sandbox

type ApprovalDecision string

type ApproveSensitiveOperationRequest struct {
	SensitiveOperationID OperationID
	Decision             ApprovalDecision
	ExpiresAt            time.Time
}

type ArtifactID string

type ArtifactRef struct {
	ID        ArtifactID
	MediaType string
	SizeBytes uint64
	Digest    Digest
}

type ArtifactResult struct{ Artifact ArtifactRef }

type AttachVolumeRequest struct {
	SandboxID SandboxID
	VolumeID  VolumeID
	Target    GuestPath
	Mode      AttachmentMode
}

type AttachmentMode string

type CapabilityDescriptor struct {
	State              CapabilityState
	ContractVersion    string
	ConformanceVersion string
	DataPlane          string
	LimitPrecision     []string
}

type CapabilityFeature string

type CapabilityRequirement struct {
	Feature CapabilityFeature
	Minimum CapabilityState
}

type CapabilityRequirements struct{ Required []CapabilityRequirement }

type CapabilitySnapshot struct {
	Digest          Digest
	SchemaVersion   string
	ControlProtocol CapabilityDescriptor
	Isolation       CapabilityDescriptor
	Guest           CapabilityDescriptor
	Resources       CapabilityDescriptor
	Reconnect       CapabilityDescriptor
	ImageAdmission  CapabilityDescriptor
	Output          CapabilityDescriptor
	Transfer        CapabilityDescriptor
	Mounts          CapabilityDescriptor
	Volumes         CapabilityDescriptor
	Snapshots       CapabilityDescriptor
	Egress          CapabilityDescriptor
	Secrets         CapabilityDescriptor
	Signals         []Signal
	Trust           KeyLifecycle
}

type CapabilityState string

type Client interface {
	Submit(context.Context, OperationRequest) (OperationRef, error)
	GetOperation(context.Context, OperationID) (Operation, error)
	WaitOperation(context.Context, OperationID) (Operation, error)
	WatchOperation(context.Context, OperationID, OperationCursor) (OperationStream, error)
	GetSandbox(context.Context, SandboxID) (SandboxInfo, error)
	GetProcess(context.Context, ProcessID) (ProcessInfo, error)
	ReplayOutput(context.Context, ProcessID, OutputCursor) (OutputStream, error)
	GetVolume(context.Context, VolumeID) (VolumeInfo, error)
	ListVolumes(context.Context, Page) (VolumePage, error)
	GetSnapshot(context.Context, SnapshotID) (SnapshotInfo, error)
	ListSnapshots(context.Context, Page) (SnapshotPage, error)
	Close(context.Context) error
}

type ClientConfig struct {
	Endpoint       Endpoint
	TLS            TLSConfig
	Credentials    CredentialSource
	TrustBundles   TrustBundleSource
	RequestTimeout time.Duration
}

type CloseSandboxRequest struct{ SandboxID SandboxID }

type Command struct {
	Executable              GuestPath
	Argv                    []string
	WorkDir                 GuestPath
	User                    NumericIdentity
	Umask                   FileMode
	Environment             map[string]string
	Grant                   Grant
	StartDeadline           time.Duration
	RuntimeLimit            time.Duration
	BindLifetimeToOperation bool
}

type ControlAction string

type ControlResult struct {
	Action  ControlAction
	Cleanup TreeCleanupState
}

type CopyInRequest struct {
	SandboxID   SandboxID
	Source      ArtifactRef
	Destination GuestPath
	Options     TransferOptions
}

type CopyOutRequest struct {
	SandboxID SandboxID
	Source    GuestPath
	Options   TransferOptions
}

type CreateSandboxRequest struct{ Spec SandboxSpec }

type CreateVolumeRequest struct{ Spec VolumeSpec }

type CredentialSink interface {
	SetAuthorization(string, string) error
	ClearAuthorization()
}

type CredentialSource interface {
	Apply(context.Context, CredentialSink) error
}

type DeleteSnapshotRequest struct{ SnapshotID SnapshotID }

type DeleteVolumeRequest struct{ VolumeID VolumeID }

type DetachVolumeRequest struct {
	SandboxID SandboxID
	VolumeID  VolumeID
}

type Digest string

type DomainPattern string

type Endpoint struct{ URL string }

type Error struct {
	// contains filtered or unexported fields
}

type ExecProcessRequest struct {
	SandboxID SandboxID
	Command   Command
}

type Failure struct {
	Code    FailureCode
	Message string
	Retry   RetryClass
	Details []FailureDetail
}

type FailureCode string

type FailureDetail struct {
	Key   FailureDetailKey
	Value string
}

type FailureDetailKey string

type FileMode uint32

type Grant struct {
	Secrets GrantSelection
	Mounts  GrantSelection
	Network NetworkGrantSelection
}

