config.go (30482B)
1 package specs 2 3 import "os" 4 5 // Spec is the base configuration for the container. 6 type Spec struct { 7 // Version of the Open Container Initiative Runtime Specification with which the bundle complies. 8 Version string `json:"ociVersion"` 9 // Process configures the container process. 10 Process *Process `json:"process,omitempty"` 11 // Root configures the container's root filesystem. 12 Root *Root `json:"root,omitempty"` 13 // Hostname configures the container's hostname. 14 Hostname string `json:"hostname,omitempty"` 15 // Mounts configures additional mounts (on top of Root). 16 Mounts []Mount `json:"mounts,omitempty"` 17 // Hooks configures callbacks for container lifecycle events. 18 Hooks *Hooks `json:"hooks,omitempty" platform:"linux,solaris"` 19 // Annotations contains arbitrary metadata for the container. 20 Annotations map[string]string `json:"annotations,omitempty"` 21 22 // Linux is platform-specific configuration for Linux based containers. 23 Linux *Linux `json:"linux,omitempty" platform:"linux"` 24 // Solaris is platform-specific configuration for Solaris based containers. 25 Solaris *Solaris `json:"solaris,omitempty" platform:"solaris"` 26 // Windows is platform-specific configuration for Windows based containers. 27 Windows *Windows `json:"windows,omitempty" platform:"windows"` 28 // VM specifies configuration for virtual-machine-based containers. 29 VM *VM `json:"vm,omitempty" platform:"vm"` 30 } 31 32 // Process contains information to start a specific application inside the container. 33 type Process struct { 34 // Terminal creates an interactive terminal for the container. 35 Terminal bool `json:"terminal,omitempty"` 36 // ConsoleSize specifies the size of the console. 37 ConsoleSize *Box `json:"consoleSize,omitempty"` 38 // User specifies user information for the process. 39 User User `json:"user"` 40 // Args specifies the binary and arguments for the application to execute. 41 Args []string `json:"args,omitempty"` 42 // CommandLine specifies the full command line for the application to execute on Windows. 43 CommandLine string `json:"commandLine,omitempty" platform:"windows"` 44 // Env populates the process environment for the process. 45 Env []string `json:"env,omitempty"` 46 // Cwd is the current working directory for the process and must be 47 // relative to the container's root. 48 Cwd string `json:"cwd"` 49 // Capabilities are Linux capabilities that are kept for the process. 50 Capabilities *LinuxCapabilities `json:"capabilities,omitempty" platform:"linux"` 51 // Rlimits specifies rlimit options to apply to the process. 52 Rlimits []POSIXRlimit `json:"rlimits,omitempty" platform:"linux,solaris"` 53 // NoNewPrivileges controls whether additional privileges could be gained by processes in the container. 54 NoNewPrivileges bool `json:"noNewPrivileges,omitempty" platform:"linux"` 55 // ApparmorProfile specifies the apparmor profile for the container. 56 ApparmorProfile string `json:"apparmorProfile,omitempty" platform:"linux"` 57 // Specify an oom_score_adj for the container. 58 OOMScoreAdj *int `json:"oomScoreAdj,omitempty" platform:"linux"` 59 // SelinuxLabel specifies the selinux context that the container process is run as. 60 SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"` 61 } 62 63 // LinuxCapabilities specifies the whitelist of capabilities that are kept for a process. 64 // http://man7.org/linux/man-pages/man7/capabilities.7.html 65 type LinuxCapabilities struct { 66 // Bounding is the set of capabilities checked by the kernel. 67 Bounding []string `json:"bounding,omitempty" platform:"linux"` 68 // Effective is the set of capabilities checked by the kernel. 69 Effective []string `json:"effective,omitempty" platform:"linux"` 70 // Inheritable is the capabilities preserved across execve. 71 Inheritable []string `json:"inheritable,omitempty" platform:"linux"` 72 // Permitted is the limiting superset for effective capabilities. 