spec

func AddAssignedDevice ¶ added in v0.13.0

func AddAssignedDevice(ctx context.Context, spec *oci.Spec) (err error)

AddAssignedDevice goes through the assigned devices that have been enumerated on the spec and updates the spec so that the correct device nodes can be mounted into the resulting container by the runtime.

GPU devices are skipped, since they are handled in [addNvidiaDeviceHook].

func AddDevSev ¶ added in v0.13.0

func AddDevSev(ctx context.Context, spec *oci.Spec) error

AddDevSev adds SEV device to container spec. On 5.x kernel the device is /dev/sev, however this changed in 6.x where the device is /dev/sev-guest.

func AddLinuxDeviceToSpec ¶ added in v0.13.0

func AddLinuxDeviceToSpec(ctx context.Context, hostDevice *config.Device, spec *oci.Spec, addCgroupDevice bool)

func ApplyAnnotationsToSpec ¶ added in v0.13.0

func ApplyAnnotationsToSpec(ctx context.Context, spec *oci.Spec) error

ApplyAnnotationsToSpec modifies the spec based on additional information from annotations

func GenerateWorkloadContainerNetworkMountsFromRoot ¶ added in v0.15.0

func GenerateWorkloadContainerNetworkMountsFromRoot(sandboxRoot string, spec *oci.Spec) []oci.Mount

GenerateWorkloadContainerNetworkMountsFromRoot generates networking mounts using a pre-resolved sandbox root directory.

func GetGroup ¶ added in v0.15.0

func GetGroup(rootPath string, filter func(user.Group) bool) (user.Group, error)

GetGroup looks up /etc/group file in a container filesystem and returns parsed group

func GetNetworkNamespaceID ¶ added in v0.13.0

func GetNetworkNamespaceID(spec *oci.Spec) string

GetNetworkNamespaceID returns the `ToLower` of `spec.Windows.Network.NetworkNamespace` or `""`.

func GetUser ¶ added in v0.15.0

func GetUser(rootPath string, filter func(user.User) bool) (user.User, error)

GetUser looks up /etc/passwd file in a container filesystem and returns parsed user

func HugePagesMountSource ¶

func HugePagesMountSource(sandboxID, path string) string

HugePagesMountSource returns hugepages mount path inside UVM.

func HugePagesMountSourceFromRoot ¶ added in v0.15.0

func HugePagesMountSourceFromRoot(sandboxRoot, mountPath string) string

HugePagesMountSourceFromRoot resolves a hugepages:// mount source from a given root.

func HugePagesMountsDir ¶

func HugePagesMountsDir(sandboxID string) string

HugePagesMountsDir returns hugepages mounts directory inside UVM.

func IsRootReadonly ¶ added in v0.13.0

func IsRootReadonly(spec *oci.Spec) bool

IsRootReadonly returns `true` if the spec specifies the rootfs is readonly.

func MountPresent ¶

func MountPresent(mountPath string, specMounts []oci.Mount) bool

MountPresent checks if mountPath is present in the specMounts array.

func OutOfUint32Bounds ¶ added in v0.13.0

func OutOfUint32Bounds(v int) bool

func SandboxHugePagesMountsDirFromRoot ¶ added in v0.15.0

func SandboxHugePagesMountsDirFromRoot(sandboxRoot string) string

SandboxHugePagesMountsDirFromRoot returns the hugepages directory for a given root.

func SandboxLogsDirFromRoot ¶ added in v0.15.0

func SandboxLogsDirFromRoot(sandboxRoot string) string

SandboxLogsDirFromRoot returns the logs directory for a given root.

func SandboxMountSource ¶

func SandboxMountSource(sandboxID, path string) string

SandboxMountSource returns sandbox mount path inside UVM.

func SandboxMountSourceFromRoot ¶ added in v0.15.0

func SandboxMountSourceFromRoot(sandboxRoot, mountPath string) string

SandboxMountSourceFromRoot resolves a sandbox:// mount source from a given root.

func SandboxMountsDir ¶

func SandboxMountsDir(sandboxID string) string

SandboxMountsDir returns sandbox mounts directory inside UVM/host.

func SandboxMountsDirFromRoot ¶ added in v0.15.0

func SandboxMountsDirFromRoot(sandboxRoot string) string

SandboxMountsDirFromRoot returns the sandbox mounts directory for a given root.

func SandboxRootDir ¶

func SandboxRootDir(sandboxID string) string

SandboxRootDir returns the sandbox container root directory inside UVM/host.

func SandboxTmpfsMountSource ¶ added in v0.15.0

func SandboxTmpfsMountSource(sandboxID, path string) string

SandboxTmpfsMountSource returns sandbox tmpfs mount path inside UVM.

func SandboxTmpfsMountSourceFromRoot ¶ added in v0.15.0

func SandboxTmpfsMountSourceFromRoot(sandboxRoot, mountPath string) string

SandboxTmpfsMountSourceFromRoot resolves a sandbox-tmp:// mount source from a given root.

func SandboxTmpfsMountsDir ¶ added in v0.15.0

func SandboxTmpfsMountsDir(sandboxID string) string

SandboxTmpfsMountsDir returns sandbox tmpfs mounts directory inside UVM.

func SandboxTmpfsMountsDirFromRoot ¶ added in v0.15.0

func SandboxTmpfsMountsDirFromRoot(sandboxRoot string) string

SandboxTmpfsMountsDirFromRoot returns the sandbox tmpfs mounts directory for a given root.

func SetCoreRLimit ¶ added in v0.13.0

func SetCoreRLimit(spec *oci.Spec, value string) error

func SetUserStr ¶ added in v0.13.0

func SetUserStr(spec *oci.Spec, userstr string) error

SetUserStr sets `spec.Process` to the valid `userstr` based on the OCI Image Spec v1.0.0 `userstr`.

Valid values are: user, uid, user:group, uid:gid, uid:group, user:gid. If uid is provided instead of the username then that value is not checked against the /etc/passwd file to verify if the user with given uid actually exists.

Since UID and GID are parsed as ints, but will ultimately end up as uint32 in the OCI spec, an error is returned if the the IDs are not within the uint32 bounds ([0, math.MathUint32]). This avoid unexpected results if the ID is first parsed as an int and then overflows around when downcast (eg, math.MaxUint32 + 1 will become 0). Notes:

• Per the Go spec, we have no indication of overflow when converting between integer types.
• "man 5 passwd" and "man 5 group" (as well as user.ParsePasswdFileFilter and [user.ParseGroupFilter)) do not specify any limits on the UID and GID range.