mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-09-26 23:19:11 +08:00
49 lines
990 B
Go
49 lines
990 B
Go
package unshare
|
|
|
|
import (
|
|
"github.com/criyle/go-sandbox/pkg/mount"
|
|
"github.com/criyle/go-sandbox/pkg/rlimit"
|
|
"github.com/criyle/go-sandbox/pkg/seccomp"
|
|
"github.com/criyle/go-sandbox/runner"
|
|
)
|
|
|
|
// Runner runs program in unshared namespaces
|
|
type Runner struct {
|
|
// argv and env for the child process
|
|
Args []string
|
|
Env []string
|
|
|
|
// fexecve param
|
|
ExecFile uintptr
|
|
|
|
// workdir is the current dir after unshare mount namespaces
|
|
WorkDir string
|
|
|
|
// file descriptors for new process, from 0 to len - 1
|
|
Files []uintptr
|
|
|
|
// Resource limit set by set rlimit
|
|
RLimits []rlimit.RLimit
|
|
|
|
// Resource limit enforced by tracer
|
|
Limit runner.Limit
|
|
|
|
// Seccomp defines the seccomp filter attach to the process (should be whitelist only)
|
|
Seccomp seccomp.Filter
|
|
|
|
// New root
|
|
Root string
|
|
|
|
// Mount syscalls
|
|
Mounts []mount.SyscallParams
|
|
|
|
// hostname & domainname
|
|
HostName, DomainName string
|
|
|
|
// Show Details
|
|
ShowDetails bool
|
|
|
|
// Use by cgroup to add proc
|
|
SyncFunc func(pid int) error
|
|
}
|