container_spec/
lib.rs

1/*
2 * Copyright 2020 fsyncd, Berlin, Germany.
3 * Additional material, copyright of the containerd authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 *     http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18use serde::{Deserialize, Serialize};
19use std::collections::HashMap;
20
21#[macro_use]
22extern crate derive_builder;
23
24/// Spec is the base configuration for the container.
25#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
26#[builder(default, setter(into))]
27pub struct Spec {
28    /// Version of the Open Container Initiative Runtime Specification with which the bundle complies.
29    #[serde(rename = "ociVersion")]
30    version: String,
31    /// Process configures the container process.
32    #[serde(skip_serializing_if = "Option::is_none")]
33    process: Option<Process>,
34    /// Root configures the container's root filesystem.
35    #[serde(skip_serializing_if = "Option::is_none")]
36    root: Option<Root>,
37    /// Hostname configures the container's hostname.
38    #[serde(skip_serializing_if = "Option::is_none")]
39    hostname: Option<String>,
40    /// Mounts configures additional mounts (on top of Root).
41    #[serde(skip_serializing_if = "Vec::is_empty")]
42    mounts: Vec<Mount>,
43    /// Hooks configures callbacks for container lifecycle events.
44    #[serde(skip_serializing_if = "Option::is_none")]
45    hooks: Option<Hooks>,
46    /// Annotations contains arbitrary metadata for the container.
47    #[serde(skip_serializing_if = "HashMap::is_empty")]
48    annotations: HashMap<String, String>,
49    /// Linux is platform-specific configuration for Linux based containers.
50    #[serde(skip_serializing_if = "Option::is_none")]
51    linux: Option<Linux>,
52}
53
54/// Process contains information to start a specific application inside the container.
55#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
56#[builder(default, setter(into))]
57pub struct Process {
58    /// Terminal creates an interactive terminal for the container.
59    #[serde(skip_serializing_if = "Option::is_none")]
60    terminal: Option<bool>,
61    /// ConsoleSize specifies the size of the console.
62    #[serde(skip_serializing_if = "Option::is_none", rename = "consoleSize")]
63    console_size: Option<ConsoleSizeBox>,
64    /// User specifies user information for the process.
65    user: User,
66    /// Args specifies the binary and arguments for the application to execute.
67    #[serde(skip_serializing_if = "Vec::is_empty")]
68    args: Vec<String>,
69    /// Env populates the process environment for the process.
70    #[serde(skip_serializing_if = "Vec::is_empty")]
71    env: Vec<String>,
72    /// Cwd is the current working directory for the process and must be
73    /// relative to the container's root.
74    cwd: String,
75    /// Capabilities are Linux capabilities that are kept for the process.
76    #[serde(skip_serializing_if = "Option::is_none")]
77    capabilities: Option<LinuxCapabilities>,
78    /// Rlimits specifies rlimit options to apply to the process.
79    #[serde(skip_serializing_if = "Vec::is_empty")]
80    rlimits: Vec<POSIXRlimit>,
81    /// NoNewPrivileges controls whether additional privileges could be gained by processes in the container.
82    #[serde(skip_serializing_if = "Option::is_none", rename = "noNewPrivileges")]
83    no_new_privileges: Option<bool>,
84    /// ApparmorProfile specifies the apparmor profile for the container.
85    #[serde(skip_serializing_if = "Option::is_none", rename = "apparmorProfile")]
86    app_armor_profile: Option<String>,
87    /// Specify an oom_score_adj for the container.
88    #[serde(skip_serializing_if = "Option::is_none", rename = "oomScoreAdj")]
89    oom_score_adj: Option<i32>,
90    /// SelinuxLabel specifies the selinux context that the container process is run as.
91    #[serde(skip_serializing_if = "Option::is_none", rename = "selinuxLabel")]
92    selinux_label: Option<String>,
93}
94
95/// LinuxCapabilities specifies the whitelist of capabilities that are kept for a process.
