kata

type Backend struct {
	// contains filtered or unexported fields
}

type Config struct {
	// RuntimePath is the path to the kata-runtime binary.
	// Default: kata-runtime (uses PATH)
	RuntimePath string

	// Image is the container image to use for execution.
	// Default: toolruntime-sandbox:latest
	Image string

	// Hypervisor specifies the hypervisor to use.
	// Options: qemu, cloud-hypervisor, firecracker
	// Default: qemu
	Hypervisor string

	// KernelPath is the path to the guest kernel.
	KernelPath string

	// ImagePath is the path to the guest image/rootfs.
	ImagePath string

	// Client executes sandbox specs.
	// If nil, Execute() returns ErrClientNotConfigured.
	Client SandboxRunner

	// ImageResolver optionally resolves/pulls images before execution.
	ImageResolver ImageResolver

	// HealthChecker optionally verifies kata availability.
	HealthChecker HealthChecker

	// Logger is an optional logger for backend events.
	Logger Logger
}

type HealthChecker interface {
	Ping(ctx context.Context) error
}

type ImageResolver interface {
	Resolve(ctx context.Context, image string) (string, error)
}

type Logger interface {
	Info(msg string, args ...any)
	Warn(msg string, args ...any)
	Error(msg string, args ...any)
}

type ResourceSpec struct {
	MemoryBytes int64
	CPUQuota    int64
	PidsLimit   int64
	DiskBytes   int64
}

type SandboxResult struct {
	ExitCode int
	Stdout   string
	Stderr   string
	Duration time.Duration
}

type SandboxRunner interface {
	Run(ctx context.Context, spec SandboxSpec) (SandboxResult, error)
}

type SandboxSpec struct {
	Image      string
	Runtime    string
	Hypervisor string
	KernelPath string
	ImagePath  string
	Command    []string
	WorkingDir string
	Env        []string
	Resources  ResourceSpec
	Security   SecuritySpec
	Timeout    time.Duration
	Labels     map[string]string
}

type SecuritySpec struct {
	User           string
	ReadOnlyRootfs bool
	NetworkMode    string
	SeccompProfile string
	Privileged     bool
}