ateompb

type AteomClient interface {
	// RunWorkload tells ateom to begin running a new workload (one or more
	// containers, potentially with shared filesystems).
	RunWorkload(ctx context.Context, in *RunWorkloadRequest, opts ...grpc.CallOption) (*RunWorkloadResponse, error)
	// CheckpointWorkload tells ateom to save the current state of the running
	// workload to object storage, and then completely reset itself to a blank
	// state (back to "available" state.)
	CheckpointWorkload(ctx context.Context, in *CheckpointWorkloadRequest, opts ...grpc.CallOption) (*CheckpointWorkloadResponse, error)
	// RestoreWorkload restores a workload from checkpoint that was previously
	// written by CheckpointWorkload.  Ateom will handle downloading the correct
	// gVisor / runsc version to match the checkpoint.
	RestoreWorkload(ctx context.Context, in *RestoreWorkloadRequest, opts ...grpc.CallOption) (*RestoreWorkloadResponse, error)
	// GetWorkloadStats returns a point-in-time resource-usage sample for the
	// workload this ateom is currently executing.
	//
	// It is a pure read: unlike the three calls above it does not move the ateom
	// between "available" and "executing", so it is safe to call on a timer for
	// the whole lifetime of a workload. It also does not wait on them. Those
	// three serialize on a mutex an ateom holds for a whole boot, restore, or
	// checkpoint; this call reads its state from outside that mutex, so a poll
	// landing in the middle of one answers immediately instead of going quiet for
	// the duration -- which would silence the poller during exactly the phases
	// whose usage is most interesting.
	//
	// Two ways it declines to give a sample, and they ask different things of the
	// caller:
	//
	//   * NOT_FOUND -- this ateom is not executing the actor in the request. It
	//     may be "available", or a recycled worker may have moved on to a
	//     different actor. Retrying on the same timer will not change the answer:
	//     the caller's worker-to-actor mapping is stale and wants re-resolving.
	//
	//   * FAILED_PRECONDITION -- this ateom is executing the requested actor but
	//     has no sample to give yet. It accepts an actor before the sandbox it
	//     will measure exists, so a poll landing in the boot lands here. Read it
	//     as "no numbers right now", not as "the actor is gone": it is transient,
	//     and the caller should skip this sample and take the next one.
	//
	// The split is worth the two codes because the identity is retained from the
	// moment the ateom accepts the actor, on both runtimes. That is what makes
	// "booting" distinguishable from "not here" at all, and it means a workload
	// that dies during boot is attributable rather than anonymous.
	GetWorkloadStats(ctx context.Context, in *GetWorkloadStatsRequest, opts ...grpc.CallOption) (*GetWorkloadStatsResponse, error)
	// GetActiveWorkloadStats samples whatever this ateom is currently
	// executing, without asserting an identity. It is the discovery read for a
	// scraper that enumerates ateoms and holds no worker-to-actor mapping;
	// GetWorkloadStats above is the verified read for a caller that must be
	// answered about a specific actor.
	//
	// Every state a blind caller can find is a normal answer here, never an
	// error: the response is either a sample or the NoSampleReason there is
	// none -- nothing to measure ("available"), or nothing to measure YET (a
	// poll landing in a boot or a restore). Error codes are reserved for real
	// failures reading a sandbox that should be measurable. This is deliberately
	// unlike GetWorkloadStats, whose caller asserts knowledge the codes then
	// answer.
	//
	// Consumers MUST attribute each sample solely from the identity echoed
	// inside it, never from a mapping they hold: without an asserted uid, the
	// response is the only statement of who was measured. Like GetWorkloadStats
	// it is a pure read, safe on a timer, and does not touch the lifecycle
	// mutex.
	GetActiveWorkloadStats(ctx context.Context, in *GetActiveWorkloadStatsRequest, opts ...grpc.CallOption) (*GetActiveWorkloadStatsResponse, error)
	// TerminateWorkload stops and deletes container workloads and cleans up
	// network and bundle overlays on ateom.
	TerminateWorkload(ctx context.Context, in *TerminateWorkloadRequest, opts ...grpc.CallOption) (*TerminateWorkloadResponse, error)
}

