Documentation
¶
Index ¶
- type Client
- func (c *Client) ApplyNetworkBlockAll(containerIP string) error
- func (c *Client) ClearNetworkRules(containerIP string) error
- func (c *Client) Create(ctx context.Context, req models.CreateSandboxRequest, sandboxID string, ...) (*SandboxRuntime, error)
- func (c *Client) Destroy(ctx context.Context, sandbox *models.Sandbox) error
- func (c *Client) ExecCreate(ctx context.Context, containerID string, cmd []string, env []string, ...) (string, error)
- func (c *Client) ExecInspect(ctx context.Context, execID string) (exitCode int, running bool, err error)
- func (c *Client) ExecResize(ctx context.Context, execID string, height, width int) error
- func (c *Client) ExecStart(ctx context.Context, execID string, tty bool) (*ExecSession, error)
- func (c *Client) Inspect(ctx context.Context, containerRef string) (*SandboxRuntime, error)
- func (c *Client) ListManaged(ctx context.Context) (map[string]*SandboxRuntime, error)
- func (c *Client) Ping(ctx context.Context) error
- func (c *Client) PushAllowedPorts(ctx context.Context, containerIP, toolboxToken string, ports []int) error
- func (c *Client) RemoveImage(ctx context.Context, imageRef string) error
- func (c *Client) Resize(ctx context.Context, containerRef string, req models.ResizeSandboxRequest) error
- func (c *Client) Start(ctx context.Context, containerRef string) (*SandboxRuntime, error)
- func (c *Client) Stop(ctx context.Context, containerRef string) error
- func (c *Client) StreamEvents(ctx context.Context, out chan<- DockerEvent) error
- type DockerEvent
- type ExecSession
- type SandboxRuntime
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
func (*Client) ApplyNetworkBlockAll ¶ added in v0.1.5
ApplyNetworkBlockAll installs the per-IP egress DROP rule. Idempotent — the underlying rule manager checks for an existing match before inserting. Called on Create (initial install), StartSandbox (after a Stop+Start cycle drops the rule on the stop event), and reconcile (to heal after host-side state loss).
func (*Client) ClearNetworkRules ¶
ClearNetworkRules releases any per-IP network rules previously attached to a sandbox. Used by the event-driven path when a container exits or is destroyed out-of-band, since Destroy() handles this for us during normal teardown.
func (*Client) Create ¶
func (c *Client) Create(ctx context.Context, req models.CreateSandboxRequest, sandboxID string, toolboxToken string, hostMounts []mounts.ContainerBind) (*SandboxRuntime, error)
Create provisions and starts a managed container. The caller chooses the sandbox ID up-front; we set it as the container's Docker name so the name is the canonical sandbox identifier end-to-end (the container ID is an internal detail). Host-side mounts are passed as bind sources prepared by the mounts manager; sandboxd never writes a mounts.json into the container.
func (*Client) ExecCreate ¶
func (c *Client) ExecCreate(ctx context.Context, containerID string, cmd []string, env []string, workdir string, tty bool) (string, error)
ExecCreate creates an exec instance attached to the given container. The returned exec ID must be passed to ExecStart to actually run the command.
func (*Client) ExecInspect ¶
func (c *Client) ExecInspect(ctx context.Context, execID string) (exitCode int, running bool, err error)
ExecInspect returns the exit code and running state of an exec instance. Call this after the hijacked stream closes to learn the process exit code.
func (*Client) ExecResize ¶
ExecResize forwards a window-resize event to a running PTY exec.
func (*Client) ExecStart ¶
ExecStart starts a previously-created exec and hijacks the connection so the caller can pipe stdin/stdout directly. The returned ExecSession owns the underlying net.Conn — close it when done.
func (*Client) ListManaged ¶
func (*Client) PushAllowedPorts ¶
func (c *Client) PushAllowedPorts(ctx context.Context, containerIP, toolboxToken string, ports []int) error
PushAllowedPorts updates the toolbox's in-memory allowlist of ports that /proxy/<port>/... is permitted to reach. The list should match the sandbox's currently exposed ports. Best-effort: callers log on failure.
func (*Client) RemoveImage ¶
RemoveImage deletes an image from the local Docker daemon by reference (name:tag or digest). 404 (already gone) and 409 (still in use) are treated as success: the goal is "image is no longer occupying disk on our account", and a 409 means another container raced ahead and started using the image between the caller's eligibility check and this call — leaving it is correct, not an error. Other failures are returned for the caller to log.
func (*Client) StreamEvents ¶
func (c *Client) StreamEvents(ctx context.Context, out chan<- DockerEvent) error
StreamEvents subscribes to Docker's /events feed for managed containers and pushes normalized events to out. It blocks until ctx is cancelled or the stream errors. Callers are expected to reconnect on error.
type DockerEvent ¶
type DockerEvent struct {
ContainerID string
SandboxID string
Action string // "die", "destroy", "oom", "start", "stop"
ExitCode int // populated on "die" when reported by Docker
Time time.Time
}
DockerEvent is a normalized container lifecycle event from the Docker engine, scoped to containers carrying our managed label.
type ExecSession ¶
ExecSession is a hijacked Docker exec stream. With Tty=true the byte stream is unframed (raw); with Tty=false it follows Docker's stdin/stdout/stderr multiplexing. The SSH gateway only uses Tty=true for shells and Tty=false for one-shot exec, where stderr framing isn't decoded — stdout+stderr both reach the SSH client through the merged stream as the SSH side expects.
func (*ExecSession) Close ¶
func (e *ExecSession) Close() error
Close releases the hijacked connection. Idempotent.
type SandboxRuntime ¶
type SandboxRuntime = models.SandboxRuntimeState
SandboxRuntime is the Docker-layer alias of the canonical models.SandboxRuntimeState type. The alias keeps every existing reference in pkg/docker compiling unchanged while letting non-Docker runtime implementations import only pkg/models.
Source Files
Directories