package libcontainer
import "github.com/opencontainers/runc/libcontainer"
Package libcontainer provides a native Go implementation for creating containers with namespaces, cgroups, capabilities, and filesystem access controls. It allows you to manage the lifecycle of the container performing additional operations after the container is created.
Index ¶
- Variables
- type BaseState
- type IO
- type Process
- func (p Process) Pid() (int, error)
- func (p Process) Signal(sig os.Signal) error
- func (p Process) Wait() (*os.ProcessState, error)
- type Status
Variables ¶
var ( ErrExist = errors.New("container with given ID already exists") ErrInvalidID = errors.New("invalid container ID format") ErrNotExist = errors.New("container does not exist") ErrPaused = errors.New("container paused") ErrRunning = errors.New("container still running") ErrNotRunning = errors.New("container not running") ErrNotPaused = errors.New("container not paused") ErrCgroupNotExist = errors.New("cgroup not exist") )
Types ¶
type BaseState ¶
type BaseState struct { // ID is the container ID. ID string `json:"id"` // InitProcessPid is the init process id in the parent namespace. InitProcessPid int `json:"init_process_pid"` // InitProcessStartTime is the init process start time in clock cycles since boot time. InitProcessStartTime uint64 `json:"init_process_start"` // Created is the unix timestamp for the creation time of the container in UTC Created time.Time `json:"created"` // Config is the container's configuration. Config configs.Config `json:"config"` }
BaseState represents the platform agnostic pieces relating to a running container's state
type IO ¶
type IO struct { Stdin io.WriteCloser Stdout io.ReadCloser Stderr io.ReadCloser }
IO holds the process's STDIO
type Process ¶
type Process struct { // The command to be run followed by any arguments. Args []string // Env specifies the environment variables for the process. Env []string // UID and GID of the executing process running inside the container // local to the container's user and group configuration. UID, GID int // AdditionalGroups specifies the gids that should be added to supplementary groups // in addition to those that the user belongs to. AdditionalGroups []int // Cwd will change the process's current working directory inside the container's rootfs. Cwd string // Stdin is a reader which provides the standard input stream. Stdin io.Reader // Stdout is a writer which receives the standard output stream. Stdout io.Writer // Stderr is a writer which receives the standard error stream. Stderr io.Writer // ExtraFiles specifies additional open files to be inherited by the process. ExtraFiles []*os.File // Initial size for the console. ConsoleWidth uint16 ConsoleHeight uint16 // Capabilities specify the capabilities to keep when executing the process. // All capabilities not specified will be dropped from the processes capability mask. // // If not nil, takes precedence over container's [configs.Config.Capabilities]. Capabilities *configs.Capabilities // AppArmorProfile specifies the profile to apply to the process and is // changed at the time the process is executed. // // If not empty, takes precedence over container's [configs.Config.AppArmorProfile]. AppArmorProfile string // Label specifies the label to apply to the process. It is commonly used by selinux. // // If not empty, takes precedence over container's [configs.Config.ProcessLabel]. Label string // NoNewPrivileges controls whether processes can gain additional privileges. // // If not nil, takes precedence over container's [configs.Config.NoNewPrivileges]. NoNewPrivileges *bool // Rlimits specifies the resource limits, such as max open files, to set for the process. // If unset, the process will inherit rlimits from the parent process. // // If not empty, takes precedence over container's [configs.Config.Rlimit]. Rlimits []configs.Rlimit // ConsoleSocket provides the masterfd console. ConsoleSocket *os.File // PidfdSocket provides process file descriptor of it own. PidfdSocket *os.File // Init specifies whether the process is the first process in the container. Init bool // LogLevel is a string containing a numeric representation of the current // log level (i.e. "4", but never "info"). It is passed on to runc init as // _LIBCONTAINER_LOGLEVEL environment variable. LogLevel string // SubCgroupPaths specifies sub-cgroups to run the process in. // Map keys are controller names, map values are paths (relative to // container's top-level cgroup). // // If empty, the default top-level container's cgroup is used. // // For cgroup v2, the only key allowed is "". SubCgroupPaths map[string]string // Scheduler represents the scheduling attributes for a process. // // If not empty, takes precedence over container's [configs.Config.Scheduler]. Scheduler *configs.Scheduler // IOPriority is a process I/O priority. // // If not empty, takes precedence over container's [configs.Config.IOPriority]. IOPriority *configs.IOPriority CPUAffinity *configs.CPUAffinity // contains filtered or unexported fields }
Process defines the configuration and IO for a process inside a container.
Note that some Process properties are also present in container configuration (configs.Config). In all such cases, Process properties take precedence over container configuration ones.
func (Process) Pid ¶
Pid returns the process ID
func (Process) Signal ¶
Signal sends a signal to the Process.
func (Process) Wait ¶
func (p Process) Wait() (*os.ProcessState, error)
Wait waits for the process to exit. Wait releases any resources associated with the Process
type Status ¶
type Status int
Status is the status of a container.
const ( // Created is the status that denotes the container exists but has not been run yet. Created Status = iota // Running is the status that denotes the container exists and is running. Running // Paused is the status that denotes the container exists, but all its processes are paused. Paused // Stopped is the status that denotes the container does not have a created or running process. Stopped )
func (Status) String ¶
Source Files ¶
container.go env.go error.go process.go restored_process.go sync.go sync_unix.go
Directories ¶
Path | Synopsis |
---|---|
libcontainer/apparmor | |
libcontainer/capabilities | |
libcontainer/configs | |
libcontainer/configs/validate | |
libcontainer/devices | |
libcontainer/integration | integration is used for integration testing of libcontainer |
libcontainer/intelrdt | |
libcontainer/keys | |
libcontainer/logs | |
libcontainer/nsenter | |
libcontainer/nsenter/test | |
libcontainer/seccomp | |
libcontainer/seccomp/patchbpf | |
libcontainer/specconv | |
libcontainer/system | |
libcontainer/user | Package user is an alias for github.com/moby/sys/user. |
libcontainer/userns | Deprecated: use github.com/moby/sys/userns |
libcontainer/utils |
- Version
- v1.3.0 (latest)
- Published
- Apr 29, 2025
- Platform
- js/wasm
- Imports
- 18 packages
- Last checked
- 18 minutes ago –
Tools for package owners.