exposure

type Chain struct {
	// Readable is false when the chain could not be read; Reason says why.
	Readable bool
	Reason   string
	Rules    []ChainRule
}

type ChainRule struct {
	Raw           string
	Proto         string
	DPort         int
	OrigDPort     int
	Source        string
	SourceNegated bool
	Target        string
	Comment       string
	Complex       bool
}

type Class string

type Container struct {
	ID      string
	Name    string
	Image   string
	Owner   Owner
	Ports   []PortBinding
	Running bool
}

type Finding struct {
	Container     string    `json:"container"`
	Image         string    `json:"image"`
	Owner         Owner     `json:"owner"`
	ImageKind     ImageKind `json:"image_kind"`
	Protocol      string    `json:"protocol"`
	HostPort      int       `json:"host_port"`
	ContainerPort int       `json:"container_port"`
	Binds         []string  `json:"binds"`
	Class         Class     `json:"class"`
	Severity      Severity  `json:"severity"`
	// AllowedSources lists the sources a matching rule lets through, when Class is restricted.
	AllowedSources []string `json:"allowed_sources,omitempty"`
	// Rules are the matching DOCKER-USER rules, verbatim.
	Rules []string `json:"rules,omitempty"`
	// Managed is true when the matching rule is one this platform created.
	Managed        bool   `json:"managed"`
	Explanation    string `json:"explanation"`
	Recommendation string `json:"recommendation,omitempty"`
	// CanRestrict is false when this audit cannot offer the guided fix, with the reason.
	CanRestrict       bool   `json:"can_restrict"`
	CannotRestrictWhy string `json:"cannot_restrict_reason,omitempty"`
}

type ImageKind string

type Manager struct {
	// contains filtered or unexported fields
}

type Owner struct {
	Kind OwnerKind `json:"kind"`
	Name string    `json:"name,omitempty"`
	// Intentional is true when the operator explicitly asked for public
	// access (a database's PubliclyAccessible, an app's public bind).
	Intentional bool `json:"intentional,omitempty"`
}

type OwnerKind string

type Plan struct {
	Commands []string `json:"commands"`
	Drops    string   `json:"drops"`
	Tag      string   `json:"tag"`
	// Persistence says plainly how long the rules last.
	Persistence string `json:"persistence"`
}

type PortBinding struct {
	HostIP        string
	HostPort      int
	ContainerPort int
	Protocol      string
}

type Restriction struct {
	Port     int      `json:"port"`
	Protocol string   `json:"protocol"`
	Allow    []string `json:"allow"`
}

type Runner func(ctx context.Context, name string, args ...string) ([]byte, error)

type Severity string

type SyncResult struct {
	Applied int
	Removed int
	Errors  []string
}

type Verdict struct {
	Class   Class
	Allowed []string
	Rules   []string
	Managed bool
	Reason  string
}