96/// http://man7.org/linux/man-pages/man7/capabilities.7.html
97#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
98#[builder(default, setter(into))]
99pub struct LinuxCapabilities {
100    /// Bounding is the set of capabilities checked by the kernel.
101    #[serde(skip_serializing_if = "Vec::is_empty")]
102    bounding: Vec<String>,
103    /// Effective is the set of capabilities checked by the kernel.
104    #[serde(skip_serializing_if = "Vec::is_empty")]
105    effective: Vec<String>,
106    /// Inheritable is the capabilities preserved across execve.
107    #[serde(skip_serializing_if = "Vec::is_empty")]
108    inheritable: Vec<String>,
109    /// Permitted is the limiting superset for effective capabilities.
110    #[serde(skip_serializing_if = "Vec::is_empty")]
111    permitted: Vec<String>,
112    /// Ambient is the ambient set of capabilities that are kept.
113    #[serde(skip_serializing_if = "Vec::is_empty")]
114    ambient: Vec<String>,
115}
116
117/// ConsoleSizeBox specifies dimensions of a rectangle. Used for specifying the size of a console.
118#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
119#[builder(default, setter(into))]
120pub struct ConsoleSizeBox {
121    /// Height is the vertical dimension of a box.
122    height: u32,
123    /// Width is the horizontal dimension of a box.
124    width: u32,
125}
126
127/// User specifies specific user (and group) information for the container process.
128#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
129#[builder(default, setter(into))]
130pub struct User {
131    /// UID is the user id.
132    uid: u32,
133    /// GID is the group id.
134    gid: u32,
135    /// Umask is the umask for the init process.
136    #[serde(skip_serializing_if = "Option::is_none")]
137    umask: Option<u32>,
138    /// AdditionalGids are additional group ids set for the container's process.
139    #[serde(skip_serializing_if = "Vec::is_empty", rename = "additionalGids")]
140    additional_gids: Vec<u32>,
141}
142
143/// Root contains information about the container's root filesystem on the host.
144#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
145#[builder(default, setter(into))]
146pub struct Root {
147    /// Path is the absolute path to the container's root filesystem.
148    path: String,
149    /// Readonly makes the root filesystem for the container readonly before the process is executed.
150    #[serde(skip_serializing_if = "Option::is_none")]
151    readonly: Option<bool>,
152}
153
154/// Mount specifies a mount for a container.
155#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
156#[builder(default, setter(into))]
157pub struct Mount {
158    /// Destination is the absolute path where the mount will be placed in the container.
159    destination: String,
160    /// Type specifies the mount kind.
161    #[serde(skip_serializing_if = "Option::is_none", rename = "type")]
162    mount_type: Option<String>,
163    /// Source specifies the source path of the mount.
164    #[serde(skip_serializing_if = "Option::is_none")]
165    source: Option<String>,
166    /// Options are fstab style mount options.
167    #[serde(skip_serializing_if = "Vec::is_empty")]
168    options: Vec<String>,
169}
170
171/// Hook specifies a command that is run at a particular event in the lifecycle of a container
172#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
173#[builder(default, setter(into))]
174pub struct Hook {
175    path: String,
176    #[serde(skip_serializing_if = "Vec::is_empty")]
177    args: Vec<String>,
178    #[serde(skip_serializing_if = "Vec::is_empty")]
179    env: Vec<String>,
180    #[serde(skip_serializing_if = "Option::is_none")]
181    timeout: Option<i32>,
182}
183
184/// Hooks specifies a command that is run in the container at a particular event in the lifecycle of a container
185/// Hooks for container setup and teardown
186#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
187#[builder(default, setter(into))]
188pub struct Hooks {
189    /// Prestart is Deprecated. Prestart is a list of hooks to be run before the container process is executed.
