shim

type Environment struct {
	User         string            // user the command will run as (may be empty / synthetic)
	OutPipe      string            // io pipe path for stdout
	ErrPipe      string            // io pipe path for stderr
	Env          map[string]string // environment variables
	TaskDir      string            // task directory
	WorkDir      string            // working directory for the task; defaults to TaskDir
	Cgroup       string            // task cgroup path
	Net          string            // allocation network namespace path
	Memory       uint64            // memory in megabytes
	MemoryMax    uint64            // memory_max in megabytes
	CPUBandwidth uint64            // cpu / cores bandwidth
	OOMScoreAdj  int               // oom_score_adj for the task
}

type ExecTwo interface {
	// Start the Task process.
	Start(context.Context) error

	// PID returns the process ID associated with exec.
	//
	// Must only be called after Start.
	PID() int

	// Wait on the process (until exit).
	//
	// Must only be called after Start.
	WaitCh() process.WaitCh

	// Stats returns current resource utilization.
	//
	// Must only be called after Start.
	Stats() *resources.Utilization

	// Signal [kill()] the process.
	//
	// Must be called after Start.
	Signal(string) error

	// Stop the process.
	//
	// Must be called after Start.
	Stop(string, time.Duration) error
}

type Mount struct {
	Source   string `json:"source"`
	Target   string `json:"target"`
	Readonly bool   `json:"readonly"`
}

type Options struct {
	Command      string
	Arguments    []string
	UnveilPaths  []string
	OOMScoreAdj  int
	Capabilities []string
	WorkDir      string  // working directory for the task; defaults to TaskDir
	Mounts       []Mount // bind mounts to set up inside the task mount namespace
}

type ShimConfig struct {
	// Version identifies the config format. Always set to configVersion (1).
	Version int `json:"version"`

	// OutPipe is the filesystem path to the named pipe for task stdout.
	OutPipe string `json:"out_pipe"`

	// ErrPipe is the filesystem path to the named pipe for task stderr.
	ErrPipe string `json:"err_pipe"`

	// UID is the numeric user ID the task process should run as.
	UID int `json:"uid"`

	// GID is the numeric group ID the task process should run as.
	GID int `json:"gid"`

	// Capabilities is the list of Linux capability names to raise as ambient
	// capabilities for the task process. Empty means no extra capabilities.
	Capabilities []string `json:"capabilities"`

	// UnveilPaths is the complete list of Landlock entries to expose.
	// Each entry is either a "mode:path" pair (e.g. "r:/some/path", "rwxc:/alloc/data")
	// or built-ins (e.g. UnveilShared, UnveilCerts) that the shim expands
	// to a go-landlock path set.
	UnveilPaths []string `json:"unveil_paths"`

	// Command is the executable to run as the task process.
	Command string `json:"command"`

	// Arguments are the command-line arguments passed to Command.
	Arguments []string `json:"arguments"`

	// Mounts is the list of bind mounts.
	Mounts []Mount `json:"mounts"`
}