type AteomServer interface {
	// RunWorkload tells ateom to begin running a new workload (one or more
	// containers, potentially with shared filesystems).
	RunWorkload(context.Context, *RunWorkloadRequest) (*RunWorkloadResponse, error)
	// CheckpointWorkload tells ateom to save the current state of the running
	// workload to object storage, and then completely reset itself to a blank
	// state (back to "available" state.)
	CheckpointWorkload(context.Context, *CheckpointWorkloadRequest) (*CheckpointWorkloadResponse, error)
	// RestoreWorkload restores a workload from checkpoint that was previously
	// written by CheckpointWorkload.  Ateom will handle downloading the correct
	// gVisor / runsc version to match the checkpoint.
	RestoreWorkload(context.Context, *RestoreWorkloadRequest) (*RestoreWorkloadResponse, error)
	// GetWorkloadStats returns a point-in-time resource-usage sample for the
	// workload this ateom is currently executing.
	//
	// It is a pure read: unlike the three calls above it does not move the ateom
	// between "available" and "executing", so it is safe to call on a timer for
	// the whole lifetime of a workload. It also does not wait on them. Those
	// three serialize on a mutex an ateom holds for a whole boot, restore, or
	// checkpoint; this call reads its state from outside that mutex, so a poll
	// landing in the middle of one answers immediately instead of going quiet for
	// the duration -- which would silence the poller during exactly the phases
	// whose usage is most interesting.
	//
	// Two ways it declines to give a sample, and they ask different things of the
	// caller:
	//
	//   * NOT_FOUND -- this ateom is not executing the actor in the request. It
	//     may be "available", or a recycled worker may have moved on to a
	//     different actor. Retrying on the same timer will not change the answer:
	//     the caller's worker-to-actor mapping is stale and wants re-resolving.
	//
	//   * FAILED_PRECONDITION -- this ateom is executing the requested actor but
	//     has no sample to give yet. It accepts an actor before the sandbox it
	//     will measure exists, so a poll landing in the boot lands here. Read it
	//     as "no numbers right now", not as "the actor is gone": it is transient,
	//     and the caller should skip this sample and take the next one.
	//
	// The split is worth the two codes because the identity is retained from the
	// moment the ateom accepts the actor, on both runtimes. That is what makes
	// "booting" distinguishable from "not here" at all, and it means a workload
	// that dies during boot is attributable rather than anonymous.
	GetWorkloadStats(context.Context, *GetWorkloadStatsRequest) (*GetWorkloadStatsResponse, error)
	// GetActiveWorkloadStats samples whatever this ateom is currently
	// executing, without asserting an identity. It is the discovery read for a
	// scraper that enumerates ateoms and holds no worker-to-actor mapping;
	// GetWorkloadStats above is the verified read for a caller that must be
	// answered about a specific actor.
	//
	// Every state a blind caller can find is a normal answer here, never an
	// error: the response is either a sample or the NoSampleReason there is
	// none -- nothing to measure ("available"), or nothing to measure YET (a
	// poll landing in a boot or a restore). Error codes are reserved for real
	// failures reading a sandbox that should be measurable. This is deliberately
	// unlike GetWorkloadStats, whose caller asserts knowledge the codes then
	// answer.
	//
	// Consumers MUST attribute each sample solely from the identity echoed
	// inside it, never from a mapping they hold: without an asserted uid, the
	// response is the only statement of who was measured. Like GetWorkloadStats
	// it is a pure read, safe on a timer, and does not touch the lifecycle
	// mutex.
	GetActiveWorkloadStats(context.Context, *GetActiveWorkloadStatsRequest) (*GetActiveWorkloadStatsResponse, error)
	// TerminateWorkload stops and deletes container workloads and cleans up
	// network and bundle overlays on ateom.
	TerminateWorkload(context.Context, *TerminateWorkloadRequest) (*TerminateWorkloadResponse, error)
	// contains filtered or unexported methods
}

