oci

type BuildRequest struct {
	ImageRef   string
	OutPath    string
	MinSizeMiB int
	// Tag is the OCI tag to apply inside the staging layout. Almost
	// always "latest" — kept as a knob because skopeo's docker://
	// transport sometimes needs the tag explicitly when the source ref
	// doesn't carry one.
	Tag string
	// InjectFiles are host-provided files written into the unpacked rootfs
	// AFTER umoci and BEFORE mkfs, so they become part of the ext4 image.
	// The Firecracker cold-boot path uses this to bake the in-guest agent
	// (toolboxd), its init shim, and the per-sandbox token into an
	// otherwise-stock OCI image — a plain image has no agent, so without
	// this the guest boots with nothing listening on vsock (see
	// internal/runtime/firecracker cold-boot agent injection). Empty for
	// template builds, which expect the operator's image to already carry
	// an init that brings the agent up.
	InjectFiles []InjectFile
}

type Builder struct {
	// contains filtered or unexported fields
}

type Config struct {
	// SkopeoBin: path to `skopeo`. Pulls the OCI image. Apt/yum/brew
	// install ship skopeo as a static binary; the daemon does NOT
	// expect a Skopeo daemon.
	SkopeoBin string
	// UmociBin: path to `umoci`. Unpacks OCI layout into a bundle.
	UmociBin string
	// Mkfs4Bin: path to `mkfs.ext4` (from e2fsprogs). Builds the
	// single-file ext4 image from the unpacked rootfs.
	Mkfs4Bin string
	// WorkDir: the parent directory under which per-build staging trees
	// live. Each Builder.Build call creates a fresh subdirectory here.
	// Should be on a filesystem with at least 2x the largest image size
	// in free space (skopeo + umoci both materialize layers).
	WorkDir string
}

type InjectFile struct {
	HostPath  string
	Content   []byte
	GuestPath string
	Mode      os.FileMode
}

type Result struct {
	RootfsPath string
	StagingDir string
	SizeBytes  int64
}