runtime

type Config struct {
	Client       *client.Client
	RunnerDir    string // host path to extracted runner binary
	RunnerMount  string // container path to mount runner at
	DefaultImage string // override default container image (auto-detected if empty)
	ImagesDir    string // directory containing pre-downloaded OCI image tarballs to import on startup
	LogDir       string // directory for per-job container logs
	DataDir      string // ephemerd data directory (used for dind socket paths)
	// ContainerDataDir is the path containerd/runc see for the DataDir.
	// On Linux this matches DataDir. On Darwin the host DataDir is shared
	// into the Linux VM via virtio-fs at a different path (e.g.
	// /mnt/ephemerd), and any bind-mount sources that reference the
	// DataDir must be rewritten to that VM-side path. When empty, falls
	// back to DataDir.
	ContainerDataDir string
	DindEnabled      bool // mount a fake Docker socket into each container
	// DindAllowPrivileged is forwarded to each per-job dind.Server.
	// When false, requests carrying HostConfig.Privileged=true or
	// HostConfig.CapAdd are rejected with HTTP 403. See
	// config.DindConfig.AllowPrivileged for the threat model.
	DindAllowPrivileged bool
	// RegistryMirror routes image pulls through a LAN pull-through cache.
	// Nil (the zero value) means no mirror: PullImage builds exactly the
	// containerd pull call it built before the feature existed. Forwarded
	// to each per-job dind.Server so the hot dind pull path is covered too.
	RegistryMirror *registrymirror.Mirror
	CacheProxyEnv  []string // extra env vars from cache proxies (e.g., GOPROXY=...)
	// CacheProxyMounts are read-only bind mounts requested by cache proxies
	// for toolchains that cannot be redirected with an env var. The Cargo
	// proxy uses this to place a generated .cargo/config.toml at the
	// container's filesystem root, where Cargo's ancestor-directory config
	// search finds it for any workspace path.
	CacheProxyMounts []proxies.Mount
	// Rlimits sets POSIX resource limits on each runner container's OCI
	// process. Zero values fall back to the containerd default (1024).
	// Applies on Linux only; ignored on Windows (HCS uses a different model).
	Rlimits config.RuntimeRlimits
	// AllowNewPrivileges permits privilege escalation via execve in the
	// runner container (NoNewPrivileges=false), which is what makes
	// `sudo` work. See config.RuntimeConfig.AllowNewPrivileges.
	//
	// NOTE: this is a resolved value — callers pass
	// cfg.Runtime.ResolvedAllowNewPrivileges(), whose default is true.
	// The zero value here is false, i.e. the hardened setting, so a
	// construction site that forgets this field breaks `sudo` rather
	// than silently loosening the sandbox.
	AllowNewPrivileges bool
	// LinuxRuntime is the containerd runtime handler for Linux job
	// containers — "io.containerd.runc.v2" (default) or
	// "io.containerd.kata.v2" for VM-isolated jobs. Empty means runc, so
	// a construction site that forgets this field keeps today's behavior
	// rather than failing to create containers. Ignored on Windows, which
	// always uses io.containerd.runhcs.v1.
	//
	// Callers pass config.LinuxRunnerToml.ContainerdRuntime().
	LinuxRuntime string
	Network      *networking.Manager
	// WindowsMemoryBytes is the memory limit for Hyper-V isolated Windows
	// runner containers. Zero leaves the OCI spec field unset, which gives
	// the HCS default (~1 GB) — too small for MSVC builds. Caller should
	// pass config.WindowsRunnerToml.MemoryBytes() which defaults to 4 GB.
	WindowsMemoryBytes uint64
	// WindowsCPUs is the virtual CPU count for Hyper-V isolated Windows
	// runner containers. Zero leaves the OCI spec field unset. Caller
	// should pass config.WindowsRunnerToml.CPUCount() which defaults to 2.
	WindowsCPUs uint64
	// BuildKit is the shared embedded BuildKit solver handed to each per-job
	// dind.Server for `docker build` support. Optional; nil means `docker build`
	// falls back to the platform default (buildah on Linux, 501 elsewhere).
	BuildKit *buildkit.Server
	// OnTaskStarted is invoked synchronously by Create after the container
	// task has successfully Start()ed. Nil means no hook. Used to wire
	// per-container resource samplers into the metrics endpoint; see
	// docs/arch/container-metrics.md.
	OnTaskStarted func(env *RunnerEnv)
	// OnTaskDestroy is invoked synchronously by Destroy before the
	// container is torn down. Symmetric with OnTaskStarted.
	OnTaskDestroy func(env *RunnerEnv)
	// ImageGC evicts LRU container images when the node is under disk
	// pressure. Nil disables it. The runtime consults it before pulling
	// an image and before creating a runner environment — a periodic
	// timer alone loses the race a single job can win by pulling a
	// multi-gigabyte toolchain image between ticks.
	ImageGC *imagegc.Collector
	Log     *slog.Logger
}

type CreateConfig struct {
	ID    string // unique job identifier (container name, dind socket path)
	Image string // OCI image reference (empty = use default)

	// Provider is the forge provider name (e.g. "github", "gitea") that
	// queued the job. Together with Repo it's used to scope dind's
	// per-repo image cache. Empty disables caching for this job.
	Provider string

	// Repo is the forge-native repo path (e.g. "owner/repo"). Together
	// with Provider it's used to scope dind's per-repo image cache.
	// Empty disables caching for this job.
	Repo string

	// JITConfig is the base64-encoded JIT config for GitHub runners.
	// Passed as "--jitconfig <value>" to the runner entrypoint.
	// Mutually exclusive with Entrypoint.
	JITConfig string

	// Env holds extra environment variables injected into the container.
	// Used by Gitea/Forgejo to pass instance URL, runner token, etc.
	Env map[string]string

	// Entrypoint overrides the container's process args.
	// When set, used instead of the default "--jitconfig" entrypoint.
	// When nil and JITConfig is set, uses the GitHub "--jitconfig" mode.
	// When nil and JITConfig is empty, uses the image's default CMD.
	Entrypoint []string
}

type RunnerEnv struct {
	ID        string
	Provider  string       // forge provider that queued the job (e.g. "github")
	Repo      string       // forge-native repo path (e.g. "owner/repo")
	Netns     string       // network namespace path (Linux only)
	RunnerDir string       // per-job runner copy, cleaned up on destroy
	Dind      *dind.Server // per-job fake Docker daemon (nil if disabled)
	Container client.Container
	Task      client.Task
}

type Runtime struct {
	// contains filtered or unexported fields
}