type CheckpointWorkloadRequest struct {
	Atespace              string        `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	ActorName             string        `protobuf:"bytes,2,opt,name=actor_name,json=actorName,proto3" json:"actor_name,omitempty"`
	ActorUid              string        `protobuf:"bytes,3,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"`
	ActorTemplateAtespace string        `` /* 126-byte string literal not displayed */
	ActorTemplateName     string        `protobuf:"bytes,5,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
	RunscPath             string        `protobuf:"bytes,6,opt,name=runsc_path,json=runscPath,proto3" json:"runsc_path,omitempty"`
	Spec                  *WorkloadSpec `protobuf:"bytes,7,opt,name=spec,proto3" json:"spec,omitempty"`
	// The object storage URI of the snapshot to write. Object names are appended
	// to it, so it addresses the snapshot as a whole rather than any one object.
	//
	// The structure of the checkpoint should generally be treated as opaque. For
	// gVisor, the checkpoint consists of a checkpoint.img file that contains the
	// memory, sentry state, and filesystem deltas.
	//
	// The control plane sends an ActorSnapshot's snapshot_uri, which sits under
	// the prefix of the resource that owns the snapshot. For example:
	// "gs://bucket/root/atespaces/team-a/actors/<actor uid>/snapshots/5678".
	SnapshotUri string `protobuf:"bytes,8,opt,name=snapshot_uri,json=snapshotUri,proto3" json:"snapshot_uri,omitempty"`
	// runtime_asset_paths maps a runtime asset name to the local on-disk path
	// atelet fetched it to (see RunWorkloadRequest). Empty for gVisor.
	RuntimeAssetPaths map[string]string `` /* 188-byte string literal not displayed */
	// What content to include in the checkpoint.
	Scope SnapshotScope `protobuf:"varint,10,opt,name=scope,proto3,enum=ateom.SnapshotScope" json:"scope,omitempty"`
	// contains filtered or unexported fields
}

type CheckpointWorkloadResponse struct {

	// snapshot_files lists the files ateom wrote into the checkpoint directory
	// (relative names) for atelet to ship to object storage. Each runtime reports
	// its own set (gVisor's image files, cloud-hypervisor's snapshot set, ...).
	SnapshotFiles []string `protobuf:"bytes,1,rep,name=snapshot_files,json=snapshotFiles,proto3" json:"snapshot_files,omitempty"`
	// contains filtered or unexported fields
}

type Container struct {
	Name   string  `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Readyz *Readyz `protobuf:"bytes,2,opt,name=readyz,proto3" json:"readyz,omitempty"`
	// durable_dir_volume_mounts are the durable-dir volumes this container
	// mounts, if any.
	DurableDirVolumeMounts []*DurableDirVolumeMount `` /* 131-byte string literal not displayed */
	// csi_volume_mounts are the CSI volumes this container mounts, if any.
	CsiVolumeMounts []*VolumeMount `protobuf:"bytes,5,rep,name=csi_volume_mounts,json=csiVolumeMounts,proto3" json:"csi_volume_mounts,omitempty"`
	// system_info_volume_mounts are the system-info volumes this container
	// mounts, if any. Contents are generated by atelet on the host; the
	// container sees them read-only.
	SystemInfoVolumeMounts []*SystemInfoVolumeMount `` /* 131-byte string literal not displayed */
	// image_volume_mounts are the image volumes this container mounts, if any.
	ImageVolumeMounts []*ImageVolumeMount `protobuf:"bytes,7,rep,name=image_volume_mounts,json=imageVolumeMounts,proto3" json:"image_volume_mounts,omitempty"`
	// contains filtered or unexported fields
}

type DurableDirVolumeMount struct {

	// volume_name is the name the ActorTemplate gave the volume. It selects the
	// per-volume directory atelet prepared for the actor on the host.
	VolumeName string `protobuf:"bytes,1,opt,name=volume_name,json=volumeName,proto3" json:"volume_name,omitempty"`
	// mount_path is where the container sees the volume.
	MountPath string `protobuf:"bytes,2,opt,name=mount_path,json=mountPath,proto3" json:"mount_path,omitempty"`
	// contains filtered or unexported fields
}

type EgressGateway struct {

	// address is required and identifies the remote gateway as an IP address or
	// DNS name followed by its port.
	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	// contains filtered or unexported fields
}

type GetActiveWorkloadStatsRequest struct {
	// contains filtered or unexported fields
}

type GetActiveWorkloadStatsResponse struct {

	// Exactly one of the two is set: either a measurement, or the reason there
	// is none. An ateom serves one actor at a time, so the sample slot is
	// singular; the sample is self-describing (see the attribution rule on the
	// rpc), and a sample being present is itself the statement that a workload
	// is executing.
	//
	// Types that are valid to be assigned to Result:
	//
	//	*GetActiveWorkloadStatsResponse_Sample
	//	*GetActiveWorkloadStatsResponse_NoSampleReason
	Result isGetActiveWorkloadStatsResponse_Result `protobuf_oneof:"result"`
	// contains filtered or unexported fields
}