73 Permitted []string `json:"permitted,omitempty" platform:"linux"` 74 // Ambient is the ambient set of capabilities that are kept. 75 Ambient []string `json:"ambient,omitempty" platform:"linux"` 76 } 77 78 // Box specifies dimensions of a rectangle. Used for specifying the size of a console. 79 type Box struct { 80 // Height is the vertical dimension of a box. 81 Height uint `json:"height"` 82 // Width is the horizontal dimension of a box. 83 Width uint `json:"width"` 84 } 85 86 // User specifies specific user (and group) information for the container process. 87 type User struct { 88 // UID is the user id. 89 UID uint32 `json:"uid" platform:"linux,solaris"` 90 // GID is the group id. 91 GID uint32 `json:"gid" platform:"linux,solaris"` 92 // Umask is the umask for the init process. 93 Umask uint32 `json:"umask,omitempty" platform:"linux,solaris"` 94 // AdditionalGids are additional group ids set for the container's process. 95 AdditionalGids []uint32 `json:"additionalGids,omitempty" platform:"linux,solaris"` 96 // Username is the user name. 97 Username string `json:"username,omitempty" platform:"windows"` 98 } 99 100 // Root contains information about the container's root filesystem on the host. 101 type Root struct { 102 // Path is the absolute path to the container's root filesystem. 103 Path string `json:"path"` 104 // Readonly makes the root filesystem for the container readonly before the process is executed. 105 Readonly bool `json:"readonly,omitempty"` 106 } 107 108 // Mount specifies a mount for a container. 109 type Mount struct { 110 // Destination is the absolute path where the mount will be placed in the container. 111 Destination string `json:"destination"` 112 // Type specifies the mount kind. 113 Type string `json:"type,omitempty" platform:"linux,solaris"` 114 // Source specifies the source path of the mount. 115 Source string `json:"source,omitempty"` 116 // Options are fstab style mount options. 117 Options []string `json:"options,omitempty"` 118 } 119 120 // Hook specifies a command that is run at a particular event in the lifecycle of a container 121 type Hook struct { 122 Path string `json:"path"` 123 Args []string `json:"args,omitempty"` 124 Env []string `json:"env,omitempty"` 125 Timeout *int `json:"timeout,omitempty"` 126 } 127 128 // Hooks specifies a command that is run in the container at a particular event in the lifecycle of a container 129 // Hooks for container setup and teardown 130 type Hooks struct { 131 // Prestart is Deprecated. Prestart is a list of hooks to be run before the container process is executed. 132 // It is called in the Runtime Namespace 133 Prestart []Hook `json:"prestart,omitempty"` 134 // CreateRuntime is a list of hooks to be run after the container has been created but before pivot_root or any equivalent operation has been called 135 // It is called in the Runtime Namespace 136 CreateRuntime []Hook `json:"createRuntime,omitempty"` 137 // CreateContainer is a list of hooks to be run after the container has been created but before pivot_root or any equivalent operation has been called 138 // It is called in the Container Namespace 139 CreateContainer []Hook `json:"createContainer,omitempty"` 140 // StartContainer is a list of hooks to be run after the start operation is called but before the container process is started 141 // It is called in the Container Namespace 142 StartContainer []Hook `json:"startContainer,omitempty"` 143 // Poststart is a list of hooks to be run after the container process is started. 144 // It is called in the Runtime Namespace 145 Poststart []Hook `json:"poststart,omitempty"` 146 // Poststop is a list of hooks to be run after the container process exits. 147 // It is called in the Runtime Namespace 148 Poststop []Hook `json:"poststop,omitempty"` 149 } 150 151 // Linux contains platform-specific configuration for Linux based containers. 152 type Linux struct { 153 // UIDMapping specifies user mappings for supporting user namespaces. 154 UIDMappings []LinuxIDMapping `json:"uidMappings,omitempty"` 155 // GIDMapping specifies group mappings for supporting user namespaces. 