container

type BindMount struct {
	Source      string
	Destination string
}

type Capabilities struct {
	Networking bool
	Add        []string // List of kernel capabilities to add to the container.
	Drop       []string // List of kernel capabilities to drop from the container.
}

type Config struct {
	PackageName              string
	Mounts                   []BindMount
	Capabilities             Capabilities
	Environment              map[string]string
	ImgRef                   string
	PodID                    string
	Arch                     apko_types.Architecture
	RunAsUID                 string
	RunAs                    string
	WorkspaceDir             string
	CacheDir                 string
	CPU, CPUModel, Memory    string
	SSHKey                   ssh.Signer
	SSHAddress               string             // SSH address for the build / chrooted environment
	SSHControlAddress        string             // SSH address for the control / management environment
	SSHHostKey               string             // Path to known_hosts file containing the VM's host key
	VMHostKeySigner          ssh.Signer         // VM's SSH host key (private signer)
	VMHostKeyPublic          ssh.PublicKey      // VM's SSH host key (public) - for verification
	VMHostKeyPrivateKeyBytes []byte             // VM's SSH host key (raw private key bytes) - for injection
	VMHostKeyPrivate         ed25519.PrivateKey // VM's SSH host key (raw private key) - for explicit zeroing
	InitramfsPath            string             // Path to temp initramfs file (contains sensitive key material)
	Disk                     string
	Timeout                  time.Duration
	SSHBuildClient           *ssh.Client // SSH client for the build environment, may not have privileges
	SSHControlBuildClient    *ssh.Client // SSH client for control operations in the build environment, has privileges
	SSHControlClient         *ssh.Client // SSH client for unrestricted control environment, has privileges
	QemuPID                  int
	RunAsGID                 string

	// Virtiofs-related fields for cache directory
	VirtiofsEnabled     bool   // Whether virtiofs is enabled for cache
	VirtiofsdPID        int    // PID of virtiofsd daemon for cleanup
	VirtiofsdSocketPath string // Path to Unix socket for virtiofsd
}

type Debugger interface {
	Debug(ctx context.Context, cfg *Config, envOverride map[string]string, cmd ...string) error
}

type Loader interface {
	LoadImage(ctx context.Context, layer v1.Layer, arch apko_types.Architecture, bc *apko_build.Context) (ref string, err error)
	RemoveImage(ctx context.Context, ref string) error
}

type MicrovmConfig struct {
	Package            string   // Main init package (default: "microvm-init")
	Repositories       []string // APK repositories
	AdditionalPackages []string // Extra packages to include
	ExtraKeys          []string // Extra keys for APK signature verification
}

type Runner interface {
	Close() error
	Name() string
	TestUsability(ctx context.Context) bool
	// OCIImageLoader returns a Loader that will load an OCI image from a stream.
	// It should return the Loader, which will be used to load the provided image
	// as a tar stream into the Loader. That image will be used as the root when StartPod() the container.
	OCIImageLoader() Loader
	StartPod(ctx context.Context, cfg *Config) error
	Run(ctx context.Context, cfg *Config, envOverride map[string]string, cmd ...string) error
	TerminatePod(ctx context.Context, cfg *Config) error
	// TempDir returns the base for temporary directory, or "" if whatever is provided by the system is fine
	TempDir() string
	// WorkspaceTar returns an io.ReadCloser that can be used to read the status of the workspace.
	// The io.ReadCloser itself is a tar stream, which can be written to an io.Writer as is,
	// or passed to an fs.FS processor
	WorkspaceTar(ctx context.Context, cfg *Config, extraFiles []string) (io.ReadCloser, error)
	// GetReleaseData returns the release data for the container's OS (os-release)
	GetReleaseData(ctx context.Context, cfg *Config) (*apko_build.ReleaseData, error)
}