Documentation
¶
Overview ¶
Package containerd implements the runtime.Runtime port over containerd + runc on Linux (ADR-0011): pull a curated runtime image, run it as a runc container with conservative OCI defaults (no added caps, no_new_privileges, optional limits), attach a per-worker netns with default-deny lateral (go-cni bridge + firewall), and read each task's stdout and stderr through FIFOs (ADR-0168). One driver subpackage; the port stays container-lib-free. Integration-tested on the Linux lane (FUNCD_IT=1, root).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func New ¶
New connects to containerd and loads the CNI config, returning a Linux containerd-backed runtime.Runtime. It self-provisions its CNI before cni.Load (ADR-0056): it writes funcd's conflist into CNIConfDir if absent (never clobbering an existing one) and enables ip_forward (best-effort — a missing /proc on a non-standard host is logged, not fatal).
Types ¶
type Config ¶
type Config struct {
Socket string // /run/containerd/containerd.sock
Snapshotter string // overlayfs
CNIBinDir string // /opt/cni/bin
CNIConfDir string // funcd-written conflist dir
StateDir string // funcd-owned dir for runtime-generated worker files (e.g. resolv.conf); dataDir-relative
SubnetCIDR string // lateral bridge subnet
Logger *slog.Logger // nil ⇒ slog.Default()
// Pullable reports whether an image ref that is not embedded may be pulled (ctrmanager.Config.Pullable);
// nil ⇒ none may.
Pullable func(ref string) bool
// Private marks Socket as funcd's private managed containerd (ADR-0054): no other owner runs workers in it, so
// Close may sweep every funcd namespace in it. An external containerd may hold another daemon's or a bench's
// workers (ADR-0055), so there Close stops only the workers this driver runs.
Private bool
}
Config configures the containerd driver (the composition root supplies it).
Source Files