containerbridge

type Config struct {
	// Image is the docker image reference (e.g. "ghcr.io/onekey-sec/unblob:latest").
	// Required.
	Image string

	// Args are the entrypoint arguments passed to the container.
	Args []string

	// Env is the environment exposed to the container.
	Env map[string]string

	// Mounts are bind mounts from the host into the container.
	Mounts []Mount

	// Stdin streams into the container's stdin. Nil means no stdin.
	Stdin io.Reader

	// Network controls --network. Empty defaults to "none" — most tool
	// runs do not need network and the safe default avoids data
	// exfiltration risk.
	Network string

	// Timeout caps the entire run. Zero defaults to 5 minutes.
	Timeout time.Duration

	// User runs the container as a specific UID:GID. Empty leaves it
	// at the image's default. Set to e.g. "1000:1000" to match the
	// host operator and simplify volume-mounted output.
	User string

	// WorkDir sets the container working directory.
	WorkDir string

	// Sandbox extras — read-only rootfs, drop capabilities. Set true
	// for tools that don't need to mutate the rootfs (most parsers).
	ReadOnlyRootfs bool

	// AllocateTTY forces -t. Generally not needed — only set true for
	// tools that misbehave without one.
	AllocateTTY bool
}

type Mount struct {
	HostPath      string
	ContainerPath string
	ReadOnly      bool
}

type RunError struct {
	ExitCode int
	Stderr   string
}

type RunResult struct {
	Stdout []byte
	Stderr []byte

	// ExitCode is 0 when the tool exited successfully, non-zero
	// otherwise. Always populated, even on RunError.
	ExitCode int

	// Duration is the wall-clock time the container ran.
	Duration time.Duration
}