156 GIDMappings []LinuxIDMapping `json:"gidMappings,omitempty"` 157 // Sysctl are a set of key value pairs that are set for the container on start 158 Sysctl map[string]string `json:"sysctl,omitempty"` 159 // Resources contain cgroup information for handling resource constraints 160 // for the container 161 Resources *LinuxResources `json:"resources,omitempty"` 162 // CgroupsPath specifies the path to cgroups that are created and/or joined by the container. 163 // The path is expected to be relative to the cgroups mountpoint. 164 // If resources are specified, the cgroups at CgroupsPath will be updated based on resources. 165 CgroupsPath string `json:"cgroupsPath,omitempty"` 166 // Namespaces contains the namespaces that are created and/or joined by the container 167 Namespaces []LinuxNamespace `json:"namespaces,omitempty"` 168 // Devices are a list of device nodes that are created for the container 169 Devices []LinuxDevice `json:"devices,omitempty"` 170 // Seccomp specifies the seccomp security settings for the container. 171 Seccomp *LinuxSeccomp `json:"seccomp,omitempty"` 172 // RootfsPropagation is the rootfs mount propagation mode for the container. 173 RootfsPropagation string `json:"rootfsPropagation,omitempty"` 174 // MaskedPaths masks over the provided paths inside the container. 175 MaskedPaths []string `json:"maskedPaths,omitempty"` 176 // ReadonlyPaths sets the provided paths as RO inside the container. 177 ReadonlyPaths []string `json:"readonlyPaths,omitempty"` 178 // MountLabel specifies the selinux context for the mounts in the container. 179 MountLabel string `json:"mountLabel,omitempty"` 180 // IntelRdt contains Intel Resource Director Technology (RDT) information for 181 // handling resource constraints (e.g., L3 cache, memory bandwidth) for the container 182 IntelRdt *LinuxIntelRdt `json:"intelRdt,omitempty"` 183 // Personality contains configuration for the Linux personality syscall 184 Personality *LinuxPersonality `json:"personality,omitempty"` 185 } 186 187 // LinuxNamespace is the configuration for a Linux namespace 188 type LinuxNamespace struct { 189 // Type is the type of namespace 190 Type LinuxNamespaceType `json:"type"` 191 // Path is a path to an existing namespace persisted on disk that can be joined 192 // and is of the same type 193 Path string `json:"path,omitempty"` 194 } 195 196 // LinuxNamespaceType is one of the Linux namespaces 197 type LinuxNamespaceType string 198 199 const ( 200 // PIDNamespace for isolating process IDs 201 PIDNamespace LinuxNamespaceType = "pid" 202 // NetworkNamespace for isolating network devices, stacks, ports, etc 203 NetworkNamespace LinuxNamespaceType = "network" 204 // MountNamespace for isolating mount points 205 MountNamespace LinuxNamespaceType = "mount" 206 // IPCNamespace for isolating System V IPC, POSIX message queues 207 IPCNamespace LinuxNamespaceType = "ipc" 208 // UTSNamespace for isolating hostname and NIS domain name 209 UTSNamespace LinuxNamespaceType = "uts" 210 // UserNamespace for isolating user and group IDs 211 UserNamespace LinuxNamespaceType = "user" 212 // CgroupNamespace for isolating cgroup hierarchies 213 CgroupNamespace LinuxNamespaceType = "cgroup" 214 ) 215 216 // LinuxIDMapping specifies UID/GID mappings 217 type LinuxIDMapping struct { 218 // ContainerID is the starting UID/GID in the container 219 ContainerID uint32 `json:"containerID"` 220 // HostID is the starting UID/GID on the host to be mapped to 'ContainerID' 221 HostID uint32 `json:"hostID"` 222 // Size is the number of IDs to be mapped 223 Size uint32 `json:"size"` 224 } 225 226 // POSIXRlimit type and restrictions 227 type POSIXRlimit struct { 228 // Type of the rlimit to set 229 Type string `json:"type"` 230 // Hard is the hard limit for the specified type 231 Hard uint64 `json:"hard"` 232 // Soft is the soft limit for the specified type 233 Soft uint64 `json:"soft"` 234 } 235 236 // LinuxHugepageLimit structure corresponds to limiting kernel hugepages 237 type LinuxHugepageLimit struct { 238 // Pagesize is the hugepage size 