type GrantMode string

type GrantSelection struct {
	Mode  GrantMode
	Names []string
}

type GuestPath string

type HostID string

type HostRoute struct {
	HostID         HostID
	Generation     uint64
	LeaseExpiresAt time.Time
}

type ImageInfo struct {
	Digest                 Digest
	Architecture           string
	Identity               NumericIdentity
	GuestProtocol          string
	AdmissionPolicyVersion string
}

type ImageRef struct{ Digest Digest }

type KeyLifecycle struct {
	TrustBundleVersion      string
	ControlSigningKeyID     string
	ControlSigningAlgorithm string
	RevocationEpoch         uint64
	NotBefore               time.Time
	NotAfter                time.Time
	RotationGrace           time.Duration
}

type KillProcessRequest struct{ ProcessID ProcessID }

type MountMode string

type MountRequest struct {
	Name   string
	Target GuestPath
	Mode   MountMode
	View   MountView
}

type MountView string

type NetworkGrantSelection struct {
	Mode  GrantMode
	Rules []NetworkRule
}

type NetworkProtocol string

type NetworkRule struct {
	Protocol NetworkProtocol
	Domain   DomainPattern
	Ports    []PortRange
}

type NumericIdentity struct {
	UID    uint32
	GID    uint32
	Groups []uint32
}

type Operation struct {
	Ref                 OperationRef
	Kind                OperationKind
	State               OperationState
	Target              OperationTarget
	CanonicalDigest     Digest
	EffectiveSpecDigest Digest
	CapabilityDigest    Digest
	Result              *OperationResult
	Failure             *Failure
	RetentionExpiresAt  time.Time
	LatestCursor        OperationCursor
}

type OperationAdmissionPolicy struct {
	Version               string
	CanonicalizerVersion  string
	CapabilityVersion     string
	ImageAdmissionVersion string
	Defaults              ResourceLimits
	Maximum               ResourceLimits
	Capabilities          CapabilitySnapshot
	AdmittedImages        map[Digest]ImageInfo
}

type OperationCursor string

type OperationEvent struct {
	Kind   OperationEventKind
	Cursor OperationCursor
	Update *Operation
	Gap    *OperationGap
}

type OperationEventKind string

type OperationGap struct {
	EarliestRetained OperationCursor
	Reason           string
}

type OperationID string

type OperationKind string

type OperationRef struct {
	ID         OperationID
	AcceptedAt time.Time
}

type OperationRequest struct {
	ID               OperationID
	Kind             OperationKind
	CreateSandbox    *CreateSandboxRequest
	RestoreSandbox   *RestoreSandboxRequest
	ExecProcess      *ExecProcessRequest
	SignalProcess    *SignalProcessRequest
	KillProcess      *KillProcessRequest
	CopyIn           *CopyInRequest
	CopyOut          *CopyOutRequest
	SnapshotSandbox  *SnapshotSandboxRequest
	CloseSandbox     *CloseSandboxRequest
	ReconcileSandbox *ReconcileSandboxRequest
	CreateVolume     *CreateVolumeRequest
	AttachVolume     *AttachVolumeRequest
	DetachVolume     *DetachVolumeRequest
	DeleteVolume     *DeleteVolumeRequest
	DeleteSnapshot   *DeleteSnapshotRequest
	ApproveSensitive *ApproveSensitiveOperationRequest
}

type OperationResult struct {
	Kind     OperationResultKind
	Sandbox  *SandboxResult
	Process  *ProcessResult
	Artifact *ArtifactResult
	Volume   *VolumeResult
	Snapshot *SnapshotResult
	Control  *ControlResult
}

type OperationResultKind string

type OperationState string

type OperationStream interface {
	Next(context.Context) (OperationEvent, error)
	Close() error
}

type OperationTarget struct {
	Kind        OperationTargetKind
	SandboxID   SandboxID
	ProcessID   ProcessID
	VolumeID    VolumeID
	SnapshotID  SnapshotID
	OperationID OperationID
}

type OperationTargetKind string

type OutputChunk struct {
	Bytes    []byte
	Redacted bool
}

type OutputCursor string

type OutputEvent struct {
	Kind   OutputEventKind
	Cursor OutputCursor
	Stream OutputKind
	Chunk  *OutputChunk
	Gap    *OutputGap
	Final  *OutputFinal
}

type OutputEventKind string

type OutputFinal struct{ Result ProcessResult }

type OutputGap struct {
	EarliestRetained OutputCursor
	Reason           string
}

type OutputKind string

type OutputRetention struct {
	EarliestCursor OutputCursor
	RetainedBytes  uint64
	Truncated      bool
}

type OutputStream interface {
	Next(context.Context) (OutputEvent, error)
	Close() error
}

type OverwriteMode string

type Page struct {
	Cursor PageCursor
	Limit  uint32
}

type PageCursor string

type PortRange struct {
	First uint16
	Last  uint16
}

type ProcessID string

type ProcessInfo struct {
	ID        ProcessID
	SandboxID SandboxID
	State     ProcessState
	Result    *ProcessResult
	Stdout    OutputRetention
	Stderr    OutputRetention
}

