container

type CPUResources struct {
	// Max is the CPU bandwidth limit as "quota period" (cpu.max)
	// quota is in microseconds, period is typically 100000 (100ms)
	// e.g., "50000 100000" limits to 50% of one CPU
	// Use "max 100000" for unlimited
	Quota  int64
	Period uint64

	// Weight is the CPU weight for fair scheduling (cpu.weight)
	// Range: 1-10000, default 100
	Weight uint64

	// Cpus is the set of CPUs the container can use (cpuset.cpus)
	// e.g., "0-3" or "0,2,4"
	Cpus string

	// Mems is the set of memory nodes the container can use (cpuset.mems)
	// e.g., "0-1" or "0"
	Mems string
}

type CPUStats struct {
	UsageUsec uint64 // Total CPU time consumed in microseconds
}

type Capabilities struct {
	// Bounding set - upper limit on capabilities that can be gained
	Bounding []cap.Value
	// Effective set - capabilities used for permission checks
	Effective []cap.Value
	// Permitted set - capabilities that can be assumed
	Permitted []cap.Value
	// Inheritable set - capabilities preserved across execve
	Inheritable []cap.Value
	// Ambient set - capabilities inherited by non-privileged programs
	Ambient []cap.Value
}

type Cgroup struct {
	// contains filtered or unexported fields
}

type CgroupStats struct {
	Memory *MemoryStats
	CPU    *CPUStats
	Pids   *PidsStats
}

type Config struct {
	Root        string
	Namespaces  Namespaces
	Hostname    string
	Mounts      []Mount
	UidMappings []syscall.SysProcIDMap
	GidMappings []syscall.SysProcIDMap

	// Security options (Phase 1)
	// UsePivotRoot uses pivot_root instead of chroot for better isolation
	UsePivotRoot bool
	// Capabilities configures Linux capabilities for the container
	Capabilities *Capabilities
	// Seccomp configures the seccomp profile for syscall filtering
	Seccomp *SeccompProfile
	// Devices specifies device nodes to create in /dev
	Devices []Device
	// SetupDev creates a minimal /dev with standard devices
	SetupDev bool
	// NoNewPrivileges sets the no_new_privs flag
	NoNewPrivileges bool

	// Resource limits (Phase 2)
	// Resources configures cgroups v2 resource limits
	Resources *Resources

	// Networking (Phase 3)
	// Network configures container networking
	Network *NetworkConfig

	// Lifecycle (Phase 4)
	// Hooks configures lifecycle hooks
	Hooks *Hooks
}

type Container struct {
	// contains filtered or unexported fields
}

type ContainerState struct {
	ID        string    `json:"id"`
	State     State     `json:"state"`
	Pid       int       `json:"pid"`
	ExitCode  int       `json:"exit_code"`
	CreatedAt time.Time `json:"created_at"`
	StartedAt time.Time `json:"started_at,omitempty"`
	StoppedAt time.Time `json:"stopped_at,omitempty"`
}

type Device struct {
	Path  string // Path inside container (e.g., "/dev/null")
	Type  uint32 // S_IFCHR (character) or S_IFBLK (block)
	Major uint32 // Major device number
	Minor uint32 // Minor device number
	Mode  uint32 // File permissions (e.g., 0666)
	Uid   uint32 // Owner UID
	Gid   uint32 // Owner GID
}

type ExecConfig struct {
	// Cmd is the command to execute
	Cmd string
	// Args are the command arguments
	Args []string
	// Env are environment variables
	Env []string
	// WorkDir is the working directory
	WorkDir string
	// Root is the root filesystem path (for chroot-based containers)
	Root string
	// Stdin is the stdin reader
	Stdin io.Reader
	// Stdout is the stdout writer
	Stdout io.Writer
	// Stderr is the stderr writer
	Stderr io.Writer
}

type Hook struct {
	// Path is the command to execute
	Path string `json:"path"`
	// Args are the command arguments
	Args []string `json:"args,omitempty"`
	// Env are environment variables
	Env []string `json:"env,omitempty"`
	// Timeout is the maximum time to wait for the hook
	Timeout time.Duration `json:"timeout,omitempty"`
}

type HookType string

type Hooks struct {
	Prestart        []Hook `json:"prestart,omitempty"`
	CreateRuntime   []Hook `json:"createRuntime,omitempty"`
	CreateContainer []Hook `json:"createContainer,omitempty"`
	StartContainer  []Hook `json:"startContainer,omitempty"`
	Poststart       []Hook `json:"poststart,omitempty"`
	Poststop        []Hook `json:"poststop,omitempty"`
}

type IOResources struct {
	// Weight is the I/O weight for fair scheduling (io.weight)
	// Range: 1-10000, default 100
	Weight uint64