239 // Format: "<size><unit-prefix>B' (e.g. 64KB, 2MB, 1GB, etc.) 240 Pagesize string `json:"pageSize"` 241 // Limit is the limit of "hugepagesize" hugetlb usage 242 Limit uint64 `json:"limit"` 243 } 244 245 // LinuxInterfacePriority for network interfaces 246 type LinuxInterfacePriority struct { 247 // Name is the name of the network interface 248 Name string `json:"name"` 249 // Priority for the interface 250 Priority uint32 `json:"priority"` 251 } 252 253 // linuxBlockIODevice holds major:minor format supported in blkio cgroup 254 type linuxBlockIODevice struct { 255 // Major is the device's major number. 256 Major int64 `json:"major"` 257 // Minor is the device's minor number. 258 Minor int64 `json:"minor"` 259 } 260 261 // LinuxWeightDevice struct holds a `major:minor weight` pair for weightDevice 262 type LinuxWeightDevice struct { 263 linuxBlockIODevice 264 // Weight is the bandwidth rate for the device. 265 Weight *uint16 `json:"weight,omitempty"` 266 // LeafWeight is the bandwidth rate for the device while competing with the cgroup's child cgroups, CFQ scheduler only 267 LeafWeight *uint16 `json:"leafWeight,omitempty"` 268 } 269 270 // LinuxThrottleDevice struct holds a `major:minor rate_per_second` pair 271 type LinuxThrottleDevice struct { 272 linuxBlockIODevice 273 // Rate is the IO rate limit per cgroup per device 274 Rate uint64 `json:"rate"` 275 } 276 277 // LinuxBlockIO for Linux cgroup 'blkio' resource management 278 type LinuxBlockIO struct { 279 // Specifies per cgroup weight 280 Weight *uint16 `json:"weight,omitempty"` 281 // Specifies tasks' weight in the given cgroup while competing with the cgroup's child cgroups, CFQ scheduler only 282 LeafWeight *uint16 `json:"leafWeight,omitempty"` 283 // Weight per cgroup per device, can override BlkioWeight 284 WeightDevice []LinuxWeightDevice `json:"weightDevice,omitempty"` 285 // IO read rate limit per cgroup per device, bytes per second 286 ThrottleReadBpsDevice []LinuxThrottleDevice `json:"throttleReadBpsDevice,omitempty"` 287 // IO write rate limit per cgroup per device, bytes per second 288 ThrottleWriteBpsDevice []LinuxThrottleDevice `json:"throttleWriteBpsDevice,omitempty"` 289 // IO read rate limit per cgroup per device, IO per second 290 ThrottleReadIOPSDevice []LinuxThrottleDevice `json:"throttleReadIOPSDevice,omitempty"` 291 // IO write rate limit per cgroup per device, IO per second 292 ThrottleWriteIOPSDevice []LinuxThrottleDevice `json:"throttleWriteIOPSDevice,omitempty"` 293 } 294 295 // LinuxMemory for Linux cgroup 'memory' resource management 296 type LinuxMemory struct { 297 // Memory limit (in bytes). 298 Limit *int64 `json:"limit,omitempty"` 299 // Memory reservation or soft_limit (in bytes). 300 Reservation *int64 `json:"reservation,omitempty"` 301 // Total memory limit (memory + swap). 302 Swap *int64 `json:"swap,omitempty"` 303 // Kernel memory limit (in bytes). 304 Kernel *int64 `json:"kernel,omitempty"` 305 // Kernel memory limit for tcp (in bytes) 306 KernelTCP *int64 `json:"kernelTCP,omitempty"` 307 // How aggressive the kernel will swap memory pages. 308 Swappiness *uint64 `json:"swappiness,omitempty"` 309 // DisableOOMKiller disables the OOM killer for out of memory conditions 310 DisableOOMKiller *bool `json:"disableOOMKiller,omitempty"` 311 // Enables hierarchical memory accounting 312 UseHierarchy *bool `json:"useHierarchy,omitempty"` 313 } 314 315 // LinuxCPU for Linux cgroup 'cpu' resource management 316 type LinuxCPU struct { 317 // CPU shares (relative weight (ratio) vs. other cgroups with cpu shares). 318 Shares *uint64 `json:"shares,omitempty"` 319 // CPU hardcap limit (in usecs). Allowed cpu time in a given period. 320 Quota *int64 `json:"quota,omitempty"` 321 // CPU period to be used for hardcapping (in usecs). 322 Period *uint64 `json:"period,omitempty"` 323 // How much time realtime scheduling may use (in usecs). 324 RealtimeRuntime *int64 `json:"realtimeRuntime,omitempty"` 325 // CPU period to be used for realtime scheduling (in usecs). 