mktemp creates a classic unlinked file in the given directory.

mockFilter returns a BPF VM that contains a mock filter with an -ENOSYS stub. If the filter returns retFallthrough, the stub filter has permitted the

mockSyscallPayload creates a fake seccomp_data struct with the given data.

mountConsole bind-mounts the provided pty on top of /dev/console so programs that operate on /dev/console operate on the correct container pty.

mountFd creates a "mount source fd" (either through open_tree(2) or just open(O_PATH)) based on the provided configuration. This function must be call

newProcess converts [specs.Process] to [libcontainer.Process].

newRootfs creates a new tmp directory and copies the busybox root filesystem to it.

newSignalHandler returns a signal handler for processing SIGCHLD and SIGWINCH signals while still forwarding all other signals to the process. If noti

newSyncSockpair returns a new SOCK_SEQPACKET unix socket pair to be used for runc-init synchronisation.

notifHandler handles seccomp notifications and responses

notifyOnOOMV2 returns channel on which you can expect event about OOM, if process died without OOM this channel will be closed.

orderNamespacePaths sorts namespace paths into a list of paths that we can setns in order.

otmpfile creates an open(O_TMPFILE) file in the given directory (supported since Linux 3.11).

parseBoolOrAuto returns (nil, nil) if s is empty or "auto"

parseMountOptions parses options and returns a configs.Mount structure with fields that depends on options set accordingly.

parseStateFds returns the seccomp-fd and closes the rest of the fds in recvFds. In case of error, no fd is closed. StateFds is assumed to be formatted

pivotRoot will call pivot_root such that rootfs becomes the new root filesystem, and everything else is cleaned up.

prepareCgroupFD sets up p.cmd to use clone3 with CLONE_INTO_CGROUP to join cgroup early, in p.cmd.Start. Returns an *os.File which must be closed by t

prepareCriuRestoreMounts tries to set up the rootfs of the container to be restored in the same way runc does it for initial container creation. Even

prepareRootfs sets up the devices, mount points, and filesystems for use inside a new mount namespace. It doesn't set anything as ro. You must call fi

tmp has to be mounted as private to allow MS_MOVE to work in all situations

processEntry parses the error and either logs it via the standard logger or, if this is a fatal error, appends its text to fatals.

If stdin, stdout, and/or stderr are pointing to `/dev/null` in the parent's rootfs this method will make them point to `/dev/null` in this container's

Reads the specified statistics available under /sys/class/net/<EthInterface>/statistics

readonlyPath will make a path read only.

reap runs wait4 in a loop until we have finished processing any existing exits then returns all exits to the main event loop for further processing.

remountReadonly will remount an existing mount point and ensure that it is read-only.

retryEAGAIN2 is like retryEAGAIN except it returns two values.

reviseRootDir ensures that the --root option argument, if specified, is converted to an absolute and cleaned path, and that this path is sane.

rootfsParentMountPrivate ensures rootfs parent mount is private. This is needed for two reasons: - pivot_root() will fail if parent mount is shared; -

go:linkname runtime_IsPollDescriptor internal/poll.IsPollDescriptor In order to make sure we do not close the internal epoll descriptors the Go runtim

safeAllocPty returns a new (ptmx, peer pty) allocation for use inside a container.

sdNotifyBarrier performs synchronization with systemd by means of the sd_notify_barrier protocol.

sealedOverlayfs will create an internal overlayfs mount using fsopen() that uses the directory containing the binary as a lowerdir and a temporary tmp

setupAndMountToRootfs sets up the mount for a single mount point and mounts it to the rootfs.

setupIO modifies the given process config according to the options.

setupNetwork sets up and initializes any network interface inside the container.

setupNetworkDevices sets up and initializes any defined network interface inside the container.

setup pipes for the process so that advanced features like c/r are able to easily checkpoint and restore the process's IO without depending on a host

setupSpec performs initial setup based on the cli.Context for the container

If systemd is supporting sd_notify protocol, this function will add support for sd_notify protocol from within the container.

setupUser changes the groups, gid, and uid for the user inside the container.

Do something equivalent to nsenter --user=<nsPath> cat <path>, but more efficiently. Returns the contents of the requested file from within the user n

srcName is only meant for error messages, it returns a "friendly" name.

start starts the process execution.

Normally, this function does not return. If it returns, with or without an error, it means the initialization has failed. If the error is returned, it

startTime returns the process start time.

startWithCgroupFD starts a process via clone3 with CLONE_INTO_CGROUP, with a fallback if it fails (e.g. not available).