190    /// It is called in the Runtime Namespace
191    #[serde(skip_serializing_if = "Vec::is_empty")]
192    prestart: Vec<Hook>,
193    /// CreateRuntime is a list of hooks to be run after the container has been created but before pivot_root or any equivalent operation has been called
194    /// It is called in the Runtime Namespace
195    #[serde(skip_serializing_if = "Vec::is_empty", rename = "createRuntime")]
196    create_runtime: Vec<Hook>,
197    /// CreateContainer is a list of hooks to be run after the container has been created but before pivot_root or any equivalent operation has been called
198    /// It is called in the Container Namespace
199    #[serde(skip_serializing_if = "Vec::is_empty", rename = "createContainer")]
200    create_container: Vec<Hook>,
201    /// StartContainer is a list of hooks to be run after the start operation is called but before the container process is started
202    /// It is called in the Container Namespace
203    #[serde(skip_serializing_if = "Vec::is_empty", rename = "startContainer")]
204    start_container: Vec<Hook>,
205    /// Poststart is a list of hooks to be run after the container process is started.
206    /// It is called in the Runtime Namespace
207    #[serde(skip_serializing_if = "Vec::is_empty")]
208    poststart: Vec<String>,
209    /// Poststop is a list of hooks to be run after the container process exits.
210    /// It is called in the Runtime Namespace
211    #[serde(skip_serializing_if = "Vec::is_empty")]
212    poststop: Vec<String>,
213}
214
215/// Linux contains platform-specific configuration for Linux based containers.
216#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
217#[builder(default, setter(into))]
218pub struct Linux {
219    /// UIDMapping specifies user mappings for supporting user namespaces.
220    #[serde(skip_serializing_if = "Vec::is_empty", rename = "uidMappings")]
221    uid_mappings: Vec<LinuxIDMapping>,
222    /// GIDMapping specifies group mappings for supporting user namespaces.
223    #[serde(skip_serializing_if = "Vec::is_empty", rename = "gidMappings")]
224    gid_mappings: Vec<LinuxIDMapping>,
225    /// Sysctl are a set of key value pairs that are set for the container on start
226    #[serde(skip_serializing_if = "HashMap::is_empty")]
227    sysctl: HashMap<String, String>,
228    /// Resources contain cgroup information for handling resource constraints
229    /// for the container
230    #[serde(skip_serializing_if = "Option::is_none")]
231    resources: Option<LinuxResources>,
232    /// CgroupsPath specifies the path to cgroups that are created and/or joined by the container.
233    /// The path is expected to be relative to the cgroups mountpoint.
234    /// If resources are specified, the cgroups at CgroupsPath will be updated based on resources.
235    #[serde(skip_serializing_if = "Option::is_none", rename = "cgroupsPath")]
236    cgroups_path: Option<String>,
237    /// Namespaces contains the namespaces that are created and/or joined by the container
238    #[serde(skip_serializing_if = "Vec::is_empty")]
239    namespaces: Vec<LinuxNamespace>,
240    /// Devices are a list of device nodes that are created for the container
241    #[serde(skip_serializing_if = "Vec::is_empty")]
242    devices: Vec<LinuxDevice>,
243    /// Seccomp specifies the seccomp security settings for the container.
244    #[serde(skip_serializing_if = "Option::is_none")]
245    seccomp: Option<LinuxSeccomp>,
246    /// RootfsPropagation is the rootfs mount propagation mode for the container.
247    #[serde(skip_serializing_if = "Option::is_none", rename = "rootfsPropagation")]
248    rootfs_propagation: Option<String>,
249    /// MaskedPaths masks over the provided paths inside the container.
250    #[serde(skip_serializing_if = "Vec::is_empty", rename = "maskedPaths")]
251    masked_paths: Vec<String>,
252    /// ReadonlyPaths sets the provided paths as RO inside the container.
253    #[serde(skip_serializing_if = "Vec::is_empty", rename = "readonlyPaths")]
254    readonly_paths: Vec<String>,
255    /// MountLabel specifies the selinux context for the mounts in the container.
