package libcontainer

import "github.com/opencontainers/runc/libcontainer"

Package libcontainer provides a native Go implementation for creating containers with namespaces, cgroups, capabilities, and filesystem access controls. It allows you to manage the lifecycle of the container performing additional operations after the container is created.

Index

Variables

var (
	ErrExist          = errors.New("container with given ID already exists")
	ErrInvalidID      = errors.New("invalid container ID format")
	ErrNotExist       = errors.New("container does not exist")
	ErrPaused         = errors.New("container paused")
	ErrRunning        = errors.New("container still running")
	ErrNotRunning     = errors.New("container not running")
	ErrNotPaused      = errors.New("container not paused")
	ErrCgroupNotExist = errors.New("cgroup not exist")
)

Types

type BaseState

type BaseState struct {
	// ID is the container ID.
	ID string `json:"id"`

	// InitProcessPid is the init process id in the parent namespace.
	InitProcessPid int `json:"init_process_pid"`

	// InitProcessStartTime is the init process start time in clock cycles since boot time.
	InitProcessStartTime uint64 `json:"init_process_start"`

	// Created is the unix timestamp for the creation time of the container in UTC
	Created time.Time `json:"created"`

	// Config is the container's configuration.
	Config configs.Config `json:"config"`
}

BaseState represents the platform agnostic pieces relating to a running container's state

type IO

type IO struct {
	Stdin  io.WriteCloser
	Stdout io.ReadCloser
	Stderr io.ReadCloser
}

IO holds the process's STDIO

type Process

type Process struct {
	// The command to be run followed by any arguments.
	Args []string

	// Env specifies the environment variables for the process.
	Env []string

	// User will set the uid and gid of the executing process running inside the container
	// local to the container's user and group configuration.
	User string

	// AdditionalGroups specifies the gids that should be added to supplementary groups
	// in addition to those that the user belongs to.
	AdditionalGroups []string

	// Cwd will change the processes current working directory inside the container's rootfs.
	Cwd string

	// Stdin is a pointer to a reader which provides the standard input stream.
	Stdin io.Reader

	// Stdout is a pointer to a writer which receives the standard output stream.
	Stdout io.Writer

	// Stderr is a pointer to a writer which receives the standard error stream.
	Stderr io.Writer

	// ExtraFiles specifies additional open files to be inherited by the container
	ExtraFiles []*os.File

	// Initial sizings for the console
	ConsoleWidth  uint16
	ConsoleHeight uint16

	// Capabilities specify the capabilities to keep when executing the process inside the container
	// All capabilities not specified will be dropped from the processes capability mask
	Capabilities *configs.Capabilities

	// AppArmorProfile specifies the profile to apply to the process and is
	// changed at the time the process is execed
	AppArmorProfile string

	// Label specifies the label to apply to the process.  It is commonly used by selinux
	Label string

	// NoNewPrivileges controls whether processes can gain additional privileges.
	NoNewPrivileges *bool

	// Rlimits specifies the resource limits, such as max open files, to set in the container
	// If Rlimits are not set, the container will inherit rlimits from the parent process
	Rlimits []configs.Rlimit

	// ConsoleSocket provides the masterfd console.
	ConsoleSocket *os.File

	// PidfdSocket provides process file descriptor of it own.
	PidfdSocket *os.File

	// Init specifies whether the process is the first process in the container.
	Init bool

	// LogLevel is a string containing a numeric representation of the current
	// log level (i.e. "4", but never "info"). It is passed on to runc init as
	// _LIBCONTAINER_LOGLEVEL environment variable.
	LogLevel string

	// SubCgroupPaths specifies sub-cgroups to run the process in.
	// Map keys are controller names, map values are paths (relative to
	// container's top-level cgroup).
	//
	// If empty, the default top-level container's cgroup is used.
	//
	// For cgroup v2, the only key allowed is "".
	SubCgroupPaths map[string]string

	Scheduler *configs.Scheduler

	IOPriority *configs.IOPriority
	// contains filtered or unexported fields
}

Process specifies the configuration and IO for a process inside a container.

func (Process) Pid

func (p Process) Pid() (int, error)

Pid returns the process ID

func (Process) Signal

func (p Process) Signal(sig os.Signal) error

Signal sends a signal to the Process.

func (Process) Wait

func (p Process) Wait() (*os.ProcessState, error)

Wait waits for the process to exit. Wait releases any resources associated with the Process

type Status

type Status int

Status is the status of a container.

const (
	// Created is the status that denotes the container exists but has not been run yet.
	Created Status = iota
	// Running is the status that denotes the container exists and is running.
	Running
	// Paused is the status that denotes the container exists, but all its processes are paused.
	Paused
	// Stopped is the status that denotes the container does not have a created or running process.
	Stopped
)

func (Status) String

func (s Status) String() string

Source Files

container.go error.go process.go restored_process.go sync.go sync_unix.go

Directories

PathSynopsis
libcontainer/apparmor
libcontainer/capabilities
libcontainer/cgroups
libcontainer/cgroups/devicesImplements creation of eBPF device filter program.
libcontainer/cgroups/fs
libcontainer/cgroups/fs2
libcontainer/cgroups/fscommon
libcontainer/cgroups/manager
libcontainer/cgroups/systemd
libcontainer/configs
libcontainer/configs/validate
libcontainer/devices
libcontainer/integrationintegration is used for integration testing of libcontainer
libcontainer/intelrdt
libcontainer/keys
libcontainer/logs
libcontainer/nsenter
libcontainer/nsenter/test
libcontainer/seccomp
libcontainer/seccomp/patchbpf
libcontainer/specconv
libcontainer/system
libcontainer/userPackage user is an alias for github.com/moby/sys/user.
libcontainer/usernsDeprecated: use github.com/moby/sys/userns
libcontainer/utils
Version
v1.2.6
Published
Mar 14, 2025
Platform
js/wasm
Imports
15 packages
Last checked
3 hours ago

Tools for package owners.