docker

type Args struct {
	Command string `json:"command" jsonschema:"required,description=The command to execute in the container"`
}

type Config struct {
	// Image is the Docker image to run (e.g., "instrumentisto/nmap:latest")
	Image string

	// Command is the command and arguments to pass to the container
	Command []string

	// Env is a list of environment variables in the form "KEY=value"
	Env []string

	// NetworkMode specifies the network mode ("host", "bridge", "none")
	// Default is "none" for maximum isolation.
	NetworkMode string

	// Timeout for the container execution. Zero means no timeout.
	Timeout time.Duration

	// AutoRemove determines if the container should be removed after execution.
	AutoRemove bool

	// Privileged runs the container in privileged mode.
	// WARNING: Use with extreme caution - bypasses most security features.
	Privileged bool

	// Mounts for volume bindings (optional)
	Mounts []mount.Mount

	// WorkingDir sets the working directory inside the container
	WorkingDir string

	// User sets the user inside the container (e.g., "1000:1000")
	User string

	// PullImage determines if the image should be pulled before running
	PullImage bool

	// MemoryLimit is the memory limit in bytes (0 = unlimited)
	MemoryLimit int64

	// CPUQuota is the CPU quota (100000 = 1 CPU)
	CPUQuota int64
}

type Option func(*Options)

type Options struct {
	// Description explains what the tool does (shown to LLM)
	Description string

	// Timeout for command execution (default: 30s)
	Timeout time.Duration

	// NetworkMode controls network access ("none", "bridge", "host")
	// Default is "none" for maximum isolation.
	NetworkMode string

	// AllowedCommands restricts which commands can be executed (optional).
	// If set, only commands starting with one of these prefixes are allowed.
	AllowedCommands []string

	// MemoryLimit in bytes (default: 256MB)
	MemoryLimit int64

	// CPUQuota (100000 = 1 CPU, default: 50000 = 0.5 CPU)
	CPUQuota int64

	// PullImage pulls the image before first use
	PullImage bool

	// User sets the user inside the container (e.g., "1000:1000")
	User string

	// WorkingDir sets the working directory inside the container
	WorkingDir string
}

type Result struct {
	// Stdout contains the standard output from the container
	Stdout []byte

	// Stderr contains the standard error from the container
	Stderr []byte

	// ExitCode is the container's exit code
	ExitCode int

	// Duration is how long the container ran
	Duration time.Duration
}

type Runner struct {
	// contains filtered or unexported fields
}

type Tool struct {
	// contains filtered or unexported fields
}