container

type Builder struct {
	// Root is container root mount path, empty uses current work path
	Root string

	// TmpRoot defines the tmp dir pattern if not nil. Temp directory will be created as container root dir
	TmpRoot string

	// Mounts defines container mount points, empty uses default mounts
	Mounts []mount.Mount

	// SymbolicLinks defines symlinks to be created after mount file system
	SymbolicLinks []SymbolicLink

	// MaskPaths defines paths to be masked to avoid reading information from
	// outside of the container
	MaskPaths []string

	// WorkDir defines container default work directory (default: /w)
	WorkDir string

	// Stderr defines whether to dup container stderr to stderr for debug
	Stderr io.Writer

	// ExecFile defines executable that called Init, otherwise defer current
	// executable (/proc/self/exe)
	ExecFile string

	// CredGenerator defines a credential generator used to create new container
	CredGenerator CredGenerator

	// Clone flags defines unshare clone flag to create container
	CloneFlags uintptr

	// HostName set container hostname (default: go-sandbox)
	HostName string

	// DomainName set container domainname (default: go-sandbox)
	DomainName string

	// InitCommand defines command that runs after the initialization of the container
	// to do additional setups (for example, loopback network)
	InitCommand []string

	// ContainerUID & ContainerGID set the container uid / gid mapping
	ContainerUID int
	ContainerGID int
}

type CredGenerator interface {
	Get() syscall.Credential
}

type Environment interface {
	Ping() error
	Open([]OpenCmd) ([]*os.File, error)
	Delete(p string) error
	Reset() error
	Execve(context.Context, ExecveParam) runner.Result
	Destroy() error
}

type ExecveParam struct {
	// Args holds command line arguments
	Args []string

	// Env specifies the environment of the process
	Env []string

	// Files specifies file descriptors for the child process
	Files []uintptr

	// ExecFile specifies file descriptor for executable file using fexecve
	ExecFile uintptr

	// RLimits specifies POSIX Resource limit through setrlimit
	RLimits []rlimit.RLimit

	// Seccomp specifies seccomp filter
	Seccomp seccomp.Filter

	// CTTY specifies whether to set controlling TTY
	CTTY bool

	// SyncFunc calls with pid just before execve (for attach the process to cgroups)
	SyncFunc func(pid int) error
}

type OpenCmd struct {
	Path string
	Flag int
	Perm os.FileMode
}

type SymbolicLink struct {
	LinkPath string
	Target   string
}