Documentation
¶
Overview ¶
Package rootless implements a daemon-free container runtime for YAP using go-containerregistry for image pulls and rootlesskit for isolated execution.
Index ¶
- func MaybeRunAsChild()
- func PullImage(distro string) error
- func RootfsDir(distro string) (string, error)
- func RootfsExists(distro string) (bool, error)
- func RunInRootless(distro, workDir string, args []string) error
- type Runtime
- func (r *Runtime) Pull(distro string) error
- func (r *Runtime) Run(distro, workDir string, args []string) error
- func (r *Runtime) RunShell(distro, workDir, shellCmd string) error
- func (r *Runtime) RunShellCapture(_ context.Context, distro, workDir, shellCmd string, env map[string]string, ...) error
- func (r *Runtime) Type() runtimetype.RuntimeType
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MaybeRunAsChild ¶
func MaybeRunAsChild()
MaybeRunAsChild checks whether the current process was re-executed as the rootlesskit child. If so, it completes the child initialisation and runs the target command inside the new user namespace, then exits.
Call this as early as possible in main(), before cobra runs.
func PullImage ¶
PullImage pulls the YAP builder image for distro from the registry (no CLI required) and extracts it to a local rootfs directory.
func RootfsExists ¶
RootfsExists returns true if a rootfs has already been extracted for distro.
func RunInRootless ¶
RunInRootless runs args inside the distro rootfs using rootlesskit for user-namespace isolation. workDir is bind-mounted as /project.
Types ¶
type Runtime ¶
type Runtime struct{}
Runtime implements the container.Runtime interface using in-process image pull and rootlesskit for user-namespace isolation.
func (*Runtime) Run ¶
Run executes args inside the distro rootfs with workDir bind-mounted as /workspace. args are the bare sub-command + flags (no binary name), matching the CLI runtime contract; the image ENTRYPOINT (yap) is prepended here.
func (*Runtime) RunShellCapture ¶ added in v2.2.0
func (r *Runtime) RunShellCapture(_ context.Context, distro, workDir, shellCmd string, env map[string]string, _ io.Writer, ) error
RunShellCapture is a best-effort variant: the rootless runner uses rootlesskit's parent.Parent loop which writes directly to the host stdio, so we cannot redirect output without rewiring that pipeline. We log a warning and fall through to RunShell — callers still get a correct success/failure signal, just no captured stream.
env is forwarded to the child via os.Setenv/Unsetenv around the rootlesskit invocation; values therefore never appear in the shell argv (no `ps`/`/proc/<pid>/cmdline` leak) — the same invariant the CLI backend honours via `-e KEY=VAL`. We restore any pre-existing values so concurrent callers in the same process don't observe stale state.
ctx is accepted for interface compatibility but is not propagated into rootlesskit's parent loop; cancellation is observed only at the next process boundary.
func (*Runtime) Type ¶
func (r *Runtime) Type() runtimetype.RuntimeType
Type returns the runtime type identifier.
Source Files