oci

type Arch string

type Config struct {
	ID            string
	Hostname      string
	Args          []string
	Env           []string
	Cwd           string
	User          string
	Tty           bool
	Privileged    bool
	ReadOnly      bool
	NetworkMode   string
	Labels        map[string]string
	Annotations   map[string]string
	Mounts        []MountConfig
	Ports         []PortConfig
	DNS           []string
	DNSSearch     []string
	DNSOptions    []string
	ExtraHosts    []string
	CapAdd        []string
	CapDrop       []string
	SecurityOpt   []string
	Sysctls       map[string]string
	Resources     *ResourceConfig
	StopSignal    string
	Init          bool
	RestartPolicy string
	Runtime       string
	ImageRef      string
	ImageConfig   *ImageConfig
	Platform      string
}

type Hook struct {
	Path    string   `json:"path"`
	Args    []string `json:"args,omitempty"`
	Env     []string `json:"env,omitempty"`
	Timeout *int     `json:"timeout,omitempty"`
}

type Hooks struct {
	// Prestart is a list of hooks to run before the container process starts.
	Prestart []Hook `json:"prestart,omitempty"`

	// CreateRuntime is a list of hooks to run after the container is created.
	CreateRuntime []Hook `json:"createRuntime,omitempty"`

	// CreateContainer is a list of hooks to run during container creation.
	CreateContainer []Hook `json:"createContainer,omitempty"`

	// StartContainer is a list of hooks to run when the container starts.
	StartContainer []Hook `json:"startContainer,omitempty"`

	// Poststart is a list of hooks to run after the container process starts.
	Poststart []Hook `json:"poststart,omitempty"`

	// Poststop is a list of hooks to run after the container process stops.
	Poststop []Hook `json:"poststop,omitempty"`
}

type ImageConfig struct {
	Entrypoint []string
	Cmd        []string
	Env        []string
	WorkingDir string
	User       string
	Volumes    map[string]struct{}
	Labels     map[string]string
	StopSignal string
	Shell      []string
}

type Linux struct {
	// Namespaces configures Linux namespaces.
	Namespaces []LinuxNamespace `json:"namespaces,omitempty"`

	// UIDMappings configures user namespace UID mappings.
	UIDMappings []LinuxIDMapping `json:"uidMappings,omitempty"`

	// GIDMappings configures user namespace GID mappings.
	GIDMappings []LinuxIDMapping `json:"gidMappings,omitempty"`

	// Devices configures device nodes in the container.
	Devices []LinuxDevice `json:"devices,omitempty"`

	// CgroupsPath is the path to the cgroup.
	CgroupsPath string `json:"cgroupsPath,omitempty"`

	// Resources configures cgroup resources.
	Resources *LinuxResources `json:"resources,omitempty"`

	// Seccomp configures the seccomp profile.
	Seccomp *LinuxSeccomp `json:"seccomp,omitempty"`

	// RootfsPropagation sets the rootfs propagation mode.
	RootfsPropagation string `json:"rootfsPropagation,omitempty"`

	// MaskedPaths masks paths inside the container.
	MaskedPaths []string `json:"maskedPaths,omitempty"`

	// ReadonlyPaths makes paths read-only inside the container.
	ReadonlyPaths []string `json:"readonlyPaths,omitempty"`

	// MountLabel is the SELinux mount label.
	MountLabel string `json:"mountLabel,omitempty"`

	// IntelRdt configures Intel RDT/CAT.
	IntelRdt *LinuxIntelRdt `json:"intelRdt,omitempty"`

	// Personality configures the execution domain.
	Personality *LinuxPersonality `json:"personality,omitempty"`

	// TimeOffsets configures time namespace offsets.
	TimeOffsets map[string]LinuxTimeOffset `json:"timeOffsets,omitempty"`

	// Sysctl configures kernel parameters.
	Sysctl map[string]string `json:"sysctl,omitempty"`

	// Unified configures unified cgroup v2 key-value pairs.
	Unified map[string]string `json:"unified,omitempty"`
}

type LinuxBlockIO struct {
	Weight            *uint16               `json:"weight,omitempty"`
	LeafWeight        *uint16               `json:"leafWeight,omitempty"`
	WeightDevice      []LinuxWeightDevice   `json:"weightDevice,omitempty"`
	ThrottleRead      []LinuxThrottleDevice `json:"throttleReadBpsDevice,omitempty"`
	ThrottleWrite     []LinuxThrottleDevice `json:"throttleWriteBpsDevice,omitempty"`
	ThrottleReadIOPS  []LinuxThrottleDevice `json:"throttleReadIOPSDevice,omitempty"`
	ThrottleWriteIOPS []LinuxThrottleDevice `json:"throttleWriteIOPSDevice,omitempty"`
}

