containerd

type Backend struct {
	// contains filtered or unexported fields
}

type Config struct {
	// ImageRef is the image reference to use for execution.
	// Default: toolruntime-sandbox:latest
	ImageRef string

	// Namespace is the containerd namespace to use.
	// Default: default
	Namespace string

	// SocketPath is the path to the containerd socket.
	// Default: /run/containerd/containerd.sock
	SocketPath string

	// Runtime is the containerd runtime to use.
	// Examples: "io.containerd.runc.v2", "io.containerd.runsc.v1", "io.containerd.kata.v2", "aws.firecracker".
	// Optional.
	Runtime string

	// SeccompPath is the path to a seccomp profile for hardened mode.
	SeccompPath string

	// Client executes container specs.
	// If nil, Execute() returns ErrClientNotConfigured.
	Client ContainerRunner

	// ImageResolver optionally resolves/pulls images before execution.
	ImageResolver ImageResolver

	// HealthChecker optionally verifies containerd availability.
	HealthChecker HealthChecker

	// Logger is an optional logger for backend events.
	Logger Logger
}

type ContainerResult struct {
	// ExitCode is the container's exit code.
	ExitCode int

	// Stdout contains the container's stdout output.
	Stdout string

	// Stderr contains the container's stderr output.
	Stderr string

	// Duration is the execution time.
	Duration time.Duration
}

type ContainerRunner interface {
	Run(ctx context.Context, spec ContainerSpec) (ContainerResult, error)
}

type ContainerSpec struct {
	// Image is the container image reference (required).
	Image string

	// Runtime is the containerd runtime to use (e.g., "io.containerd.runc.v2").
	Runtime string

	// Command is the command to execute.
	Command []string

	// WorkingDir is the working directory inside the container.
	WorkingDir string

	// Env contains environment variables in KEY=value format.
	Env []string

	// Resources defines resource limits.
	Resources ResourceSpec

	// Security defines security settings.
	Security SecuritySpec

	// Timeout is the maximum execution duration.
	Timeout time.Duration

	// Labels are container labels for tracking.
	Labels map[string]string
}

type HealthChecker interface {
	Ping(ctx context.Context) error
}

type ImageResolver interface {
	Resolve(ctx context.Context, image string) (string, error)
}

type Logger interface {
	Info(msg string, args ...any)
	Warn(msg string, args ...any)
	Error(msg string, args ...any)
}

type ResourceSpec struct {
	// MemoryBytes is the memory limit in bytes.
	// Zero means unlimited.
	MemoryBytes int64

	// CPUQuota is the CPU quota in microseconds per 100ms period.
	// Zero means unlimited.
	CPUQuota int64

	// PidsLimit is the maximum number of processes.
	// Zero means unlimited.
	PidsLimit int64

	// DiskBytes is the disk limit in bytes.
	// Zero means unlimited. Not all runtimes support this.
	DiskBytes int64
}

type SecuritySpec struct {
	// User is the user to run as (e.g., "nobody:nogroup").
	User string

	// ReadOnlyRootfs mounts the root filesystem as read-only.
	ReadOnlyRootfs bool

	// NetworkMode is the network mode: "none", "bridge", "host".
	// "host" is not allowed in sandbox contexts.
	NetworkMode string

	// SeccompProfile is the path to a seccomp profile.
	// Empty uses the runtime's default profile.
	SeccompProfile string

	// Privileged grants extended privileges to the container.
	// Must always be false in sandbox contexts.
	Privileged bool
}