type GetActiveWorkloadStatsResponse_NoSampleReason struct {
	NoSampleReason NoSampleReason `protobuf:"varint,2,opt,name=no_sample_reason,json=noSampleReason,proto3,enum=ateom.NoSampleReason,oneof"`
}

type GetActiveWorkloadStatsResponse_Sample struct {
	Sample *WorkloadStatsSample `protobuf:"bytes,1,opt,name=sample,proto3,oneof"`
}

type GetWorkloadStatsRequest struct {

	// The actor the caller believes is executing here. A worker can be recycled
	// between the caller's view of the world and this call, so ateom answers
	// NOT_FOUND on a mismatch rather than reporting a different actor's numbers
	// under the requested actor's identity.
	ActorUid string `protobuf:"bytes,1,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"`
	// contains filtered or unexported fields
}

type GetWorkloadStatsResponse struct {
	Sample *WorkloadStatsSample `protobuf:"bytes,1,opt,name=sample,proto3" json:"sample,omitempty"`
	// contains filtered or unexported fields
}

type HTTPGetAction struct {

	// Path to access on the HTTP server. Empty means "/readyz".
	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	// TCP port to connect to (1..65535).
	Port int32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// contains filtered or unexported fields
}

type ImageVolumeMount struct {

	// volume_name is the name the ActorTemplate gave the volume.
	VolumeName string `protobuf:"bytes,1,opt,name=volume_name,json=volumeName,proto3" json:"volume_name,omitempty"`
	// mount_path is where the container sees the volume.
	MountPath string `protobuf:"bytes,2,opt,name=mount_path,json=mountPath,proto3" json:"mount_path,omitempty"`
	// contains filtered or unexported fields
}

type NoSampleReason int32

type Readyz struct {
	HttpGet *HTTPGetAction `protobuf:"bytes,1,opt,name=http_get,json=httpGet,proto3" json:"http_get,omitempty"`
	// How long to keep polling before giving up and failing the actor start.
	// Zero means the ateom's default.
	TimeoutSeconds int32 `protobuf:"varint,2,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`
	// contains filtered or unexported fields
}

type RestoreWorkloadRequest struct {
	Atespace              string        `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	ActorName             string        `protobuf:"bytes,2,opt,name=actor_name,json=actorName,proto3" json:"actor_name,omitempty"`
	ActorUid              string        `protobuf:"bytes,3,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"`
	ActorTemplateAtespace string        `` /* 126-byte string literal not displayed */
	ActorTemplateName     string        `protobuf:"bytes,5,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
	RunscPath             string        `protobuf:"bytes,6,opt,name=runsc_path,json=runscPath,proto3" json:"runsc_path,omitempty"`
	Spec                  *WorkloadSpec `protobuf:"bytes,7,opt,name=spec,proto3" json:"spec,omitempty"`
	// The object storage URI of the snapshot to restore. Object names are
	// appended to it; it addresses the snapshot, not any one object.
	SnapshotUri string `protobuf:"bytes,8,opt,name=snapshot_uri,json=snapshotUri,proto3" json:"snapshot_uri,omitempty"`
	// runtime_asset_paths maps a runtime asset name to the local on-disk path
	// atelet fetched it to (see RunWorkloadRequest). Empty for gVisor.
	RuntimeAssetPaths map[string]string `` /* 188-byte string literal not displayed */
	// What content to restore from the snapshot.
	Scope SnapshotScope `protobuf:"varint,10,opt,name=scope,proto3,enum=ateom.SnapshotScope" json:"scope,omitempty"`
	// When absent, actor traffic uses direct egress instead of atunnel.
	EgressGateway *EgressGateway `protobuf:"bytes,12,opt,name=egress_gateway,json=egressGateway,proto3,oneof" json:"egress_gateway,omitempty"`
	// The object storage URI of the ActorTemplate's golden snapshot.
	// Set only when scope is SNAPSHOT_SCOPE_DATA_ON_GOLDEN. Mirrors the
	// snapshot_uri contract (field 8).
	GoldenSnapshotUri string `protobuf:"bytes,13,opt,name=golden_snapshot_uri,json=goldenSnapshotUri,proto3" json:"golden_snapshot_uri,omitempty"`
	// The actor's declared size, from the ActorTemplate's resource limits. Used to
	// (re)size the sandbox on a DATA-scope restore (fresh guest container). On a
	// FULL micro-VM restore the size baked into the snapshot is authoritative and
	// these are ignored. Zero means "unset": keep the runtime default.
	CpuMilli    int64 `protobuf:"varint,14,opt,name=cpu_milli,json=cpuMilli,proto3" json:"cpu_milli,omitempty"`          // CPU limit in millicores (1000 = one core).
	MemoryBytes int64 `protobuf:"varint,15,opt,name=memory_bytes,json=memoryBytes,proto3" json:"memory_bytes,omitempty"` // Memory limit in bytes.
	// contains filtered or unexported fields
}

