oci package

❖

const (
	// ConfigFileName is the name of the config file
	ConfigFileName = "config.json"

	// RunjExtensionFileName is the name of an additional file, specifying only
	// the experimental FreeBSD section, which can be merged into the regular
	// bundle config.  This allows for software which generates a config file
	// unaware of FreeBSD and runj to be augmented by an additional program
	// that specifies additional settings.
	RunjExtensionFileName = "runj.ext.json"
)

func LoadConfig ¶

❖

func LoadConfig(id string) (*runtimespec.Spec, error)

func LoadProcess ¶

❖

func LoadProcess(id string, pid int) (*runtimespec.Process, error)

LoadProcess loads the configuration for a secondary process previously persisted by StoreProcess.

func RemoveProcess ¶

❖

func RemoveProcess(id string, pid int) error

RemoveProcess removes the persisted configuration for a secondary process. Any files not removed here (e.g. if runj-entrypoint dies before consuming its file) are cleaned up when the container's state directory is removed on delete.

func StoreConfig ¶

❖

func StoreConfig(id, bundlePath string) error

StoreConfig copies the config file provided in the input bundle to the state directory for the container. The file must be copied to comply with this requirement from the OCI runtime specification: Any changes made to the config.json file after this operation will not have an effect on the container.

func StoreProcess ¶

❖

func StoreProcess(id string, pid int, process *runtimespec.Process) error

StoreProcess persists the configuration for a secondary process (one started by `runj exec` rather than the jail's init process) to the container's state directory.

Unlike the init process, whose configuration is part of the persisted config.json, a secondary process is transient and per-invocation, so its configuration cannot be read back from config.json. runj-entrypoint runs inside the jail and needs the process configuration (cwd, and in the future user/umask/rlimits/...) after it has chroot'd, so the configuration must be handed to it out-of-band. Rather than widen runj-entrypoint's argument or environment contract (which would break across version skew; see the design doc), runj writes the configuration here and runj-entrypoint reads it back with LoadProcess.

The file is keyed by pid: `runj exec` exec(2)s into runj-entrypoint, which preserves the pid, so runj-entrypoint can locate its own file with getpid(2) without anything extra being passed on the wire. Concurrent execs use distinct pids and therefore distinct files.

func ValidateProcess ¶

❖

func ValidateProcess(process *runtimespec.Process) error

ValidateProcess checks the process fields runj applies from inside the jail. The OCI runtime spec requires process.cwd to be an absolute path; runj treats an empty cwd as the jail root but rejects a relative one, which would resolve against an unspecified directory.

Index ¶