326 RealtimePeriod *uint64 `json:"realtimePeriod,omitempty"` 327 // CPUs to use within the cpuset. Default is to use any CPU available. 328 Cpus string `json:"cpus,omitempty"` 329 // List of memory nodes in the cpuset. Default is to use any available memory node. 330 Mems string `json:"mems,omitempty"` 331 } 332 333 // LinuxPids for Linux cgroup 'pids' resource management (Linux 4.3) 334 type LinuxPids struct { 335 // Maximum number of PIDs. Default is "no limit". 336 Limit int64 `json:"limit"` 337 } 338 339 // LinuxNetwork identification and priority configuration 340 type LinuxNetwork struct { 341 // Set class identifier for container's network packets 342 ClassID *uint32 `json:"classID,omitempty"` 343 // Set priority of network traffic for container 344 Priorities []LinuxInterfacePriority `json:"priorities,omitempty"` 345 } 346 347 // LinuxRdma for Linux cgroup 'rdma' resource management (Linux 4.11) 348 type LinuxRdma struct { 349 // Maximum number of HCA handles that can be opened. Default is "no limit". 350 HcaHandles *uint32 `json:"hcaHandles,omitempty"` 351 // Maximum number of HCA objects that can be created. Default is "no limit". 352 HcaObjects *uint32 `json:"hcaObjects,omitempty"` 353 } 354 355 // LinuxResources has container runtime resource constraints 356 type LinuxResources struct { 357 // Devices configures the device whitelist. 358 Devices []LinuxDeviceCgroup `json:"devices,omitempty"` 359 // Memory restriction configuration 360 Memory *LinuxMemory `json:"memory,omitempty"` 361 // CPU resource restriction configuration 362 CPU *LinuxCPU `json:"cpu,omitempty"` 363 // Task resource restriction configuration. 364 Pids *LinuxPids `json:"pids,omitempty"` 365 // BlockIO restriction configuration 366 BlockIO *LinuxBlockIO `json:"blockIO,omitempty"` 367 // Hugetlb limit (in bytes) 368 HugepageLimits []LinuxHugepageLimit `json:"hugepageLimits,omitempty"` 369 // Network restriction configuration 370 Network *LinuxNetwork `json:"network,omitempty"` 371 // Rdma resource restriction configuration. 372 // Limits are a set of key value pairs that define RDMA resource limits, 373 // where the key is device name and value is resource limits. 374 Rdma map[string]LinuxRdma `json:"rdma,omitempty"` 375 } 376 377 // LinuxDevice represents the mknod information for a Linux special device file 378 type LinuxDevice struct { 379 // Path to the device. 380 Path string `json:"path"` 381 // Device type, block, char, etc. 382 Type string `json:"type"` 383 // Major is the device's major number. 384 Major int64 `json:"major"` 385 // Minor is the device's minor number. 386 Minor int64 `json:"minor"` 387 // FileMode permission bits for the device. 388 FileMode *os.FileMode `json:"fileMode,omitempty"` 389 // UID of the device. 390 UID *uint32 `json:"uid,omitempty"` 391 // Gid of the device. 392 GID *uint32 `json:"gid,omitempty"` 393 } 394 395 // LinuxDeviceCgroup represents a device rule for the whitelist controller 396 type LinuxDeviceCgroup struct { 397 // Allow or deny 398 Allow bool `json:"allow"` 399 // Device type, block, char, etc. 400 Type string `json:"type,omitempty"` 401 // Major is the device's major number. 402 Major *int64 `json:"major,omitempty"` 403 // Minor is the device's minor number. 404 Minor *int64 `json:"minor,omitempty"` 405 // Cgroup access permissions format, rwm. 406 Access string `json:"access,omitempty"` 407 } 408 409 // LinuxPersonalityDomain refers to a personality domain. 410 type LinuxPersonalityDomain string 411 412 // LinuxPersonalityFlag refers to an additional personality flag. None are currently defined. 413 type LinuxPersonalityFlag string 414 415 // Define domain and flags for Personality 416 const ( 417 // PerLinux is the standard Linux personality 418 PerLinux LinuxPersonalityDomain = "LINUX" 419 // PerLinux32 sets personality to 32 bit 420 PerLinux32 LinuxPersonalityDomain = "LINUX32" 421 ) 422 423 // LinuxPersonality represents the Linux personality syscall input 424 type LinuxPersonality struct { 425 // Domain for the personality 426 Domain LinuxPersonalityDomain `json:"domain"` 427 // Additional flags 428 Flags []LinuxPersonalityFlag `json:"flags,omitempty"` 429 } 430 431 // Solaris contains platform-specific configuration for Solaris application containers. 