type RestoreWorkloadResponse struct {
	// contains filtered or unexported fields
}

type RunWorkloadRequest struct {
	Atespace              string        `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	ActorName             string        `protobuf:"bytes,2,opt,name=actor_name,json=actorName,proto3" json:"actor_name,omitempty"`
	ActorUid              string        `protobuf:"bytes,3,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"`
	ActorTemplateAtespace string        `` /* 126-byte string literal not displayed */
	ActorTemplateName     string        `protobuf:"bytes,5,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
	RunscPath             string        `protobuf:"bytes,6,opt,name=runsc_path,json=runscPath,proto3" json:"runsc_path,omitempty"`
	Spec                  *WorkloadSpec `protobuf:"bytes,7,opt,name=spec,proto3" json:"spec,omitempty"`
	// runtime_asset_paths maps a runtime asset name (e.g. "cloud-hypervisor",
	// "virtiofsd", "kata-kernel", "kata-image", "kata-config")
	// to the local on-disk path atelet fetched it to (content-addressed, like
	// runsc_path). Empty for the gVisor runtime, which uses runsc_path.
	RuntimeAssetPaths map[string]string `` /* 188-byte string literal not displayed */
	// When absent, actor traffic uses direct egress instead of atunnel.
	EgressGateway *EgressGateway `protobuf:"bytes,10,opt,name=egress_gateway,json=egressGateway,proto3,oneof" json:"egress_gateway,omitempty"`
	// The actor's declared size, from the ActorTemplate's resource limits. ateom
	// sizes the sandbox to these (cgroup caps via the OCI spec, and for the
	// micro-VM the VM's vCPU count and memory). Zero means "unset": keep the
	// runtime default (unlimited for gVisor, the kata config for the micro-VM).
	CpuMilli    int64 `protobuf:"varint,11,opt,name=cpu_milli,json=cpuMilli,proto3" json:"cpu_milli,omitempty"`          // CPU limit in millicores (1000 = one core).
	MemoryBytes int64 `protobuf:"varint,12,opt,name=memory_bytes,json=memoryBytes,proto3" json:"memory_bytes,omitempty"` // Memory limit in bytes.
	// contains filtered or unexported fields
}

type RunWorkloadResponse struct {
	// contains filtered or unexported fields
}

type SandboxClass int32

type SnapshotScope int32

type StatsSource int32

type SystemInfoVolumeMount struct {

	// volume_name is the name the ActorTemplate gave the volume. It selects the
	// per-volume directory atelet prepared for the actor on the host.
	VolumeName string `protobuf:"bytes,1,opt,name=volume_name,json=volumeName,proto3" json:"volume_name,omitempty"`
	// mount_path is where the container sees the volume.
	MountPath string `protobuf:"bytes,2,opt,name=mount_path,json=mountPath,proto3" json:"mount_path,omitempty"`
	// contains filtered or unexported fields
}

type TerminateWorkloadRequest struct {
	Atespace              string        `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	ActorName             string        `protobuf:"bytes,2,opt,name=actor_name,json=actorName,proto3" json:"actor_name,omitempty"`
	ActorUid              string        `protobuf:"bytes,3,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"`
	ActorTemplateAtespace string        `` /* 126-byte string literal not displayed */
	ActorTemplateName     string        `protobuf:"bytes,5,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
	RunscPath             string        `protobuf:"bytes,6,opt,name=runsc_path,json=runscPath,proto3" json:"runsc_path,omitempty"`
	Spec                  *WorkloadSpec `protobuf:"bytes,7,opt,name=spec,proto3" json:"spec,omitempty"`
	// contains filtered or unexported fields
}

