containerization-framework 0.5.0

Rust bindings for Apple's Containerization framework: Linux containers in lightweight VMs, in-process and without a daemon.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

use crate::containerization_oci;
use crate::containerization_os;
use crate::error::Error;
use crate::platform;
use crate::platform::ffi;

/// `LinuxCapabilities`.
#[derive(Clone, Debug, Default, Eq, PartialEq)]
pub struct LinuxCapabilities {
  pub bounding: Vec<containerization_os::linux::CapabilityName>,
  pub effective: Vec<containerization_os::linux::CapabilityName>,
  pub inheritable: Vec<containerization_os::linux::CapabilityName>,
  pub permitted: Vec<containerization_os::linux::CapabilityName>,
  pub ambient: Vec<containerization_os::linux::CapabilityName>,
}

impl LinuxCapabilities {
  /// `LinuxCapabilities.allCapabilities`, which holds every capability in
  /// every set.
  pub fn all_capabilities() -> Self {
    let all = containerization_os::linux::CapabilityName::ALL_CASES.to_vec();

    Self {
      bounding: all.clone(),
      effective: all.clone(),
      inheritable: all.clone(),
      permitted: all.clone(),
      ambient: all,
    }
  }

  /// `LinuxCapabilities.defaultOCICapabilities`.
  pub fn default_oci_capabilities() -> Self {
    Self::with_capabilities(vec![
      containerization_os::linux::CapabilityName::Chown,
      containerization_os::linux::CapabilityName::DacOverride,
      containerization_os::linux::CapabilityName::Fsetid,
      containerization_os::linux::CapabilityName::Fowner,
      containerization_os::linux::CapabilityName::Mknod,
      containerization_os::linux::CapabilityName::NetRaw,
      containerization_os::linux::CapabilityName::Setgid,
      containerization_os::linux::CapabilityName::Setuid,
      containerization_os::linux::CapabilityName::Setfcap,
      containerization_os::linux::CapabilityName::Setpcap,
      containerization_os::linux::CapabilityName::NetBindService,
      containerization_os::linux::CapabilityName::SysChroot,
      containerization_os::linux::CapabilityName::Kill,
      containerization_os::linux::CapabilityName::AuditWrite,
    ])
  }

  /// `LinuxCapabilities(capabilities:)`, which puts the capabilities in the
  /// bounding, effective and permitted sets, and leaves the others empty.
  /// Rust has no overloading, so the suffix names the argument label that
  /// tells it apart from `LinuxCapabilities()`.
  pub fn with_capabilities(capabilities: Vec<containerization_os::linux::CapabilityName>) -> Self {
    Self {
      bounding: capabilities.clone(),
      effective: capabilities.clone(),
      inheritable: Vec::new(),
      permitted: capabilities,
      ambient: Vec::new(),
    }
  }

  /// `LinuxCapabilities.toOCI()`, which leaves out empty sets.
  pub fn to_oci(&self) -> Result<containerization_oci::runtime::LinuxCapabilities, Error> {
    platform::outcome(
      ffi::cz_linux_capabilities_to_oci(self.clone()),
      "convert capabilities to OCI's",
    )
    .map(|outcome| outcome.oci_linux_capabilities())
  }
}