go-sandbox/runner/unshare/runner_linux.go
2024-02-03 16:19:58 +00:00

49 lines
990 B
Go

package unshare
import (
"github.com/criyle/go-sandbox/pkg/mount"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/pkg/seccomp"
"github.com/criyle/go-sandbox/runner"
)
// Runner runs program in unshared namespaces
type Runner struct {
// argv and env for the child process
Args []string
Env []string
// fexecve param
ExecFile uintptr
// workdir is the current dir after unshare mount namespaces
WorkDir string
// file descriptors for new process, from 0 to len - 1
Files []uintptr
// Resource limit set by set rlimit
RLimits []rlimit.RLimit
// Resource limit enforced by tracer
Limit runner.Limit
// Seccomp defines the seccomp filter attach to the process (should be whitelist only)
Seccomp seccomp.Filter
// New root
Root string
// Mount syscalls
Mounts []mount.SyscallParams
// hostname & domainname
HostName, DomainName string
// Show Details
ShowDetails bool
// Use by cgroup to add proc
SyncFunc func(pid int) error
}