type TerminateWorkloadResponse struct {
	// contains filtered or unexported fields
}

type UnimplementedAteomServer struct{}

type UnsafeAteomServer interface {
	// contains filtered or unexported methods
}

type VolumeMount struct {
	VolumeName string `protobuf:"bytes,1,opt,name=volume_name,json=volumeName,proto3" json:"volume_name,omitempty"`
	MountPath  string `protobuf:"bytes,2,opt,name=mount_path,json=mountPath,proto3" json:"mount_path,omitempty"`
	// contains filtered or unexported fields
}

type WorkloadSpec struct {
	Containers []*Container `protobuf:"bytes,1,rep,name=containers,proto3" json:"containers,omitempty"`
	// contains filtered or unexported fields
}

type WorkloadStatsSample struct {

	// Identity of the measured actor, retained by ateom from the
	// RunWorkloadRequest / RestoreWorkloadRequest that started it. Echoed back so
	// the caller can attribute the sample without holding its own mapping from
	// worker to actor.
	Atespace              string `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	ActorName             string `protobuf:"bytes,2,opt,name=actor_name,json=actorName,proto3" json:"actor_name,omitempty"`
	ActorUid              string `protobuf:"bytes,3,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"`
	ActorTemplateAtespace string `` /* 126-byte string literal not displayed */
	ActorTemplateName     string `protobuf:"bytes,5,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
	// The sandbox runtime family that produced this sample.
	SandboxClass SandboxClass `protobuf:"varint,6,opt,name=sandbox_class,json=sandboxClass,proto3,enum=ateom.SandboxClass" json:"sandbox_class,omitempty"`
	// How the measurements below were obtained.
	Source StatsSource `protobuf:"varint,7,opt,name=source,proto3,enum=ateom.StatsSource" json:"source,omitempty"`
	// Measurements. All four are zero when source is STATS_SOURCE_UNSPECIFIED,
	// which means "not measured" rather than "measured as zero".
	//
	// Two of them accumulate -- memory_peak_bytes and cpu_usage_usec -- and both
	// are scoped to the current EPOCH rather than to the actor's lifetime. An
	// epoch begins wherever the accounting behind the sample begins, which is not
	// the same event for every source: STATS_SOURCE_CGROUP reads a sandbox cgroup
	// that a restore recreates, so both restart at zero there, while
	// STATS_SOURCE_GUEST_AGENT reads counters the guest kernel keeps in its own
	// RAM, which a restored guest brings back with it. A caller that wants a
	// lifetime figure has to accumulate one itself, and must read a decrease as a
	// new epoch rather than emit a negative delta -- but not the converse. An
	// epoch can also begin at a value above the last one reported, so no
	// comparison of consecutive samples detects every boundary.
	MemoryCurrentBytes uint64 `protobuf:"varint,8,opt,name=memory_current_bytes,json=memoryCurrentBytes,proto3" json:"memory_current_bytes,omitempty"`
	// High-water mark of memory_current_bytes within the current epoch. Also zero
	// when the runtime cannot report a peak at all: the cgroup source reads
	// memory.peak, which only exists on Linux 5.19 and later.
	MemoryPeakBytes uint64 `protobuf:"varint,9,opt,name=memory_peak_bytes,json=memoryPeakBytes,proto3" json:"memory_peak_bytes,omitempty"`
	// memory_current_bytes less the reclaimable page cache, floored at zero. This
	// is the figure to compare against a memory limit; memory_current_bytes
	// drifts upward with cache the kernel would drop for free under pressure.
	MemoryWorkingSetBytes uint64 `` /* 130-byte string literal not displayed */
	// Cumulative CPU time within the current epoch.
	CpuUsageUsec       uint64 `protobuf:"varint,11,opt,name=cpu_usage_usec,json=cpuUsageUsec,proto3" json:"cpu_usage_usec,omitempty"`
	ObservedAtUnixNano int64  `protobuf:"varint,12,opt,name=observed_at_unix_nano,json=observedAtUnixNano,proto3" json:"observed_at_unix_nano,omitempty"`
	// contains filtered or unexported fields
}