256    #[serde(skip_serializing_if = "Option::is_none", rename = "mountLabel")]
257    mount_label: Option<String>,
258    /// IntelRdt contains Intel Resource Director Technology (RDT) information for
259    /// handling resource constraints (e.g., L3 cache, memory bandwidth) for the container
260    #[serde(skip_serializing_if = "Option::is_none", rename = "intelRdt")]
261    intel_rdt: Option<LinuxIntelRdt>,
262    /// Personality contains configuration for the Linux personality syscall
263    #[serde(skip_serializing_if = "Option::is_none")]
264    personality: Option<LinuxPersonality>,
265}
266
267/// LinuxNamespace is the configuration for a Linux namespace
268#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
269#[builder(default, setter(into))]
270pub struct LinuxNamespace {
271    /// Type is the type of namespace
272    #[serde(rename = "type")]
273    namespace_type: String,
274    /// Path is a path to an existing namespace persisted on disk that can be joined
275    /// and is of the same type
276    #[serde(skip_serializing_if = "Option::is_none")]
277    path: Option<String>,
278}
279
280/// LinuxIDMapping specifies UID/GID mappings
281#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
282#[builder(default, setter(into))]
283pub struct LinuxIDMapping {
284    /// ContainerID is the starting UID/GID in the container
285    #[serde(rename = "containerID")]
286    container_id: u32,
287    /// HostID is the starting UID/GID on the host to be mapped to 'ContainerID'
288    #[serde(rename = "hostID")]
289    host_id: u32,
290    /// Size is the number of IDs to be mapped
291    size: u32,
292}
293
294/// POSIXRlimit type and restrictions
295#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
296#[builder(default, setter(into))]
297pub struct POSIXRlimit {
298    /// Type of the rlimit to set
299    #[serde(rename = "type")]
300    rlimit_type: String,
301    /// Hard is the hard limit for the specified type
302    hard: u64,
303    /// Soft is the soft limit for the specified type
304    soft: u64,
305}
306
307// LinuxHugepageLimit structure corresponds to limiting kernel hugepages
308#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
309#[builder(default, setter(into))]
310pub struct LinuxHugepageLimit {
311    /// Pagesize is the hugepage size
312    /// Format: "<size><unit-prefix>B' (e.g. 64KB, 2MB, 1GB, etc.)
313    #[serde(rename = "pageSize")]
314    page_size: String,
315    /// Limit is the limit of "hugepagesize" hugetlb usage
316    limit: u64,
317}
318
319/// LinuxInterfacePriority for network interfaces
320#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
321#[builder(default, setter(into))]
322pub struct LinuxInterfacePriority {
323    /// Name is the name of the network interface
324    name: String,
325    /// Priority for the interface
326    priority: u32,
327}
328
329/// LinuxWeightDevice struct holds a `major:minor weight` pair for weightDevice
330#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
331#[builder(default, setter(into))]
332pub struct LinuxWeightDevice {
333    /// Major is the device's major number.
334    major: i64,
335    /// Minor is the device's minor number.
336    minor: i64,
337    /// Weight is the bandwidth rate for the device.
338    #[serde(skip_serializing_if = "Option::is_none")]
339    weight: Option<u16>,
340    /// LeafWeight is the bandwidth rate for the device while competing with the cgroup's child cgroups, CFQ scheduler only
341    #[serde(skip_serializing_if = "Option::is_none", rename = "leafWeight")]
342    leaf_weight: Option<u16>,
343}
344
345/// LinuxThrottleDevice struct holds a `major:minor rate_per_second` pai
346#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
347#[builder(default, setter(into))]
348pub struct LinuxThrottleDevice {
349    /// Major is the device's major number.
350    major: i64,
351    /// Minor is the device's minor number.