	// Max specifies per-device I/O limits (io.max)
	// Key is "major:minor", value is the limit string
	// e.g., "8:0": "rbps=1048576 wbps=1048576 riops=1000 wiops=1000"
	Max map[string]string
}

type MemoryResources struct {
	// Max is the hard memory limit in bytes (memory.max)
	// Use -1 for unlimited
	Max int64

	// High is the memory throttling threshold in bytes (memory.high)
	// When exceeded, processes are throttled and put under heavy reclaim pressure
	// Use -1 for unlimited
	High int64

	// SwapMax is the swap limit in bytes (memory.swap.max)
	// Use -1 for unlimited, 0 to disable swap
	SwapMax int64
}

type MemoryStats struct {
	Current uint64 // Current memory usage in bytes
	Peak    uint64 // Peak memory usage in bytes
}

type Mount struct {
	Source string
	Target string
	Type   string
	Flags  uintptr
	Data   string
}

type Namespaces struct {
	NewIPC  bool
	NewMnt  bool
	NewNet  bool
	NewPID  bool
	NewUTS  bool
	NewUser bool
}

type Network struct {
	// contains filtered or unexported fields
}

type NetworkConfig struct {
	// Mode is the networking mode
	Mode NetworkMode

	// Bridge is the bridge name to connect to (for bridge mode)
	// If empty, defaults to "container0"
	Bridge string

	// IPAddress is the container's IP address with CIDR (e.g., "10.0.0.2/24")
	// If empty in bridge mode, will need manual configuration
	IPAddress string

	// Gateway is the default gateway IP
	Gateway string

	// DNS is a list of DNS server IPs
	DNS []string

	// Hostname is the container hostname (also set via Config.Hostname)
	Hostname string

	// PortMappings defines port forwarding rules
	PortMappings []PortMapping
}

type NetworkMode string

type PidsResources struct {
	// Max is the maximum number of processes (pids.max)
	// Use -1 for unlimited
	Max int64
}

type PidsStats struct {
	Current uint64 // Current number of processes
}

type PortForwarder struct {
	// contains filtered or unexported fields
}

type PortMapping struct {
	// HostIP is the host IP to bind to (empty for all interfaces)
	HostIP string
	// HostPort is the port on the host
	HostPort uint16
	// ContainerPort is the port in the container
	ContainerPort uint16
	// Protocol is "tcp" or "udp"
	Protocol string
}

type Process struct {
	Cmd        string
	Args       []string
	WorkDir    string
	Env        []string
	InheritEnv bool
	Init       bool
	Credential *syscall.Credential
	Stdin      io.Reader `json:"-"`
	Stdout     io.Writer `json:"-"`
	Stderr     io.Writer `json:"-"`
	StdinPipe  bool      `json:"-"`
	StdoutPipe bool      `json:"-"`
	StderrPipe bool      `json:"-"`
}

type Resources struct {
	// Memory limits
	Memory *MemoryResources

	// CPU limits
	CPU *CPUResources

	// Process limits
	Pids *PidsResources

	// I/O limits
	IO *IOResources
}

type SeccompProfile struct {
	// DefaultAction is the action for syscalls not in the rules
	DefaultAction seccomp.Action
	// Syscalls defines the syscall filtering rules
	Syscalls []seccomp.SyscallGroup
}

type SignalConfig struct {
	// StopSignal is the signal to send for graceful stop (default SIGTERM)
	StopSignal syscall.Signal
	// StopTimeout is how long to wait before sending SIGKILL
	StopTimeout time.Duration
	// ForwardSignals lists signals to forward to the container
	ForwardSignals []syscall.Signal
}

type SignalForwarder struct {
	// contains filtered or unexported fields
}

type State string

type StateManager struct {
	// contains filtered or unexported fields
}