ok fails the test if an err is not nil.

Run executes the hook with the provided state.

TODO: replace with new(v) once Go < 1.26 is not supported.

newTemplateConfig returns a base template for running a container. It uses a network strategy of just setting a loopback interface and the default se

Close closes all open fds for the tty and/or restores the original stdin state to what it was prior to the container execution

Wait waits for the process to exit. Wait releases any resources associated with the Process

pid returns the pid for the running process.

LexicallyCleanPath makes a path safe for use with filepath.Join. This is done by not only cleaning the path, but also (if the path is relative) adding

runContainerOk is a wrapper for runContainer, simplifying its use for cases when the run is expected to succeed and return exit code of 0.

mount is a simple unix.Mount wrapper, returning an error with more context in case it failed.

Signal sends a signal to the Process.

NewCommandHook will execute the provided command when the hook is run.

mountViaFds is a unix.Mount wrapper which uses srcFile instead of source, and dstFd instead of target, unless those are empty. If srcFile is non-nil

State returns the current container's state information.

Status returns the current status of the container.

WithProcfdFile is a very minimal wrapper around [ProcThreadSelfFd]. The caller is responsible for making sure that the provided file handle is actuall

Destroy destroys the container, if its in a valid state. Any event registrations are removed before the container is destroyed. No error is returned

Start starts a process inside the container. Returns error if process fails to start. You can track process lifecycle with passed Process structure.

String forms of the state from proc(5)'s documentation for proc/[pid]/status' "State" field.

checkProcMount checks to ensure that the mount destination is not over the top of /proc. dest is required to be an abs path and have any symlinks reso

getContainer returns the specified container instance by loading it from a state directory (root).

ID returns the container's unique ID

Set Intel RDT "resource control" filesystem as configured.

Gets a single uint64 value from the specified file.

Apply applies Intel RDT configuration to the process with the specified pid.

CreateLibcontainerConfig creates a new libcontainer configuration from a given specification and a cgroup name

NsName converts the namespace type to its filename

checkCriuVersion checks CRIU version greater than or equal to minVersion.

retryEAGAIN is a top-level retry loop for pathrs to try to returning spurious errors in most normal user cases when using openat2 (libpathrs itself do

runContainer runs the container with the specific config and arguments buffers are returned containing the STDOUT and STDERR output for the run along

stringifyMountFlags converts mount(2) flags to a string that you can use in error messages.

Example returns an example spec file, with many options set so a user can see what a standard spec file looks like.

Pid returns the process ID

RecvFile waits for a file descriptor to be sent over the given AF_UNIX socket. The file name of the remote file descriptor will be recreated locally (

Reopen is a wrapper around pathrs.Reopen.

Root returns the Intel RDT "resource control" filesystem mount point.

Set resources of container as configured. Can be used to change resources when the container is running.

Stat returns a Stat_t instance for the specified process.

Gets a string value from the specified file

hasInit tells whether the container init process exists.

GetPath returns Intel RDT path to save in a state file and to be able to restore the object later.

IsPrivate tells whether the namespace of type t is configured as private (i.e. it exists and is not shared).

NewFunctionHook will call the provided function when the hook is run.

ProcThreadSelfOpen is a wrapper around [procfs.Handle.OpenThreadSelf] and [pathrs.Reopen], to let you one-shot open a procfs file with the given flags

Do the mount operation followed by additional mounts required to take care of propagation flags. This will always be scoped inside the container rootf

retryOnEINTR takes a function that returns an error and calls it until the error returned is not EINTR.

Config returns the container's configuration

Destroy destroys the Intel RDT container-specific container_id group.

HostRootGID gets the root gid for the process on host which could be non-zero when user namespaces are enabled.

HostRootUID gets the root uid for the process on host which could be non-zero when user namespaces are enabled.

LexicallyStripRoot returns the passed path, stripping the root path if it was (lexicially) inside it. Note that both passed paths will always be treat

Load takes a path to the state directory (root) and an id of an existing container, and returns a Container object reconstructed from the saved state.

SendRawFd sends a specific file descriptor over the given AF_UNIX socket.

WriteJSON writes the provided struct v to w using standard json marshaling without a trailing newline. This is used instead of json.Encoder because th

capSlice converts the slice of capability names in caps, to their numeric equivalent, and returns them as a slice. Unknown or unavailable capabilities

check checks that the file contains txt and does not contain notxt.

needsSetupDev returns true if /dev needs to be set up.