// Package container provides pre-forked container environment to // run programs in isolated Linux namespaces. // // Overview // // It creates container within unshared container and communicate // with host process using unix socket with // oob for fd / pid and commands encoded by gob. // // Protocol // // Host to container communication protocol is single threaded and always initiated by // the host: // // - ping (alive check): // - reply: pong // // - conf (set configuration): // - reply pong // // - open (open files in given mode inside container): // - send: []OpenCmd // - reply: "success", file fds / "error" // // - delete (unlink file / rmdir dir inside container): // - send: path // - reply: "finished" / "error" // // - reset (clean up container for later use (clear workdir / tmp)): // - send: // - reply: "success" // // - execve: (execute file inside container): // - send: argv, env, rLimits, fds // - reply: // - success: "success", pid // - failed: "failed" // - send (success): "init_finished" (as cmd) // - reply: "finished" / send: "kill" (as cmd) // - send: "kill" (as cmd) / reply: "finished" // - reply: // // Any socket related error will cause the container exit with all process inside container package container