432 type Solaris struct { 433 // SMF FMRI which should go "online" before we start the container process. 434 Milestone string `json:"milestone,omitempty"` 435 // Maximum set of privileges any process in this container can obtain. 436 LimitPriv string `json:"limitpriv,omitempty"` 437 // The maximum amount of shared memory allowed for this container. 438 MaxShmMemory string `json:"maxShmMemory,omitempty"` 439 // Specification for automatic creation of network resources for this container. 440 Anet []SolarisAnet `json:"anet,omitempty"` 441 // Set limit on the amount of CPU time that can be used by container. 442 CappedCPU *SolarisCappedCPU `json:"cappedCPU,omitempty"` 443 // The physical and swap caps on the memory that can be used by this container. 444 CappedMemory *SolarisCappedMemory `json:"cappedMemory,omitempty"` 445 } 446 447 // SolarisCappedCPU allows users to set limit on the amount of CPU time that can be used by container. 448 type SolarisCappedCPU struct { 449 Ncpus string `json:"ncpus,omitempty"` 450 } 451 452 // SolarisCappedMemory allows users to set the physical and swap caps on the memory that can be used by this container. 453 type SolarisCappedMemory struct { 454 Physical string `json:"physical,omitempty"` 455 Swap string `json:"swap,omitempty"` 456 } 457 458 // SolarisAnet provides the specification for automatic creation of network resources for this container. 459 type SolarisAnet struct { 460 // Specify a name for the automatically created VNIC datalink. 461 Linkname string `json:"linkname,omitempty"` 462 // Specify the link over which the VNIC will be created. 463 Lowerlink string `json:"lowerLink,omitempty"` 464 // The set of IP addresses that the container can use. 465 Allowedaddr string `json:"allowedAddress,omitempty"` 466 // Specifies whether allowedAddress limitation is to be applied to the VNIC. 467 Configallowedaddr string `json:"configureAllowedAddress,omitempty"` 468 // The value of the optional default router. 469 Defrouter string `json:"defrouter,omitempty"` 470 // Enable one or more types of link protection. 471 Linkprotection string `json:"linkProtection,omitempty"` 472 // Set the VNIC's macAddress 473 Macaddress string `json:"macAddress,omitempty"` 474 } 475 476 // Windows defines the runtime configuration for Windows based containers, including Hyper-V containers. 477 type Windows struct { 478 // LayerFolders contains a list of absolute paths to directories containing image layers. 479 LayerFolders []string `json:"layerFolders"` 480 // Devices are the list of devices to be mapped into the container. 481 Devices []WindowsDevice `json:"devices,omitempty"` 482 // Resources contains information for handling resource constraints for the container. 483 Resources *WindowsResources `json:"resources,omitempty"` 484 // CredentialSpec contains a JSON object describing a group Managed Service Account (gMSA) specification. 485 CredentialSpec interface{} `json:"credentialSpec,omitempty"` 486 // Servicing indicates if the container is being started in a mode to apply a Windows Update servicing operation. 487 Servicing bool `json:"servicing,omitempty"` 488 // IgnoreFlushesDuringBoot indicates if the container is being started in a mode where disk writes are not flushed during its boot process. 489 IgnoreFlushesDuringBoot bool `json:"ignoreFlushesDuringBoot,omitempty"` 490 // HyperV contains information for running a container with Hyper-V isolation. 491 HyperV *WindowsHyperV `json:"hyperv,omitempty"` 492 // Network restriction configuration. 493 Network *WindowsNetwork `json:"network,omitempty"` 494 } 495 496 // WindowsDevice represents information about a host device to be mapped into the container. 497 type WindowsDevice struct { 498 // Device identifier: interface class GUID, etc. 499 ID string `json:"id"` 500 // Device identifier type: "class", etc. 501 IDType string `json:"idType"` 502 } 503 504 // WindowsResources has container runtime resource constraints for containers running on Windows. 