dockerguard

type BootConfig struct {
	// DataDir holds the socket and settings file and is itself protected.
	DataDir string
	// ExtraProtected are further host paths no bind may cover.
	ExtraProtected []string
	// ResolveSymlinks is false when this process does not share the
	// daemon's view of the host filesystem.
	ResolveSymlinks bool
	Sink            Sink
	Logger          *slog.Logger
	Lookup          func(string) (string, bool)
}

type Booted struct {
	Server     *Server
	Controller *Controller
	Grants     *Grants
	Host       string
}

type Config struct {
	Mode     Mode
	Upstream string // Unix socket path of the real daemon
	Policy   Policy
	Grants   *Grants
	Tunables Tunables
	// Sink receives every decision worth an audit row; may be nil.
	Sink   Sink
	Logger *slog.Logger
}

type Controller struct {
	// contains filtered or unexported fields
}

type Decision struct {
	Mode       Mode
	Denied     bool
	Method     string
	Path       string
	Pattern    string
	Container  string
	Violations []Violation
	At         time.Time
}

type FileSink struct {
	// contains filtered or unexported fields
}

type Grants struct {
	// contains filtered or unexported fields
}

type Guard struct {
	// contains filtered or unexported fields
}

type Mode string

type Policy struct {
	// AllowedCaps may appear in CapAdd on any container: the hardening
	// profile's minimal set plus operator extras.
	AllowedCaps []string
	// SensitivePaths are host paths no bind may cover, on top of
	// internal/bindmount.ForbiddenPaths.
	SensitivePaths []string
	// AllowHostNetwork lets a create declared with host networking through.
	AllowHostNetwork bool
	// ResolveSymlinks checks a bind's resolved host path too. Off when this
	// process cannot see the host filesystem (the agent in a container).
	ResolveSymlinks bool
}

type PrivilegeSource interface {
	Runtime() docker.RuntimeInfo
	DaemonSecurity(ctx context.Context) (docker.DaemonSecurity, error)
}

type Risk string

type RuleCount struct {
	Rule      string    `json:"rule"`
	Denied    int64     `json:"denied"`
	WouldDeny int64     `json:"would_deny"`
	LastSeen  time.Time `json:"last_seen"`
	// LastPath is the most recent canonical path, never a body.
	LastPath string `json:"last_path"`
}

type Server struct {
	Guard  *Guard
	Socket string
	// contains filtered or unexported fields
}

type Settings struct {
	Mode Mode `json:"mode,omitempty"`
	// AuditSince is when the guard started observing in audit mode without a
	// break, so the feed can tell a week of clean observation from a fresh start.
	AuditSince time.Time `json:"audit_since,omitempty"`
	// LastRunMode is the mode the guard actually ran in at the last boot or live switch.
	LastRunMode Mode      `json:"last_run_mode,omitempty"`
	UpdatedAt   time.Time `json:"updated_at,omitempty"`
	UpdatedBy   string    `json:"updated_by,omitempty"`
}

type Sink interface {
	RecordDecision(ctx context.Context, d Decision) error
}

type Stats struct {
	// contains filtered or unexported fields
}

type Status struct {
	// Mode is the configured mode, Running whether the socket is up, and
	// Effective what the running guard does now.
	Mode            Mode        `json:"mode"`
	Source          string      `json:"source"`
	Effective       Mode        `json:"effective"`
	Running         bool        `json:"running"`
	Socket          string      `json:"socket,omitempty"`
	Upstream        string      `json:"upstream,omitempty"`
	RestartRequired bool        `json:"restart_required"`
	ConfigError     string      `json:"config_error,omitempty"`
	StartError      string      `json:"start_error,omitempty"`
	AuditSince      time.Time   `json:"audit_since,omitempty"`
	SinceBoot       []RuleCount `json:"since_boot"`
	Rules           []string    `json:"rules"`
}

type Tunables struct {
	MaxBodyBytes     int64
	AuditDedup       time.Duration
	SummaryWindow    time.Duration
	HeaderTimeout    time.Duration
	RecordQueue      int
	AllowHostNetwork bool
}

type Violation struct {
	Rule   string `json:"rule"`
	Reason string `json:"reason"`
}