sshgateway

type Config struct {
	ListenAddr     string
	HostKeyPath    string
	AcceptDeadline time.Duration
	// ToolboxPort is the in-container HTTP port toolboxd listens on. Used by
	// session-attach mode to dial the WebSocket directly. If zero, session
	// mode is disabled and the gateway falls back to one-shot exec.
	ToolboxPort int
	// RemoteAPIBaseURL enables cross-node SSH routing. When non-empty (cluster
	// mode), a connection for a sandbox NOT owned by this node is authenticated
	// against the owner's authoritative key and its session is bridged through
	// this node's own v1 API, which clusterForwardWrap reverse-proxies to the
	// owner over the cert-pinned mTLS channel. Empty (single-node) disables the
	// remote path entirely — behaviour is byte-for-byte the pre-cluster gateway.
	// Conventionally the loopback API address, e.g. "http://127.0.0.1:8080".
	RemoteAPIBaseURL string
	// RemoteAPIToken is the PAT presented on the loopback v1 call. Only used
	// when RemoteAPIBaseURL is set.
	RemoteAPIToken string
	// ContainerEngine is the host runtime engine ("docker" | "containerd").
	// On containerd, sandboxes are containerd tasks (not docker containers), so
	// the docker-exec one-shot path cannot reach them — the gateway runs the
	// command through the in-container toolbox session instead. Empty defaults
	// to the docker behaviour.
	ContainerEngine string
}

type DockerExec interface {
	ExecCreate(ctx context.Context, containerID string, cmd []string, env []string, workdir string, tty bool) (string, error)
	ExecStart(ctx context.Context, execID string, tty bool) (*docker.ExecSession, error)
	ExecResize(ctx context.Context, execID string, height, width int) error
	ExecInspect(ctx context.Context, execID string) (exitCode int, running bool, err error)
}

type Gateway struct {
	// contains filtered or unexported fields
}

type SandboxLookup interface {
	GetSandbox(ctx context.Context, id string) (*models.Sandbox, error)
	TouchSandbox(ctx context.Context, id string) error
}