type LinuxCPU struct {
	Shares          *uint64 `json:"shares,omitempty"`
	Quota           *int64  `json:"quota,omitempty"`
	Period          *uint64 `json:"period,omitempty"`
	RealtimeRuntime *int64  `json:"realtimeRuntime,omitempty"`
	RealtimePeriod  *uint64 `json:"realtimePeriod,omitempty"`
	Cpus            string  `json:"cpus,omitempty"`
	Mems            string  `json:"mems,omitempty"`
}

type LinuxCapabilities struct {
	Bounding    []string `json:"bounding,omitempty"`
	Effective   []string `json:"effective,omitempty"`
	Inheritable []string `json:"inheritable,omitempty"`
	Permitted   []string `json:"permitted,omitempty"`
	Ambient     []string `json:"ambient,omitempty"`
}

type LinuxDevice struct {
	// Path is the device path inside the container.
	Path string `json:"path"`

	// Type is the device type (c, b, u, p).
	Type string `json:"type,omitempty"`

	// Major is the device major number.
	Major int64 `json:"major"`

	// Minor is the device minor number.
	Minor int64 `json:"minor"`

	// FileMode is the file mode of the device (e.g., 0666).
	FileMode *uint32 `json:"fileMode,omitempty"`

	// UID is the device owner UID.
	UID *uint32 `json:"uid,omitempty"`

	// GID is the device owner GID.
	GID *uint32 `json:"gid,omitempty"`
}

type LinuxDeviceCgroup struct {
	Allow  bool   `json:"allow"`
	Type   string `json:"type,omitempty"`
	Major  *int64 `json:"major,omitempty"`
	Minor  *int64 `json:"minor,omitempty"`
	Access string `json:"access,omitempty"`
}

type LinuxHugepageLimit struct {
	Pagesize string `json:"pagesize"`
	Limit    int64  `json:"limit"`
}

type LinuxIDMapping struct {
	ContainerID uint32 `json:"containerID"`
	HostID      uint32 `json:"hostID"`
	Size        uint32 `json:"size"`
}

type LinuxIntelRdt struct {
	ClosID        string `json:"closID,omitempty"`
	L3CacheSchema string `json:"l3CacheSchema,omitempty"`
	MemBwSchema   string `json:"memBwSchema,omitempty"`
}

type LinuxInterfacePriority struct {
	Name     string `json:"name"`
	Priority uint32 `json:"priority"`
}

type LinuxMemory struct {
	Limit            *int64  `json:"limit,omitempty"`
	Reservation      *int64  `json:"reservation,omitempty"`
	Swap             *int64  `json:"swap,omitempty"`
	Kernel           *int64  `json:"kernel,omitempty"`
	KernelTCP        *int64  `json:"kernelTCP,omitempty"`
	Swappiness       *uint64 `json:"swappiness,omitempty"`
	DisableOOMKiller *bool   `json:"disableOOMKiller,omitempty"`
	UseHierarchy     *bool   `json:"useHierarchy,omitempty"`
}

type LinuxNamespace struct {
	// Type is the namespace type.
	Type LinuxNamespaceType `json:"type"`

	// Path is the path to join an existing namespace.
	Path string `json:"path,omitempty"`
}

type LinuxNamespaceType string

type LinuxNetwork struct {
	ClassID    *uint32                  `json:"classID,omitempty"`
	Priorities []LinuxInterfacePriority `json:"priorities,omitempty"`
}

type LinuxPersonality struct {
	Domain string   `json:"domain"`
	Flags  []string `json:"flags,omitempty"`
}

type LinuxPids struct {
	Limit int64 `json:"limit"`
}

type LinuxRdma struct {
	HcaHandles *uint32 `json:"hcaHandles,omitempty"`
	HcaObjects *uint32 `json:"hcaObjects,omitempty"`
}

type LinuxResources struct {
	Devices        []LinuxDeviceCgroup  `json:"devices,omitempty"`
	Memory         *LinuxMemory         `json:"memory,omitempty"`
	CPU            *LinuxCPU            `json:"cpu,omitempty"`
	Pids           *LinuxPids           `json:"pids,omitempty"`
	BlockIO        *LinuxBlockIO        `json:"blockIO,omitempty"`
	HugepageLimits []LinuxHugepageLimit `json:"hugepageLimits,omitempty"`
	Network        *LinuxNetwork        `json:"network,omitempty"`
	Rdma           map[string]LinuxRdma `json:"rdma,omitempty"`
}

type LinuxSeccomp struct {
	DefaultAction LinuxSeccompAction `json:"defaultAction"`
	Architectures []Arch             `json:"architectures,omitempty"`
	Syscalls      []LinuxSyscall     `json:"syscalls,omitempty"`
	Flags         []string           `json:"flags,omitempty"`
}

type LinuxSeccompAction string

type LinuxSeccompArg struct {
	Index    uint           `json:"index"`
	Value    uint64         `json:"value"`
	ValueTwo uint64         `json:"valueTwo,omitempty"`
	Op       LinuxSeccompOp `json:"op"`
}