505 type WindowsResources struct { 506 // Memory restriction configuration. 507 Memory *WindowsMemoryResources `json:"memory,omitempty"` 508 // CPU resource restriction configuration. 509 CPU *WindowsCPUResources `json:"cpu,omitempty"` 510 // Storage restriction configuration. 511 Storage *WindowsStorageResources `json:"storage,omitempty"` 512 } 513 514 // WindowsMemoryResources contains memory resource management settings. 515 type WindowsMemoryResources struct { 516 // Memory limit in bytes. 517 Limit *uint64 `json:"limit,omitempty"` 518 } 519 520 // WindowsCPUResources contains CPU resource management settings. 521 type WindowsCPUResources struct { 522 // Number of CPUs available to the container. 523 Count *uint64 `json:"count,omitempty"` 524 // CPU shares (relative weight to other containers with cpu shares). 525 Shares *uint16 `json:"shares,omitempty"` 526 // Specifies the portion of processor cycles that this container can use as a percentage times 100. 527 Maximum *uint16 `json:"maximum,omitempty"` 528 } 529 530 // WindowsStorageResources contains storage resource management settings. 531 type WindowsStorageResources struct { 532 // Specifies maximum Iops for the system drive. 533 Iops *uint64 `json:"iops,omitempty"` 534 // Specifies maximum bytes per second for the system drive. 535 Bps *uint64 `json:"bps,omitempty"` 536 // Sandbox size specifies the minimum size of the system drive in bytes. 537 SandboxSize *uint64 `json:"sandboxSize,omitempty"` 538 } 539 540 // WindowsNetwork contains network settings for Windows containers. 541 type WindowsNetwork struct { 542 // List of HNS endpoints that the container should connect to. 543 EndpointList []string `json:"endpointList,omitempty"` 544 // Specifies if unqualified DNS name resolution is allowed. 545 AllowUnqualifiedDNSQuery bool `json:"allowUnqualifiedDNSQuery,omitempty"` 546 // Comma separated list of DNS suffixes to use for name resolution. 547 DNSSearchList []string `json:"DNSSearchList,omitempty"` 548 // Name (ID) of the container that we will share with the network stack. 549 NetworkSharedContainerName string `json:"networkSharedContainerName,omitempty"` 550 // name (ID) of the network namespace that will be used for the container. 551 NetworkNamespace string `json:"networkNamespace,omitempty"` 552 } 553 554 // WindowsHyperV contains information for configuring a container to run with Hyper-V isolation. 555 type WindowsHyperV struct { 556 // UtilityVMPath is an optional path to the image used for the Utility VM. 557 UtilityVMPath string `json:"utilityVMPath,omitempty"` 558 } 559 560 // VM contains information for virtual-machine-based containers. 561 type VM struct { 562 // Hypervisor specifies hypervisor-related configuration for virtual-machine-based containers. 563 Hypervisor VMHypervisor `json:"hypervisor,omitempty"` 564 // Kernel specifies kernel-related configuration for virtual-machine-based containers. 565 Kernel VMKernel `json:"kernel"` 566 // Image specifies guest image related configuration for virtual-machine-based containers. 567 Image VMImage `json:"image,omitempty"` 568 } 569 570 // VMHypervisor contains information about the hypervisor to use for a virtual machine. 571 type VMHypervisor struct { 572 // Path is the host path to the hypervisor used to manage the virtual machine. 573 Path string `json:"path"` 574 // Parameters specifies parameters to pass to the hypervisor. 575 Parameters []string `json:"parameters,omitempty"` 576 } 577 578 // VMKernel contains information about the kernel to use for a virtual machine. 579 type VMKernel struct { 580 // Path is the host path to the kernel used to boot the virtual machine. 581 Path string `json:"path"` 582 // Parameters specifies parameters to pass to the kernel. 583 Parameters []string `json:"parameters,omitempty"` 584 // InitRD is the host path to an initial ramdisk to be used by the kernel. 