internal/

Package actorlog provides structured JSON logging for actor sandboxes shared by the gVisor and micro-VM ateom runtimes.

Package ateapiauth authenticates clients of the ateapi gRPC server, and provides a matching client dial helper.

Package ateattr is the single source of truth for substrate's ate.* telemetry attributes: the identity keys stamped on spans/logs, and the bounded value sets used as metric labels.

Package atelet contains shared constants and definitions that are used across Substrate components related to atelet.

Package ateletdial connects a worker Pod to the atelet on its own node over the node-local socket, authenticating both ends by Pod certificate.

Package ateomcapacity reports what an ateom can supply to the actors it hosts.

Package ateomnet provides shared networking configuration logic for Substrate runtime agents.

Ateom and atelet need to agree on many filesystem paths.

Package ateomstats holds the pieces both ateom runtimes need to answer ateompb.Ateom/GetWorkloadStats.

Package atunnel carries actor ingress and egress through an ateom worker pod.

Package cdi reads a Container Device Interface spec and resolves what a named set of devices asks a container runtime to do.

Package credbundle handles credential bundle files written by Kubernetes Pod Certificates.

Package deviceplugin advertises host device nodes (for example /dev/kvm) to kubelet as extended resources, so a worker pod can be granted just those devices instead of running privileged.

Package imagecache implements the node-local OCI image cache: a content-addressed pool of unpacked image layers shared by every actor on the node, plus the per-bundle overlay spec that tells the ateom runtimes how to compose an actor rootfs from cached layers.

Package localca implements a CA whose state can be stored in a local file or Kubernetes secret.

Package localjwtauthority implements a simple "CA" for JWTs.

Package objectstore manages the existence of the objects an external snapshot is made of: listing them, copying them, and deleting them once nothing owns them any more.

Package ocispec builds the runtime-neutral OCI spec for actor bundles, which each ateom shapes for its runtime.

Package otlprelay carries ateom's OTLP telemetry to the collector over a unix socket served by atelet, so a worker pod needs no network path of its own to export spans and metrics.

Package pemutil sanitizes PEM certificate bundles for projection into actors, the way kubelet does for clusterTrustBundle projected volumes.

Package portforward tunnels to the pods behind a Service.

Package readyz polls a container's HTTP readiness endpoint from inside an ateom.

Package roottest gates tests that need root privileges (mounts, mknod, trusted.* xattrs, ...).

Package serverboot collects the startup boilerplate shared by the long-running substrate server binaries (ateapi, atelet, ateom-gvisor, ateom-microvm): slog wiring, OTel tracer + meter providers, a Prometheus + /readyz HTTP surface, and a couple of small helpers for startup fail-fast.

Package sizing right-sizes a sandbox to the actor's declared resource limits.

Package substratex509 contains routines for creating and parsing x509 certificates that embed Substrate-specific X.509 extensions communicating the identity of a given workload.

Package tarutil archives and restores a directory tree as a tar file, preserving the metadata a workload's data directory depends on: modes, ownership, modification times, symlinks, hardlinks, FIFOs, device nodes, and user.* / trusted.overlay.* extended attributes (as PAX SCHILY.xattr records).

Package testenv starts the envtest (kubebuilder) control plane shared by the repo's apiserver-backed test packages.

Package version exposes build-time identity for substrate binaries.

Package versionlabel derives the ate.dev/substrate-version label that keys versioned dataplane objects to a substrate build version.