import "go.sbk.wtf/runj/jail"
AwaitFifoOpen waits for a runj-entrypoint process to open the fifo passed to it. The fifo is used to indicate when runj-entrypoint should start the process inside the jail.
CleanupEntrypoint sends a SIGTERM to the PID recorded in the state file. This function returns with no error even if the process is not running or cannot be signaled.
ExecEntrypoint execs a runj-entrypoint process in order to start a secondary process inside the jail.
The process's configuration (cwd, and in the future user/umask/rlimits/...) is persisted to the state directory and read back by runj-entrypoint once it is inside the jail, rather than being passed on runj-entrypoint's argument or environment contract. Because this function exec(2)s into runj-entrypoint, the pid is preserved, so runj-entrypoint can find the file with getpid(2). See docs/entrypoint-process-config.md for the rationale.
Note: this API is unstable; expect it to change.
IsRunning attempts to determine whether a given jail is running. This is accomplished by looking to see whether the jail's primary pid (passed as an argument) is still active and by whether there are any processes present in the jail. This function is best-effort, racy, and subject to change. It currently depends on the host's "ps" command.
Kill sends a signal to a process in a jail
KillAll sends a signal to all processes in a jail
func Mount(ociConfig *runtimespec.Spec) error
Mount mounts the mounts
func MoveVNetInterfaces(ctx context.Context, ociConfig *runtimespec.Spec, j Jail, reverse VNetMove) error
func SetupEntrypoint(id string, init bool, argv []string, env []string, consoleSocketPath string) (*exec.Cmd, error)
SetupEntrypoint starts a runj-entrypoint process, which is used to start processes inside the jail.
When used to start the jail's init process, runj-entrypoint will later be signalled through `runj start` to run the specified program in the jail. This indirection is necessary so that the STDIO for `runj create` or the supplied console socket is directed to that process.
When used to start a secondary process inside the jail, the waiting step is skipped and runj-entrypoint will immediately proceed to create the process as soon as STDIO is configured.
Note: this API is unstable; expect it to change. The init process's configuration (cwd, and in the future user/umask/rlimits/...) is not passed here: runj-entrypoint reads it back from the persisted config.json once it is inside the jail. See docs/entrypoint-process-config.md.
func Unmount(ociConfig *runtimespec.Spec) error
Unmount attempts to unmount all mounts present in the spec. If multiple errors occur, Unmount returns the first.
type CreateAllowParams struct {
AllowSetHostname bool
AllowRawSockets bool
AllowChFlags bool
AllowMount []string
AllowQuotas bool
AllowSocketAf bool
AllowMlock bool
AllowReservedPorts bool
AllowSuser bool
}
type CreateParams struct {
Name string
Root string
Hostname string
Domainname string
Host string
IP4 string
IP4Addr []string
IP6 string
IP6Addr []string
VNet string
// VNetInterface
// Deprecated: not used
VNetInterface []string
// EnforceStatfs controls mount visibility (0, 1, or 2); nil leaves the
// kernel default.
EnforceStatfs *int
SysVMsg string
SysVSem string
SysVShm string
Allow *CreateAllowParams
}
CreateParams is a limited subset of the parameters available in jail.conf(5) for use with jail(8).
ID identifies jails
type Jail interface {
// Attach attaches the current running process to the jail
Attach() error
// Remove destroys the jail
Remove() error
// contains filtered or unexported methods
}
Jail represents an existing jail
func Create(config *CreateParams) (Jail, error)
FromName queries the OS for a jail with the specified name
entrypoint.go jail.go kill.go mount.go params.go ps.go syscall.go vnet.go