syncParentHooks sends to the given pipe a JSON payload which indicates that the parent should execute pre-start hooks. It then waits for the parent to

syscallMode returns the syscall-specific mode bits from Go's portable mode bits. Copy from https://cs.opensource.google/go/go/+/refs/tags/go1.20.7:src

traversePath gives read+execute permissions to others for all elements in tPath below os.TempDir() and errors out if elements above it don't have read

verifyCwd ensures that the current directory is actually inside the mount namespace root of the current process.

wait waits on the process returning the process state.

CloneFlags parses the container's Namespaces options to set the correct flags on clone, unshare. This function returns flags only for new namespaces.

DeviceFromPath takes the path to a device and its cgroup_permissions (which cannot be easily queried) to look up the information about a linux device

Error provides a string error representation.

GetDevices recursively traverses a directory specified by path and returns all devices found there. Deprecated: Use [devices.GetDevices] instead. Thi

GetPtyPeer is a wrapper for ioctl(TIOCGPTPEER).

GetSubreaper returns the subreaper setting for the calling process

HostDevices returns all devices that can be found under /dev directory. Deprecated: Use [devices.HostDevices] instead. This package will be removed i

InitSeccomp installs the seccomp filters to be used in the container as specified in config. Returns the seccomp file descriptor if any of the filters

IsEnabled returns true if apparmor is enabled for the host.

NotifyMemoryPressure returns a read-only channel signaling when the container reaches a given pressure level.

OCIState returns the current container's state information.

RecvFile waits for a file descriptor to be sent over the given AF_UNIX socket. The file name of the remote file descriptor will be recreated locally (

Run immediately starts the process inside the container. Returns an error if the process fails to start. It does not block waiting for the exec fifo a

Run executes all hooks for the given hook name.

SendFile sends a file over the given AF_UNIX socket. file.Name() is also included so that if the other end uses RecvFile, the file will have the same

SendRawFd sends a specific file descriptor over the given AF_UNIX socket. Deprecated: This method is deprecated and has been moved to an internal pac

Serialize serializes the message. Int32msg has the following representation | nlattr len | nlattr type | | uint32 value |

Test that a container using user namespaces is able to bind mount a folder that does not have permissions for group/others.

TestConvertSysctlVariableToDotsSeparator tests whether the sysctl variable can be correctly converted to a dot as a separator.