352    minor: i64,
353    /// Rate is the IO rate limit per cgroup per device
354    rate: u64,
355}
356
357/// LinuxBlockIO for Linux cgroup 'blkio' resource management
358#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
359#[builder(default, setter(into))]
360pub struct LinuxBlockIO {
361    /// Specifies per cgroup weight
362    #[serde(skip_serializing_if = "Option::is_none")]
363    weight: Option<u16>,
364    /// Specifies tasks' weight in the given cgroup while competing with the cgroup's child cgroups, CFQ scheduler only
365    #[serde(skip_serializing_if = "Option::is_none", rename = "leafWeight")]
366    leaf_weight: Option<u16>,
367    /// Weight per cgroup per device, can override BlkioWeight
368    #[serde(skip_serializing_if = "Vec::is_empty", rename = "weightDevice")]
369    weight_device: Vec<LinuxWeightDevice>,
370    /// IO read rate limit per cgroup per device, bytes per second
371    #[serde(
372        skip_serializing_if = "Vec::is_empty",
373        rename = "throttleReadBpsDevice"
374    )]
375    throttle_read_bps_device: Vec<LinuxThrottleDevice>,
376    /// IO write rate limit per cgroup per device, bytes per second
377    #[serde(
378        skip_serializing_if = "Vec::is_empty",
379        rename = "throttleWriteBpsDevice"
380    )]
381    throttle_write_bps_device: Vec<LinuxThrottleDevice>,
382    /// IO read rate limit per cgroup per device, IO per second
383    #[serde(
384        skip_serializing_if = "Vec::is_empty",
385        rename = "throttleReadIOPSDevice"
386    )]
387    throttle_read_iops_device: Vec<LinuxThrottleDevice>,
388    /// IO write rate limit per cgroup per device, IO per second
389    #[serde(
390        skip_serializing_if = "Vec::is_empty",
391        rename = "throttleWriteIOPSDevice"
392    )]
393    throttle_write_iops_device: Vec<LinuxThrottleDevice>,
394}
395
396/// LinuxMemory for Linux cgroup 'memory' resource management
397#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
398#[builder(default, setter(into))]
399pub struct LinuxMemory {
400    /// Memory limit (in bytes).
401    #[serde(skip_serializing_if = "Option::is_none")]
402    limit: Option<i64>,
403    /// Memory reservation or soft_limit (in bytes).
404    #[serde(skip_serializing_if = "Option::is_none")]
405    reservation: Option<i64>,
406    /// Total memory limit (memory + swap).
407    #[serde(skip_serializing_if = "Option::is_none")]
408    swap: Option<i64>,
409    /// Kernel memory limit (in bytes).
410    #[serde(skip_serializing_if = "Option::is_none")]
411    kernel: Option<i64>,
412    /// Kernel memory limit for tcp (in bytes)
413    #[serde(skip_serializing_if = "Option::is_none", rename = "kernelTCP")]
414    kernel_tcp: Option<i64>,
415    /// How aggressive the kernel will swap memory pages.
416    #[serde(skip_serializing_if = "Option::is_none")]
417    swappiness: Option<i64>,
418    /// DisableOOMKiller disables the OOM killer for out of memory conditions
419    #[serde(skip_serializing_if = "Option::is_none", rename = "disableOOMKiller")]
420    disable_oom_killer: Option<bool>,
421    /// Enables hierarchical memory accounting
422    #[serde(skip_serializing_if = "Option::is_none", rename = "useHierarchy")]
423    use_hierarchy: Option<bool>,
424}
425
426/// LinuxCPU for Linux cgroup 'cpu' resource management
427#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
428#[builder(default, setter(into))]
429pub struct LinuxCPU {
430    /// CPU shares (relative weight (ratio) vs. other cgroups with cpu shares).
431    #[serde(skip_serializing_if = "Option::is_none")]
432    shares: Option<u64>,
433    /// CPU hardcap limit (in usecs). Allowed cpu time in a given period.
434    #[serde(skip_serializing_if = "Option::is_none")]
435    quota: Option<i64>,
436    /// CPU period to be used for hardcapping (in usecs).
437    #[serde(skip_serializing_if = "Option::is_none")]
438    period: Option<u64>,
439    /// How much time realtime scheduling may use (in usecs).
440    #[serde(skip_serializing_if = "Option::is_none", rename = "realtimeRuntime")]
441    realtime_runtime: Option<i64>,
442    /// CPU period to be used for realtime scheduling (in usecs).
