GetStats returns statistics for Intel RDT.

Getwd wraps [unix.Getwd].

GreaterEqualThan checks if the host's kernel version is greater than, or equal to the given kernel version v. Only "kernel version" and "major revisio

HostGID gets the translated gid for the process on host which could be different when user namespaces are enabled.

Init is part of "runc init" implementation.

IsSameMapping returns whether or not the two id mappings are the same. Note that if the order of the mappings is different, or a mapping has been spli

New creates a new Caps from the given Capabilities config. Unknown Capabilities or Capabilities that are unavailable in the current environment are ig

NewManager returns a new instance of Manager, or nil if the Intel RDT functionality is not specified in the config, available from hardware or enabled

Open wraps [unix.Open].

Openat wraps [unix.Openat].

ProcThreadSelf returns a string that is equivalent to proc/thread-self/<subpath>, with a graceful fallback on older kernels where proc/thread-self doe

Release all resources associated with this Handle. All existing files returned from Get() will continue to work even after calling Release(). The same

Restore restores the checkpointed container to a running state using the criu(8) utility.

Sendmsg wraps [unix.Sendmsg].

ToRootless converts the given spec file into one that should work with rootless containers (euid != 0), by removing incompatible options and adding ot

nolint:revive UnsafeCloseFrom closes all file descriptors greater or equal to minFd in the current process, except for those critical to Go's runtime

Version returns major, minor, and micro.

bootstrapData encodes the necessary data in netlink binary format as a io.Reader. Consumer can write the data to a bootstrap program such as one that

checkWait is like check, but if the file is empty, it waits until it's not.

closeClonedExes cleans up any existing cloned binaries associated with the Process.

convertSysctlVariableToDotsSeparator can return sysctl variables in dots separator format. The '/' separator is also accepted in place of a '.'. Conve

fdRangeFrom calls the passed fdFunc for each file descriptor that is open in the current process.

finalizeNamespace drops the caps, sets the correct user and working dir, and closes any leaked file descriptors before executing the command inside th

Convert Libcontainer Action to Libseccomp ScmpAction

hallucinateUnsafePath creates a new unsafePath which has all symlinks (including dangling symlinks) fully resolved and any non-existent components tre

Utility function that gets a host ID for a container ID from user namespace map if that ID is present in the map.

initProcessCgroupPath returns container init's cgroup path, as read from /proc/PID/cgroup. Only works for cgroup v2. Returns empty string if the path

loadSpec loads the specification from the provided path.

logCriuErrors tries to find and log errors from a criu log file. The output is similar to what "grep -n -B5 Error" does.

maskDir mounts a read-only tmpfs on top of the specified path.

notifyHost tells the host (usually systemd) that the container reported READY. Also sends MAINPID and BARRIER.

notifyOnOOM returns channel on which you can expect event about OOM, if process died without OOM this channel will be closed.

parseRelease parses a string and creates a KernelVersion based on it.

parseSync runs the given callback function on each syncT received from the child. It will return once io.EOF is returned from the given pipe.

prepareEnv processes a list of environment variables, preparing it for direct consumption by unix.Exec. In particular, it: - validates each variable i