runtime

type Config struct {
	Type       string            // "docker" or "kubernetes"
	Endpoint   string            // Docker socket or K8s API endpoint
	Namespace  string            // K8s namespace
	KubeConfig string            // Path to kubeconfig file
	Labels     map[string]string // Default labels for agents

	// Image validation and security settings
	EnableImageValidation bool     // Enable image validation
	EnableSecurityScan    bool     // Enable vulnerability scanning
	AllowedRegistries     []string // List of allowed registries
	BlockedRegistries     []string // List of blocked registries
	RequireImageDigest    bool     // Require images to have digest
	MaxImageAgeDays       int      // Maximum age of images in days
	EnforceTrustedImages  bool     // Require signed images

	// CVE thresholds
	AllowCriticalCVEs bool // Allow images with critical CVEs
	MaxHighCVEs       int  // Maximum allowed high severity CVEs
	MaxMediumCVEs     int  // Maximum allowed medium severity CVEs
}

type DockerFactory struct{}

type DockerManifestList struct {
	SchemaVersion int    `json:"schemaVersion"`
	MediaType     string `json:"mediaType"`
	Manifests     []struct {
		MediaType string `json:"mediaType"`
		Size      int64  `json:"size"`
		Digest    string `json:"digest"`
		Platform  struct {
			Architecture string `json:"architecture"`
			OS           string `json:"os"`
		} `json:"platform"`
	} `json:"manifests"`
}

type DockerRuntime struct {
	// contains filtered or unexported fields
}

type Factory interface {
	Create(config Config) (Runtime, error)
}

type GVisorConfig struct {
	Config // Embed base config

	// gVisor specific settings
	Platform        GVisorPlatform `json:"platform,omitempty"`
	Debug           bool           `json:"debug,omitempty"`
	LogLevel        string         `json:"log_level,omitempty"`
	EnableProfiling bool           `json:"enable_profiling,omitempty"`

	// Security settings
	EnableSandbox   bool     `json:"enable_sandbox"`
	AllowedSyscalls []string `json:"allowed_syscalls,omitempty"`
	BlockedSyscalls []string `json:"blocked_syscalls,omitempty"`
	EnableSeccomp   bool     `json:"enable_seccomp"`
	EnableAppArmor  bool     `json:"enable_apparmor"`

	// Network settings
	NetworkMode string   `json:"network_mode,omitempty"` // "none", "host", "bridge"
	EnableIPv6  bool     `json:"enable_ipv6,omitempty"`
	DNSServers  []string `json:"dns_servers,omitempty"`

	// Resource settings
	EnableCgroups bool   `json:"enable_cgroups"`
	CgroupsPath   string `json:"cgroups_path,omitempty"`

	// Image settings
	ImageCacheSize int64         `json:"image_cache_size,omitempty"` // In bytes
	ImageCacheTTL  time.Duration `json:"image_cache_ttl,omitempty"`

	// Monitoring
	EnableHealthChecks  bool          `json:"enable_health_checks"`
	HealthCheckInterval time.Duration `json:"health_check_interval,omitempty"`
}

type GVisorPlatform string

type GVisorRuntime struct {
	// contains filtered or unexported fields
}

type HealthStatus struct {
	Status       string    `json:"status"` // healthy, unhealthy, starting
	LastCheck    time.Time `json:"last_check"`
	FailureCount int       `json:"failure_count"`
	Output       string    `json:"output,omitempty"`
}

type ImageCacheEntry struct {
	Digest   string
	Size     int64
	LastUsed time.Time
	Path     string
	Layers   []string
	Config   map[string]interface{} // Generic config, was *v1.Image
}

type KubernetesFactory struct{}

type KubernetesRuntime struct {
	// contains filtered or unexported fields
}

type NetworkConfig struct {
	Mode      string            `json:"mode"`
	IPAddress string            `json:"ip_address,omitempty"`
	Gateway   string            `json:"gateway,omitempty"`
	DNS       []string          `json:"dns,omitempty"`
	Ports     map[string]string `json:"ports,omitempty"`
}

type OCIManifest struct {
	SchemaVersion int    `json:"schemaVersion"`
	MediaType     string `json:"mediaType"`
	Config        struct {
		MediaType string `json:"mediaType"`
		Size      int64  `json:"size"`
		Digest    string `json:"digest"`
	} `json:"config"`
	Layers []struct {
		MediaType string `json:"mediaType"`
		Size      int64  `json:"size"`
		Digest    string `json:"digest"`
	} `json:"layers"`
}

type OCIPuller struct {
	// contains filtered or unexported fields
}

type ResourceUsage struct {
	CPUUsage    float64   `json:"cpu_usage"`
	MemoryUsage int64     `json:"memory_usage"`
	DiskUsage   int64     `json:"disk_usage"`
	NetworkRx   int64     `json:"network_rx"`
	NetworkTx   int64     `json:"network_tx"`
	UpdatedAt   time.Time `json:"updated_at"`
}

type Runtime interface {
	// CreateAgent creates a new agent container
	CreateAgent(ctx context.Context, agent *types.Agent) error

	// StartAgent starts an agent container
	StartAgent(ctx context.Context, agentID string) error

	// StopAgent stops an agent container
	StopAgent(ctx context.Context, agentID string) error

	// DestroyAgent removes an agent container
	DestroyAgent(ctx context.Context, agentID string) error

	// GetAgentStatus returns the current status of an agent
	GetAgentStatus(ctx context.Context, agentID string) (*types.Agent, error)

	// ListAgents returns all agents managed by this runtime
	ListAgents(ctx context.Context) ([]*types.Agent, error)

	// StreamLogs streams logs from an agent container
	StreamLogs(ctx context.Context, agentID string) (io.ReadCloser, error)

	// ExecCommand executes a command in an agent container
	ExecCommand(ctx context.Context, agentID string, cmd []string) (io.ReadCloser, error)
}

type TokenResponse struct {
	Token       string `json:"token"`
	AccessToken string `json:"access_token"`
	ExpiresIn   int    `json:"expires_in"`
}