443    #[serde(skip_serializing_if = "Option::is_none", rename = "realtimePeriod")]
444    realtime_period: Option<u64>,
445    /// CPUs to use within the cpuset. Default is to use any CPU available.
446    #[serde(skip_serializing_if = "Option::is_none")]
447    cpus: Option<String>,
448    /// List of memory nodes in the cpuset. Default is to use any available memory node.
449    #[serde(skip_serializing_if = "Option::is_none")]
450    mems: Option<String>,
451}
452
453/// LinuxPids for Linux cgroup 'pids' resource management (Linux 4.3)
454#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
455#[builder(default, setter(into))]
456pub struct LinuxPids {
457    /// Maximum number of PIDs. Default is "no limit".
458    limit: i64,
459}
460
461/// LinuxNetwork identification and priority configuration
462#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
463#[builder(default, setter(into))]
464pub struct LinuxNetwork {
465    /// Set class identifier for container's network packets
466    #[serde(skip_serializing_if = "Option::is_none", rename = "classID")]
467    class_id: Option<u32>,
468    /// Set priority of network traffic for container
469    #[serde(skip_serializing_if = "Vec::is_empty")]
470    priorities: Vec<LinuxInterfacePriority>,
471}
472
473/// LinuxRdma for Linux cgroup 'rdma' resource management (Linux 4.11)
474#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
475#[builder(default, setter(into))]
476pub struct LinuxRdma {
477    /// Maximum number of HCA handles that can be opened. Default is "no limit".
478    #[serde(skip_serializing_if = "Option::is_none", rename = "hcaHandles")]
479    hca_handles: Option<u32>,
480    /// Maximum number of HCA objects that can be created. Default is "no limit".
481    #[serde(skip_serializing_if = "Option::is_none", rename = "hcaObjects")]
482    hca_objects: Option<u32>,
483}
484
485/// LinuxResources has container runtime resource constraints
486#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
487#[builder(default, setter(into))]
488pub struct LinuxResources {
489    /// Devices configures the device whitelist.
490    #[serde(skip_serializing_if = "Vec::is_empty")]
491    devices: Vec<LinuxDeviceCgroup>,
492    /// Memory restriction configuration
493    #[serde(skip_serializing_if = "Option::is_none")]
494    memory: Option<LinuxMemory>,
495    /// CPU resource restriction configuration
496    #[serde(skip_serializing_if = "Option::is_none")]
497    cpu: Option<LinuxCPU>,
498    /// Task resource restriction configuration.
499    #[serde(skip_serializing_if = "Option::is_none")]
500    pids: Option<LinuxPids>,
501    /// BlockIO restriction configuration
502    #[serde(skip_serializing_if = "Option::is_none", rename = "blockIO")]
503    block_io: Option<LinuxBlockIO>,
504    /// Hugetlb limit (in bytes)
505    #[serde(skip_serializing_if = "Vec::is_empty", rename = "hugepageLimits")]
506    hugepage_limits: Vec<LinuxHugepageLimit>,
507    /// Network restriction configuration
508    #[serde(skip_serializing_if = "Option::is_none")]
509    network: Option<LinuxNetwork>,
510    /// Rdma resource restriction configuration.
511    /// Limits are a set of key value pairs that define RDMA resource limits,
512    /// where the key is device name and value is resource limits.
513    #[serde(skip_serializing_if = "HashMap::is_empty")]
514    rdma: HashMap<String, LinuxRdma>,
515}
516
517/// LinuxDevice represents the mknod information for a Linux special device file
518#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
519#[builder(default, setter(into))]
520pub struct LinuxDevice {
521    /// Path to the device.
522    path: String,
523    /// Device type, block, char, etc.
524    #[serde(rename = "type")]
525    device_type: String,
526    /// Major is the device's major number.
527    major: i64,
528    /// Minor is the device's minor number.
529    minor: i64,
530    /// FileMode permission bits for the device.
531    #[serde(skip_serializing_if = "Option::is_none", rename = "fileMode")]
532    file_mode: Option<u32>,
533    /// UID of the device.