type LinuxSeccompOp string

type LinuxSyscall struct {
	Names   []string           `json:"names"`
	Action  LinuxSeccompAction `json:"action"`
	Args    []LinuxSeccompArg  `json:"args,omitempty"`
	Comment string             `json:"comment,omitempty"`
}

type LinuxThrottleDevice struct {
	Major int64  `json:"major"`
	Minor int64  `json:"minor"`
	Rate  uint64 `json:"rate"`
}

type LinuxTimeOffset struct {
	Secs     int64  `json:"secs"`
	Nanosecs uint32 `json:"nanosecs,omitempty"`
}

type LinuxWeightDevice struct {
	Major      int64   `json:"major"`
	Minor      int64   `json:"minor"`
	Weight     *uint16 `json:"weight,omitempty"`
	LeafWeight *uint16 `json:"leafWeight,omitempty"`
}

type Mount struct {
	// Destination is the mount path inside the container.
	Destination string `json:"destination"`

	// Type is the filesystem type (e.g., "proc", "sysfs", "tmpfs", "bind").
	Type string `json:"type,omitempty"`

	// Source is the source path for bind mounts.
	Source string `json:"source,omitempty"`

	// Options are mount options.
	Options []string `json:"options,omitempty"`
}

type MountConfig struct {
	Type     string
	Source   string
	Target   string
	ReadOnly bool
}

type POSIXRlimit struct {
	Type string `json:"type"`
	Hard uint64 `json:"hard"`
	Soft uint64 `json:"soft"`
}

type PortConfig struct {
	PrivatePort uint16
	PublicPort  uint16
	Type        string
}

type Process struct {
	// Terminal specifies whether to allocate a pseudo-TTY.
	Terminal bool `json:"terminal,omitempty"`

	// User specifies the user information for the process.
	User User `json:"user"`

	// Args is the command to run. The first element is the binary path.
	Args []string `json:"args"`

	// Entrypoint is the entrypoint of the container (from image).
	Entrypoint []string `json:"entrypoint,omitempty"`

	// Cmd is the default arguments (from image).
	Cmd []string `json:"cmd,omitempty"`

	// Env sets environment variables for the process.
	Env []string `json:"env,omitempty"`

	// Cwd is the working directory for the process.
	Cwd string `json:"cwd"`

	// Capabilities configures Linux capabilities.
	Capabilities *LinuxCapabilities `json:"capabilities,omitempty"`

	// Rlimits configures POSIX rlimits.
	Rlimits []POSIXRlimit `json:"rlimits,omitempty"`

	// NoNewPrivileges prevents the process from gaining privileges.
	NoNewPrivileges bool `json:"noNewPrivileges,omitempty"`

	// ApparmorProfile is the AppArmor profile to apply.
	ApparmorProfile string `json:"apparmorProfile,omitempty"`

	// OOMScoreAdj adjusts the OOM killer score.
	OOMScoreAdj *int `json:"oomScoreAdj,omitempty"`

	// SelinuxLabel is the SELinux process label.
	SelinuxLabel string `json:"selinuxLabel,omitempty"`
}

type ResourceConfig struct {
	CPUShares      int64
	Memory         int64
	MemorySwap     int64
	NanoCpus       int64
	CPUPeriod      int64
	CPUQuota       int64
	CpusetCpus     string
	CpusetMems     string
	PidsLimit      int64
	BlkioWeight    uint16
	OomKillDisable bool
	ShmSize        int64
}

type Root struct {
	// Path is the path to the root filesystem.
	Path string `json:"path"`

	// Readonly makes the root filesystem read-only.
	Readonly bool `json:"readonly,omitempty"`
}

type Spec struct {
	// Version is the OCI runtime spec version.
	Version string `json:"ociVersion"`

	// Process configures the container process.
	Process *Process `json:"process,omitempty"`

	// Root configures the container's root filesystem.
	Root *Root `json:"root,omitempty"`

	// Hostname is the container's hostname.
	Hostname string `json:"hostname,omitempty"`

	// Mounts configures additional mounts.
	Mounts []Mount `json:"mounts,omitempty"`

	// Hooks configures lifecycle hooks.
	Hooks *Hooks `json:"hooks,omitempty"`

	// Annotations contains arbitrary metadata.
	Annotations map[string]string `json:"annotations,omitempty"`

	// Linux is platform-specific configuration for Linux-based containers.
	Linux *Linux `json:"linux,omitempty"`
}

type User struct {
	// UID is the user ID.
	UID uint32 `json:"uid"`

	// GID is the group ID.
	GID uint32 `json:"gid"`

	// Umask is the file mode creation mask.
	Umask *uint32 `json:"umask,omitempty"`

	// AdditionalGids are additional group IDs.
	AdditionalGids []uint32 `json:"additionalGids,omitempty"`
}

type ValidationError struct {
	Field   string
	Message string
}

type ValidationErrors []*ValidationError