exits, not the second.
	// If setting this it is best to just use Run().
	DoubleFork bool

	// These are name spaces that should be joined by the cloned child
	// before executing the process. This is either empty, or a string
	// of the form "/proc/123/ns/ipc". Note that its impossible to join
	// a PID name space so its not listed here.
	IPCNameSpace     string
	MountNameSpace   string
	NetworkNameSpace string
	UserNameSpace    string
	UTSNameSpace     string
	PIDNameSpace     string

	// These boolean values are used to let the clone system know that it
	// should use the flags that specifically create new name spaces when
	// creating the child process.
	NewIPCNameSpace     bool
	NewMountNameSpace   bool
	NewNetworkNameSpace bool
	NewPIDNameSpace     bool
	NewUserNameSpace    bool
	NewUTSNameSpace     bool

	// If NewUserNameSpace is set to true then these two fields will allow
	// the user map to be defined in the new user namespace. It is an error
	// to define these if NewUserNameSpace is not true. Leaving these as
	// nil will cause gocloen to not alter the user or group settings in
	// the new namespace.
	//
	// An important note here is that the user namespace does not kick in
	// until a call to setuid() and setgid() takes place. As such you
	// should almost always use UserNameSpace and NewUserNameSpace with
	// SysProcAttr set to some UID and GID.
	UserMap  []MapElement
	GroupMap []MapElement

	// Hostname in net ns
	Hostname string

	// If set to true then the child process will create pseudo
	// devices: tty, zero, null, full, random, urandom
	CreatePseudoDevices bool
	// contains filtered or unexported fields
}

type MapElement struct {
	// This is the UID or GID to use inside of the user namespace.
	Inside uint64

	// This is the UID or GID to use outside of the user namespace.
	Outside uint64

	// This sets how many mappings this should cover.
	Length uint64
}