534    #[serde(skip_serializing_if = "Option::is_none")]
535    uid: Option<u32>,
536    /// Gid of the device.
537    #[serde(skip_serializing_if = "Option::is_none")]
538    gid: Option<u32>,
539}
540
541/// LinuxDeviceCgroup represents a device rule for the whitelist controller
542#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
543#[builder(default, setter(into))]
544pub struct LinuxDeviceCgroup {
545    /// Allow or deny
546    allow: bool,
547    /// Device type, block, char, etc.
548    #[serde(skip_serializing_if = "Option::is_none", rename = "type")]
549    device_type: Option<String>,
550    /// Major is the device's major number.
551    #[serde(skip_serializing_if = "Option::is_none")]
552    major: Option<i64>,
553    /// Minor is the device's minor number.
554    #[serde(skip_serializing_if = "Option::is_none")]
555    minor: Option<i64>,
556    /// Cgroup access permissions format, rwm.
557    #[serde(skip_serializing_if = "Option::is_none")]
558    access: Option<String>,
559}
560
561/// LinuxPersonality represents the Linux personality syscall input
562#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
563#[builder(default, setter(into))]
564pub struct LinuxPersonality {
565    /// Domain for the personality
566    domain: String,
567    /// Additional flags
568    #[serde(skip_serializing_if = "Vec::is_empty")]
569    flags: Vec<String>,
570}
571
572/// LinuxSeccomp represents syscall restrictions
573#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
574#[builder(default, setter(into))]
575pub struct LinuxSeccomp {
576    #[serde(rename = "defaultAction")]
577    default_action: String,
578    #[serde(skip_serializing_if = "Vec::is_empty")]
579    architectures: Vec<String>,
580    #[serde(skip_serializing_if = "Vec::is_empty")]
581    flags: Vec<String>,
582    #[serde(skip_serializing_if = "Vec::is_empty")]
583    syscalls: Vec<LinuxSyscall>,
584}
585
586/// LinuxSeccompArg used for matching specific syscall arguments in Seccomp
587#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
588#[builder(default, setter(into))]
589pub struct LinuxSeccompArg {
590    index: u64,
591    value: u64,
592    #[serde(skip_serializing_if = "Option::is_none", rename = "valueTwo")]
593    value_two: Option<u64>,
594    op: String,
595}
596
597/// LinuxSyscall is used to match a syscall in Seccomp
598#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
599#[builder(default, setter(into))]
600pub struct LinuxSyscall {
601    names: Vec<String>,
602    action: String,
603    #[serde(skip_serializing_if = "Vec::is_empty")]
604    args: Vec<String>,
605}
606
607/// LinuxIntelRdt has container runtime resource constraints for Intel RDT
608/// CAT and MBA features which introduced in Linux 4.10 and 4.12 kernel
609#[derive(Default, Clone, Builder, Debug, Serialize, Deserialize)]
610#[builder(default, setter(into))]
611pub struct LinuxIntelRdt {
612    /// The identity for RDT Class of Service
613    #[serde(skip_serializing_if = "Option::is_none", rename = "closID")]
614    clos_id: Option<String>,
615    /// The schema for L3 cache id and capacity bitmask (CBM)
616    /// Format: "L3:<cache_id0>=<cbm0>;<cache_id1>=<cbm1>;..."
617    #[serde(skip_serializing_if = "Option::is_none", rename = "l3CacheSchema")]
618    l3_cache_schema: Option<String>,
619    /// The schema of memory bandwidth per L3 cache id
620    /// Format: "MB:<cache_id0>=bandwidth0;<cache_id1>=bandwidth1;..."
621    /// The unit of memory bandwidth is specified in "percentages" by
622    /// Default, Clone, and in "MBps" if MBA Software Controller is enabled.
623    #[serde(skip_serializing_if = "Option::is_none", rename = "memBwSchema")]
624    mem_bw_schema: Option<String>,
625}
container_spec/lib.rs

container_spec/
lib.rs
