Documentation
¶
Index ¶
- Variables
- func DefaultRoot() (string, error)
- func Init()
- func ValidateName(name string) error
- type BuildOptions
- type Container
- type Engine
- func (e *Engine) Build(ctx context.Context, opts BuildOptions, stdio IO) (_ *Image, retErr error)
- func (e *Engine) Discard(path string) error
- func (e *Engine) Exec(ctx context.Context, name string, opts ExecOptions, io IO) (int, error)
- func (e *Engine) Export(ctx context.Context, name string, out io.Writer) error
- func (e *Engine) Images() ([]Image, error)
- func (e *Engine) Import(ctx context.Context, ref string, archive io.Reader) (*Image, error)
- func (e *Engine) ImportOCI(ctx context.Context, ref, path string) (*Image, error)
- func (e *Engine) Inspect(ctx context.Context, name string) (*Container, error)
- func (e *Engine) InspectImage(ref string) (*Image, error)
- func (e *Engine) List(ctx context.Context) ([]Container, error)
- func (e *Engine) PrepareRootfs(ctx context.Context, ref, dest string) (_ *Image, retErr error)
- func (e *Engine) Pull(ctx context.Context, ref string) (*Image, error)
- func (e *Engine) Remove(ctx context.Context, name string, force bool) error
- func (e *Engine) RemoveImage(ref string) error
- func (e *Engine) Rename(ctx context.Context, oldName, newName string) error
- func (e *Engine) Run(ctx context.Context, opts RunOptions, io IO) (int, error)
- func (e *Engine) Start(ctx context.Context, name string, io IO) (int, error)
- func (e *Engine) Stop(ctx context.Context, name string, timeout time.Duration) error
- type ExecOptions
- type IO
- type Image
- type Lifecycle
- type Mount
- type RunOptions
Constants ¶
This section is empty.
Variables ¶
var ErrUnsupported = errors.New("spod container execution requires Linux user namespaces")
Functions ¶
func DefaultRoot ¶
DefaultRoot returns the platform-standard location for spod's storage: $XDG_DATA_HOME/spod/storage (defaulting to ~/.local/share/spod/storage) on Linux and other Unix systems, ~/Library/Application Support/spod/storage on macOS, and %LOCALAPPDATA%\spod\storage on Windows. SPOD_ROOT overrides the location and must be absolute.
func Init ¶
func Init()
Init must be the very first call in main() for every binary that links this package. When the current process is a libcontainer re-exec (the init of a new container), it hands control to libcontainer and never returns. Otherwise it returns immediately and normal startup continues.
Detection uses the _LIBCONTAINER_INITPIPE environment marker that libcontainer sets on its re-exec child, so ordinary subcommands (e.g. a user-facing "init" wizard) are never mistaken for container init.
func ValidateName ¶
Types ¶
type BuildOptions ¶ added in v0.3.0
type BuildOptions struct {
// Context is the build context directory COPY and ADD read from.
Context string
// File is the Containerfile path; empty selects Containerfile, then
// Dockerfile, in Context.
File string
// Tag is the reference the built image is stored under.
Tag string
// BuildArgs override ARG defaults.
BuildArgs map[string]string
// Target selects the stage to build; empty builds the last one.
Target string
}
BuildOptions describes a Containerfile build.
type Engine ¶
type Engine struct {
Root string
}
Engine is a daemonless, per-user image and container store.
func (*Engine) Build ¶ added in v0.3.0
Build builds an image from a Containerfile and stores it under opts.Tag. Each RUN executes in a container on the stage's rootfs under the default mapping (container root is the caller) with host networking. The result is a single squashed layer over the stage's filesystem; file ownership is recorded in the layer, and extended attributes, including file capabilities, are not. Stages the target does not need are skipped.
func (*Engine) Discard ¶
Discard retains removed resources in the store's trash rather than deleting them.
func (*Engine) Export ¶
Export writes a container's root filesystem as a plain uncompressed tar stream. The archive holds the filesystem as the container sees it: entries are owned by root, with modes and symlinks preserved. Runtime bind mounts and device nodes are host resources and are not part of the archive. The container keeps running while it is exported; files written concurrently may be captured mid-write.
func (*Engine) Import ¶
Import builds a stored image from a plain filesystem tar, such as one produced by Export, so it can serve as the base image of other containers. The archive becomes the image's single layer; no entrypoint, environment, or history is inferred beyond a default PATH. The archive is buffered while the layer digest is computed. Import works on every platform; only running the resulting containers requires Linux.
func (*Engine) ImportOCI ¶ added in v0.2.0
ImportOCI stores an image tarball under ref. Both common save formats are accepted: the OCI layout (podman save --format oci-archive) and the docker-save layout (docker save). Unlike Import, the archive carries the image's real layers and configuration, so the stored image behaves exactly like the source: entrypoint, environment, and history included. The archive must contain a single-platform image matching the host.
func (*Engine) Inspect ¶
Inspect returns the current metadata for a container, reconciled with its live runtime state.
func (*Engine) InspectImage ¶
InspectImage reads local metadata without contacting a registry.
func (*Engine) PrepareRootfs ¶
PrepareRootfs creates an independent writable filesystem, never hardlinking files to the shared cache. dest must not exist, or must be an empty directory on the storage filesystem. The returned Image.Rootfs points to dest.
func (*Engine) Pull ¶
Pull downloads a Linux image for the host architecture without a daemon. A cached reference is reused; remove it explicitly to refresh a mutable tag.
func (*Engine) Remove ¶
Remove deletes a container's metadata and rootfs. A running container is only removed when force is true (it is killed first). Removed resources are moved to the store trash, never deleted outright.
func (*Engine) RemoveImage ¶
RemoveImage retains the image in trash and refuses references used by a container. Unreadable container metadata fails closed.
func (*Engine) Rename ¶
Rename changes a stopped container's name. Its store directories, metadata, named volumes, attach socket, and logs move with it, and mount sources referencing the moved volumes are rewritten. Running containers must be stopped first. Every move is journaled with its inverse, and metadata is replaced atomically, so a failure restores the original state instead of stranding data.
func (*Engine) Run ¶
Run creates a container with its own persistent rootfs and metadata, starts it, and blocks until the init process exits, returning its exit status. The caller (typically a detached monitor re-exec) owns stdio. Metadata reaches the running state (with PID) before Run begins waiting, so other processes can observe and signal it.
type ExecOptions ¶
type Image ¶
type Image struct {
Reference string
Digest string
Rootfs string
Config v1.Config
Created time.Time
Platform v1.Platform
}
Image describes an image and its unpacked filesystem. Pull and InspectImage return an immutable shared Rootfs; PrepareRootfs returns the writable copy.
type Lifecycle ¶
type Lifecycle interface {
Run(context.Context, RunOptions, IO) (int, error)
Start(context.Context, string, IO) (int, error)
Exec(context.Context, string, ExecOptions, IO) (int, error)
Stop(context.Context, string, time.Duration) error
Remove(context.Context, string, bool) error
Inspect(context.Context, string) (*Container, error)
List(context.Context) ([]Container, error)
}
Lifecycle is implemented directly by Engine on Linux and returns ErrUnsupported elsewhere.
type RunOptions ¶
type RunOptions struct {
Name string
Image string
Command []string
Entrypoint []string
Env []string
WorkDir string
User string
Hostname string
Mounts []Mount
Labels map[string]string
TTY bool
Interactive bool
Remove bool
Network string
// UserNS selects the user namespace mapping: "" maps the caller to
// container root; "keep-id" maps the caller to its own UID/GID and
// container root to a subordinate ID, like podman --userns=keep-id.
UserNS string
}