Documentation
¶
Overview ¶
Package containerd implements the runtime.Runtime port over containerd + runc on Linux (ADR-0011): pull a curated runtime image, run it as a runc container with conservative OCI defaults (no added caps, no_new_privileges, optional limits), attach a per-worker netns with default-deny lateral (go-cni bridge + firewall), and harvest logs via cio.LogFile. One driver subpackage; the port stays container-lib-free. Integration-tested on the Linux lane (FUNCD_IT=1, root).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func New ¶
New connects to containerd and loads the CNI config, returning a Linux containerd-backed runtime.Runtime. It self-provisions its CNI before cni.Load (ADR-0056): it writes funcd's conflist into CNIConfDir if absent (never clobbering an existing one) and enables ip_forward (best-effort — a missing /proc on a non-standard host is logged, not fatal).
Types ¶
type Config ¶
type Config struct {
Socket string // /run/containerd/containerd.sock
Snapshotter string // overlayfs
CNIBinDir string // /opt/cni/bin
CNIConfDir string // funcd-written conflist dir
StateDir string // funcd-owned dir for runtime-generated worker files (e.g. resolv.conf); dataDir-relative
SubnetCIDR string // lateral bridge subnet
}
Config configures the containerd driver (the composition root supplies it).
Source Files