gvisor

func CreateSpec ¶

func CreateSpec(cfg ContainerConfig) (string, error)

CreateSpec builds an OCI runtime spec for running the container described by cfg under gVisor and returns it as a config.json string.

When the container is run with non-zero UID, it creates its own nested user namespace to work-around gVisor limitation: https://github.com/google/gvisor/issues/13564

func Exec ¶

func Exec(args []string, env []string, terminal bool, paths *jailfs.Paths, cwdInSandbox string) error