Annotations returns the bundle path and user defined annotations from the libcontainer state. We need to remove the bundle because that is a label ad

Create creates a new container with the given id inside a given state directory (root), and returns a Container object. The root is a state directory

GetMonPath returns path of the monitoring group of the container. Returns an empty string if the container does not have a individual dedicated monito

HasHook checks if config has any hooks with any given names configured.

InitSeccomp does nothing because seccomp is not supported.

IsCATEnabled checks if Intel RDT/CAT is enabled.

IsLexicallyInRoot is shorthand for strings.HasPrefix(path+"/", root+"/"), but properly handling the case where path or root have a "/" suffix. NOTE:

IsMBAEnabled checks if Intel RDT/MBA is enabled.

MkdirAllInRoot attempts to make path, _ := securejoin.SecureJoin(root.Name(), unsafePath) os.MkdirAll(path, mode) os.Open(path) safer against att

OpenInRoot opens the given path inside the root with the provided flags. It is effectively shorthand for [securejoin.OpenatInRoot] followed by [secure

Processes returns the PIDs inside this container. The PIDs are in the namespace of the calling process. Some of the returned PIDs may no longer refer

ToCPUSet parses a string in list format into a unix.CPUSet, e.g. "0-3,5,7-9".

VerifyInode verifies that the underlying inode for the given file matches an expected inode type (possibly on a particular kind of filesystem). This i

Check if Intel RDT sub-features are enabled in featuresInit()

getStrategy returns the specific network strategy for the provided type.

id returns a unique identifier for this mapping, agnostic of the order of the uid and gid mappings (because the order doesn't matter to the kernel). T

TODO: replace with new(v) once Go < 1.26 is not supported.

newManager is the same as NewManager, except it does not check if the feature is actually available. Used by unit tests that mock intelrdt paths.

retryOnEINTR2 is like retryOnEINTR, but it returns 2 values.

syncParentSeccomp sends the fd associated with the seccomp file descriptor to the parent, and wait for the parent to do pidfd_getfd() to grab a copy.

ExitStatus returns the correct exit status for a process based on if it was signaled or exited cleanly

HostUID gets the translated uid for the process on host which could be different when user namespaces are enabled.

IsCMTEnabled checks if Intel RDT/CMT is enabled.

IsMBMEnabled checks if Intel RDT/MBM is enabled.

IsNamespaceSupported returns whether a namespace is available or not

MkdirAllParentInRoot is like [MkdirAllInRoot] except that it only creates the parent directory of the target path, returning the trailing component so

Creates a new test util

NewSockPair returns a new SOCK_STREAM unix socket pair.

Openat is a Go-friendly openat(2) wrapper.

Pause pauses the container, if its state is RUNNING or CREATED, changing its state to PAUSED. If the state is already PAUSED, does nothing.

ProcThreadSelfFd is small wrapper around ProcThreadSelf to make it easier to create a /proc/thread-self handle for given file descriptor. It is basic

Resume resumes the execution of any user processes in the container before setting the container state to RUNNING. This is only performed if the curre

SearchLabels searches through a list of key=value pairs for a given key, returning its value, and the binary flag telling whether the key exist.

SendFile sends a file over the given AF_UNIX socket. file.Name() is also included so that if the other end uses RecvFile, the file will have the same

Stats returns statistics for the container.

SymlinkInRoot creates a symlink inside a root with the given target (as well as creating any missing parent directories). If the subpath already exist

WriteIntelRdtTasks writes the specified pid into the "tasks" file

checkPropertyName checks if systemd property name is valid. A valid name should consist of latin letters only, and have least 3 of them.

https://elixir.bootlin.com/linux/v6.12/source/net/core/dev.c#L1066

fatal prints the error's details if it is a libcontainer specific error type then exits the program with an exit status of 1.

getKernelVersion gets the current kernel version.

ignoreTerminateErrors returns nil if the given err matches an error known to indicate that the terminate occurred successfully or err was nil, otherwi

refreshState needs to be called to verify that the current state on the container is what is true. Because consumers of libcontainer can use it out o

send a SIGKILL to the process and wait for the exit.

unmount is a simple unix.Unmount wrapper.

ApplyProfile will apply the profile with the specified name to the process after the next exec. It is only supported on Linux and produces an [ErrAppa

CloseExecFrom sets the O_CLOEXEC flag on all file descriptors greater or equal to minFd in the current process.

ConvertCPUAffinity converts [specs.CPUAffinity] to [CPUAffinity].

ConvertStringToAction converts a string into a Seccomp rule match action. Actions use the names they are assigned in Libseccomp's header. Attempting t

Dup3 wraps [unix.Dup3].

Exec wraps [unix.Exec].

Exec signals the container to exec the users process at the end of the init.

FlagSupported tells if a provided seccomp flag is supported.

Get returns a handle to a /proc/$pid/ns/user nsfs file with the requested mapping. The processes spawned to produce userns nsfds are cached, so if equ