Documentation
¶
Overview ¶
Package oci builds the deny-all profile. Encoding a spec does not qualify a runtime; a deployed runsc adapter must enforce and probe every control.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ContainedSpec ¶
ContainedSpec places the payload beneath its fixed worker service cgroup. The service must delegate CPU, memory and PID controllers, place the worker in its supervisor subgroup, and enforce a kill policy for the complete tree. This encoding does not attest to those external controls being installed.
func Spec ¶
Spec encodes a sealed job with host-staged rootfs and input paths. Staging must verify the pinned image and each evidence digest before creating the bundle. No workload-supplied host paths, namespaces, capabilities or hooks are accepted. The adapter must additionally use runsc --network=none, enforce the wall/output limits, and tear down the complete sandbox. Inputs must be regular files.
func WorkspaceSpec ¶
func WorkspaceSpec(j sandbox.Job, rootfs string, inputs map[string]string, scratch string) (*specs.Spec, error)
WorkspaceSpec binds /tmp to the worker's bounded scratch filesystem so files survive runtime deletion for host-authorized export. The caller must verify its mount identity, quotas and isolation before every runtime command.
Types ¶
This section is empty.
Source Files