585 InitRD string `json:"initrd,omitempty"` 586 } 587 588 // VMImage contains information about the virtual machine root image. 589 type VMImage struct { 590 // Path is the host path to the root image that the VM kernel would boot into. 591 Path string `json:"path"` 592 // Format is the root image format type (e.g. "qcow2", "raw", "vhd", etc). 593 Format string `json:"format"` 594 } 595 596 // LinuxSeccomp represents syscall restrictions 597 type LinuxSeccomp struct { 598 DefaultAction LinuxSeccompAction `json:"defaultAction"` 599 Architectures []Arch `json:"architectures,omitempty"` 600 Flags []LinuxSeccompFlag `json:"flags,omitempty"` 601 Syscalls []LinuxSyscall `json:"syscalls,omitempty"` 602 } 603 604 // Arch used for additional architectures 605 type Arch string 606 607 // LinuxSeccompFlag is a flag to pass to seccomp(2). 608 type LinuxSeccompFlag string 609 610 // Additional architectures permitted to be used for system calls 611 // By default only the native architecture of the kernel is permitted 612 const ( 613 ArchX86 Arch = "SCMP_ARCH_X86" 614 ArchX86_64 Arch = "SCMP_ARCH_X86_64" 615 ArchX32 Arch = "SCMP_ARCH_X32" 616 ArchARM Arch = "SCMP_ARCH_ARM" 617 ArchAARCH64 Arch = "SCMP_ARCH_AARCH64" 618 ArchMIPS Arch = "SCMP_ARCH_MIPS" 619 ArchMIPS64 Arch = "SCMP_ARCH_MIPS64" 620 ArchMIPS64N32 Arch = "SCMP_ARCH_MIPS64N32" 621 ArchMIPSEL Arch = "SCMP_ARCH_MIPSEL" 622 ArchMIPSEL64 Arch = "SCMP_ARCH_MIPSEL64" 623 ArchMIPSEL64N32 Arch = "SCMP_ARCH_MIPSEL64N32" 624 ArchPPC Arch = "SCMP_ARCH_PPC" 625 ArchPPC64 Arch = "SCMP_ARCH_PPC64" 626 ArchPPC64LE Arch = "SCMP_ARCH_PPC64LE" 627 ArchS390 Arch = "SCMP_ARCH_S390" 628 ArchS390X Arch = "SCMP_ARCH_S390X" 629 ArchPARISC Arch = "SCMP_ARCH_PARISC" 630 ArchPARISC64 Arch = "SCMP_ARCH_PARISC64" 631 ) 632 633 // LinuxSeccompAction taken upon Seccomp rule match 634 type LinuxSeccompAction string 635 636 // Define actions for Seccomp rules 637 const ( 638 ActKill LinuxSeccompAction = "SCMP_ACT_KILL" 639 ActTrap LinuxSeccompAction = "SCMP_ACT_TRAP" 640 ActErrno LinuxSeccompAction = "SCMP_ACT_ERRNO" 641 ActTrace LinuxSeccompAction = "SCMP_ACT_TRACE" 642 ActAllow LinuxSeccompAction = "SCMP_ACT_ALLOW" 643 ActLog LinuxSeccompAction = "SCMP_ACT_LOG" 644 ) 645 646 // LinuxSeccompOperator used to match syscall arguments in Seccomp 647 type LinuxSeccompOperator string 648 649 // Define operators for syscall arguments in Seccomp 650 const ( 651 OpNotEqual LinuxSeccompOperator = "SCMP_CMP_NE" 652 OpLessThan LinuxSeccompOperator = "SCMP_CMP_LT" 653 OpLessEqual LinuxSeccompOperator = "SCMP_CMP_LE" 654 OpEqualTo LinuxSeccompOperator = "SCMP_CMP_EQ" 655 OpGreaterEqual LinuxSeccompOperator = "SCMP_CMP_GE" 656 OpGreaterThan LinuxSeccompOperator = "SCMP_CMP_GT" 657 OpMaskedEqual LinuxSeccompOperator = "SCMP_CMP_MASKED_EQ" 658 ) 659 660 // LinuxSeccompArg used for matching specific syscall arguments in Seccomp 661 type LinuxSeccompArg struct { 662 Index uint `json:"index"` 663 Value uint64 `json:"value"` 664 ValueTwo uint64 `json:"valueTwo,omitempty"` 665 Op LinuxSeccompOperator `json:"op"` 666 } 667 668 // LinuxSyscall is used to match a syscall in Seccomp 669 type LinuxSyscall struct { 670 Names []string `json:"names"` 671 Action LinuxSeccompAction `json:"action"` 672 Args []LinuxSeccompArg `json:"args,omitempty"` 673 } 674 675 // LinuxIntelRdt has container runtime resource constraints for Intel RDT 676 // CAT and MBA features which introduced in Linux 4.10 and 4.12 kernel 677 type LinuxIntelRdt struct { 678 // The identity for RDT Class of Service 679 ClosID string `json:"closID,omitempty"` 680 // The schema for L3 cache id and capacity bitmask (CBM) 681 // Format: "L3:<cache_id0>=<cbm0>;<cache_id1>=<cbm1>;..." 682 L3CacheSchema string `json:"l3CacheSchema,omitempty"` 683 684 // The schema of memory bandwidth per L3 cache id 685 // Format: "MB:<cache_id0>=bandwidth0;<cache_id1>=bandwidth1;..." 686 // The unit of memory bandwidth is specified in "percentages" by 687 // default, and in "MBps" if MBA Software Controller is enabled. 688 MemBwSchema string `json:"memBwSchema,omitempty"` 689 }