rootlessEUIDMount verifies that all mounts have valid uid=/gid= options, i.e. their arguments has proper ID mappings.

setupConsole sets up the console from inside the container, and sends the master pty fd to the config.Pipe (using cmsg). This is done to ensure that c

setupPidfd opens a process file descriptor of init process, and sends the file descriptor back to the socket.

signalAllProcesses freezes then iterates over all the processes inside the manager's cgroups sending the signal s to them.

Starts setns process with specified initial CPU affinity.

syncParentReady sends to the given pipe a JSON payload which indicates that the init is ready to Exec the child process. It then waits for the parent

tryResetCPUAffinity tries to reset the CPU affinity of the process identified by pid to include all possible CPUs (notwithstanding cgroup cpuset restr

validateID checks if the supplied container ID is valid, returning the ErrInvalidID in case it is not. The format of valid ID was never formally defi

ApplyBoundingSet sets the capability bounding set to those specified in the whitelist.

ApplyCaps sets all the capabilities for the current process in the config.

ClearRlimitNofileCache clears go runtime's nofile rlimit cache. The argument is process RLIMIT_NOFILE values. Relies on go.dev/cl/588076.

CloneBinary creates a "sealed" clone of a given binary, which can be used to thwart attempts by the container process to gain access to host binaries

CloneFlags parses the container's Namespaces options to set the correct flags on clone, unshare. This function returns flags only for new namespaces.

CloneSelfExe makes a clone of the current process's binary (through proc/self/exe). This binary can then be used for "runc init" in order to make sure

ClosePostStart closes any fds that are provided to the container and dup2'd so that we no longer have copy in our process.

ConvertStringToArch converts a string into a Seccomp comparison arch.

ConvertStringToOperator converts a string into a Seccomp comparison operator. Comparison operators use the names they are assigned by Libseccomp's hea

Copy is like io.Copy except it uses sendfile(2) if the source and sink are both (*os.File) as an optimisation to make copies faster.

CreateInRoot creates a new file inside a root (as well as any missing parent directories) and returns a handle to said file. This effectively has open

FchmodFile is a wrapper around fchmodat2(AT_EMPTY_PATH) with fallbacks for older kernels. This is distinct from [File.Chmod] and [unix.Fchmod] in that

FchownFile is a wrapper around fchownat(AT_EMPTY_PATH). This is distinct from [File.Chown] and [unix.Fchown] in that it works on O_PATH file descripto

Files returns a slice containing a os.File object for each file descriptor passed to this process via systemd fd-passing protocol. The order of the f

FlagSupported checks if the flag is known to runc and supported by currently used libseccomp and kernel (i.e. it can be set).

GetPtyPeer is a wrapper for ioctl(TIOCGPTPEER).

InitializeIO creates pipes for use with the process's stdio and returns the opposite side for each. Do not use this if you want to have a pseudotermin

IsCloned returns whether the given file can be guaranteed to be a safe exe.

IsEnabled checks if Intel RDT is enabled.

IsSelfExeCloned returns whether /proc/self/exe is a cloned binary that can be guaranteed to be safe. This means that it must be a sealed memfd. Other

KnownActions returns the list of the known actions. Used by `runc features`.

KnownArchs returns the list of the known archs. Used by `runc features`.

KnownCapabilities returns the list of the known capabilities. Used by `runc features`.

KnownFlags returns the list of the known filter flags. Used by `runc features`.

KnownHookNames returns the known hook names. Used by `runc features`.

KnownMemoryPolicyFlags returns the list of the known memory policy mode flags. Used by `runc features`.

KnownMemoryPolicyModes returns the list of the known memory policy modes. Used by `runc features`.

KnownMountOptions returns the list of the known mount options. Used by `runc features`.

KnownNamespaces returns the list of the known namespaces. Used by `runc features`.

KnownOperators returns the list of the known operations. Used by `runc features`.

Memfd creates a sealable executable memfd (supported since Linux 3.17).

ModKeyringPerm modifies permissions on a keyring by reading the current permissions, anding the bits with the given mask (clearing permissions) and se

NotifyOOM returns a read-only channel signaling when the container receives an OOM notification.

PatchAndLoad takes a seccomp configuration and a libseccomp filter which has been pre-configured with the set of rules in the seccomp config. It then

ProcPidOpen is a wrapper around [procfs.Handle.OpenPid] and [pathrs.Reopen], to let you one-shot open a procfs file with the given flags.

ProcSelfOpen is a wrapper around [procfs.Handle.OpenSelf] and [pathrs.Reopen], to let you one-shot open a procfs file with the given flags.

Readlinkat wraps [unix.Readlinkat].

Recvfrom wraps [unix.Recvfrom].

SchedSetaffinity wraps sched_setaffinity syscall without unix.CPUSet size limitation.

SetDefaultEnv sets the environment for those CommandHook entries that do not have one set.

SetLinuxPersonality sets the Linux execution personality. For more information see the personality syscall documentation. checkout getLinuxPersonality

SetMempolicy wraps set_mempolicy.

SetSubreaper sets the value i as the subreaper setting for the calling process

Signal sends a specified signal to container's init. When s is SIGKILL and the container does not have its own PID namespace, all the container's pro

SupportedFlags returns the list of the supported filter flags. This list may be a subset of one returned by KnownFlags due to some flags not supported

ToSchedAttr is to convert *configs.Scheduler to *unix.SchedAttr.

UnlinkInRoot deletes the inode specified at the given subpath. If you pass [unix.AT_REMOVEDIR] it will remove directories, otherwise it will remove no

WriteSysctls sets the given sysctls to the requested values.