Documentation
¶
Overview ¶
Package pods gives paid members a personal Linux container over SSH (`ssh pod@host`) — "run shit in a docker-like" without root on the host.
Engine preference: rootless Podman (daemonless; container root maps to an unprivileged host uid via user namespaces), falling back to Docker.
Capability profile differs by engine. Under rootless podman the host is protected by the userns mapping itself, so pods keep podman's default capability set — the pod's root behaves like real root (apt, chown, su, binding :80, ping). Under docker a breakout is host-root, so docker pods run non-root (uid 1000) with cap-drop ALL + no-new-privileges. Either way the SSH user never touches the host OS. cpu/mem/pids limits apply to both.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager provisions and attaches per-user pods.
func Detect ¶
Detect picks the best available engine. Returns an error if neither podman nor docker is present. usersDir is the host <data>/users tree: when non-empty, each pod bind-mounts <usersDir>/<user>/public_html at /home/dev/public_html so a member's ~/public_html is exactly the directory Caddy serves at <name>.<host>. Pass "" to disable the bind.
func (*Manager) Attach ¶
Attach provisions the pod and wires the SSH session to a shell inside it. Blocks until the shell exits or the session closes.
Source Files