type ProcessResult struct {
	StartedAt  time.Time
	FinishedAt time.Time
	ExitCode   *int
	Signal     *Signal
	Reason     TerminationReason
	Usage      ResourceUsage
	Cleanup    TreeCleanupState
}

type ProcessState string

type ReconcileSandboxRequest struct{ SandboxID SandboxID }

type ResolvedOperation struct {
	Operation Operation
	// InputDigest identifies the exact canonical wire request before operator
	// defaults are resolved. Control stores use it to reconnect retries to the
	// already accepted effective policy instead of silently adopting new defaults.
	InputDigest     Digest
	CleanupRequired bool
}

type ResourceLimits struct {
	MilliCPU            uint32
	MemoryBytes         uint64
	RootDiskBytes       uint64
	TmpfsBytes          uint64
	PIDs                uint32
	ProcessCount        uint32
	OpenFiles           uint32
	Inodes              uint64
	Files               uint64
	Lifetime            time.Duration
	ProducedOutputBytes uint64
	RetainedOutputBytes uint64
	TransferBytes       uint64
	NetworkConnections  uint32
	VolumeBytes         uint64
	SnapshotBytes       uint64
}

type ResourceUsage struct {
	CPUTime         time.Duration
	PeakMemoryBytes uint64
	ReadBytes       uint64
	WrittenBytes    uint64
}

type RestoreSandboxRequest struct {
	SnapshotID SnapshotID
	Overrides  SandboxOverrides
}

type RetryClass string

type SandboxActualState string

type SandboxDesiredState string

type SandboxID string

type SandboxInfo struct {
	ID           SandboxID
	Desired      SandboxDesiredState
	Actual       SandboxActualState
	Image        ImageInfo
	Resources    ResourceLimits
	Capabilities CapabilitySnapshot
	Host         HostRoute
	Failure      *Failure
}

type SandboxOverrides struct {
	Resources    *ResourceLimits
	Capabilities *CapabilityRequirements
}

type SandboxResult struct{ ID SandboxID }

type SandboxSpec struct {
	Image             ImageRef
	Resources         ResourceLimits
	Environment       map[string]string
	SecretBindings    []SecretBinding
	VolumeAttachments []VolumeAttachment
	Mounts            []MountRequest
	Tmpfs             []TmpfsMount
	Capabilities      CapabilityRequirements
	Labels            map[string]string
}

type SecretBinding struct {
	Name    string
	Purpose string
}

type Signal string

type SignalProcessRequest struct {
	ProcessID ProcessID
	Signal    Signal
}

type SnapshotID string

type SnapshotInfo struct {
	ID                 SnapshotID
	SourceSandboxID    SandboxID
	Digest             Digest
	SizeBytes          uint64
	Tainted            bool
	RetentionExpiresAt time.Time
}

type SnapshotPage struct {
	Items []SnapshotInfo
	Next  PageCursor
}

type SnapshotResult struct{ ID SnapshotID }

type SnapshotRiskAttestation struct {
	Risk  string
	Owner string
}

type SnapshotSandboxRequest struct {
	SandboxID       SandboxID
	RiskAttestation *SnapshotRiskAttestation
}

type StaticTrustBundleSource struct {
	// contains filtered or unexported fields
}

type TLSConfig struct {
	ServerName     string
	TrustBundleRef TrustBundleRef
}

type TerminationReason string

type TmpfsMount struct {
	Target    GuestPath
	SizeBytes uint64
	Mode      FileMode
}

type TransferOptions struct {
	Overwrite OverwriteMode
	Mode      FileMode
	Owner     *NumericIdentity
	Durable   bool
}

type TreeCleanupState string

type TrustBundle struct {
	Version  string
	PEMRoots []byte
}

type TrustBundleRef string

type TrustBundleSource interface {
	ResolveTrustBundle(context.Context, TrustBundleRef) (TrustBundle, error)
}

type VolumeAttachment struct {
	VolumeID VolumeID
	Target   GuestPath
	Mode     AttachmentMode
}

type VolumeAttachmentInfo struct {
	SandboxID      SandboxID
	Generation     uint64
	LeaseExpiresAt time.Time
	Mode           AttachmentMode
}

type VolumeID string

type VolumeInfo struct {
	ID                 VolumeID
	SizeBytes          uint64
	Inodes             uint64
	Attachment         *VolumeAttachmentInfo
	Tainted            bool
	RetentionExpiresAt time.Time
}

type VolumePage struct {
	Items []VolumeInfo
	Next  PageCursor
}

type VolumeResult struct {
	ID         VolumeID
	Attachment *VolumeAttachmentInfo
}

type VolumeSpec struct {
	SizeBytes uint64
	Inodes    uint64
	Labels    map[string]string
}