gvisor

type Backend struct {
	// contains filtered or unexported fields
}

type Config struct {
	// RunscPath is the path to the runsc binary.
	// Default: runsc (uses PATH)
	RunscPath string

	// Image is the container image to use for execution.
	// Default: toolruntime-sandbox:latest
	Image string

	// RootDir is the root directory for gVisor state.
	// Default: /var/run/gvisor
	RootDir string

	// Platform is the gVisor platform to use.
	// Options: ptrace, kvm, systrap
	// Default: systrap
	Platform string

	// NetworkMode specifies the network configuration.
	// Options: none, sandbox, host
	// Default: none
	NetworkMode string

	// Client executes sandbox specs.
	// If nil, Execute() returns ErrClientNotConfigured.
	Client SandboxRunner

	// ImageResolver optionally resolves/pulls images before execution.
	ImageResolver ImageResolver

	// HealthChecker optionally verifies gVisor availability.
	HealthChecker HealthChecker

	// Logger is an optional logger for backend events.
	Logger Logger
}

type HealthChecker interface {
	Ping(ctx context.Context) error
}

type ImageResolver interface {
	Resolve(ctx context.Context, image string) (string, error)
}

type Logger interface {
	Info(msg string, args ...any)
	Warn(msg string, args ...any)
	Error(msg string, args ...any)
}

type ResourceSpec struct {
	MemoryBytes int64
	CPUQuota    int64
	PidsLimit   int64
	DiskBytes   int64
}

type SandboxResult struct {
	ExitCode int
	Stdout   string
	Stderr   string
	Duration time.Duration
}

type SandboxRunner interface {
	Run(ctx context.Context, spec SandboxSpec) (SandboxResult, error)
}

type SandboxSpec struct {
	Image      string
	Command    []string
	WorkingDir string
	Env        []string
	Resources  ResourceSpec
	Security   SecuritySpec
	Platform   string
	RunscPath  string
	RootDir    string
	Timeout    time.Duration
	Labels     map[string]string
}

type SecuritySpec struct {
	User           string
	ReadOnlyRootfs bool
	NetworkMode    string
	SeccompProfile string
	Privileged     bool
}