// Package generate implements functions generating container config files.

package generate

import (

"encoding/json"

"fmt"

"io"

"os"

"slices"

"strings"

"github.com/moby/sys/capability"

rspec "github.com/opencontainers/runtime-spec/specs-go"

"github.com/opencontainers/runtime-tools/generate/seccomp"

capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"

)

var (

// Namespaces include the names of supported namespaces.

Namespaces = []string{"network", "pid", "mount", "ipc", "uts", "user", "cgroup", "time"}

// we don't care about order...and this is way faster...

removeFunc = func(s []string, i int) []string {

s[i] = s[len(s)-1]

return s[:len(s)-1]

}

)

const (

// UnlimitedPidsLimit can be passed to SetLinuxResourcesPidsLimit to

// request unlimited PIDs.

UnlimitedPidsLimit int64 = -1

)

// Generator represents a generator for a container config.

type Generator struct {

Config *rspec.Spec

HostSpecific bool

// This is used to keep a cache of the ENVs added to improve

// performance when adding a huge number of ENV variables

envMap map[string]int

}

// ExportOptions have toggles for exporting only certain parts of the specification

type ExportOptions struct {

Seccomp bool // seccomp toggles if only seccomp should be exported

}

// New creates a configuration Generator with the default

// configuration for the target operating system.

func New(os string) (generator Generator, err error) {

if os != "linux" && os != "solaris" && os != "windows" && os != "freebsd" {

return generator, fmt.Errorf("no defaults configured for %s", os)

}

config := rspec.Spec{

Version: rspec.Version,

Hostname: "mrsdalloway",

}

if os == "windows" {

config.Process = &rspec.Process{

Args: []string{

"cmd",

},

Cwd: `C:\`,

}

config.Windows = &rspec.Windows{}

} else {

config.Root = &rspec.Root{

Path: "rootfs",

Readonly: false,

}

config.Process = &rspec.Process{

Terminal: false,

Args: []string{

"sh",

},

}

}

if os == "linux" || os == "solaris" || os == "freebsd" {

config.Process.User = rspec.User{}

config.Process.Env = []string{

"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",

"TERM=xterm",

}

config.Process.Cwd = "/"

config.Process.Rlimits = []rspec.POSIXRlimit{

{

Type: "RLIMIT_NOFILE",

Hard: uint64(1024),

Soft: uint64(1024),

},

}

}

switch os {

case "linux":

config.Process.Capabilities = &rspec.LinuxCapabilities{

Bounding: []string{

"CAP_CHOWN",

"CAP_DAC_OVERRIDE",

"CAP_FSETID",

"CAP_FOWNER",

"CAP_MKNOD",

"CAP_NET_RAW",

"CAP_SETGID",

"CAP_SETUID",

"CAP_SETFCAP",

"CAP_SETPCAP",

"CAP_NET_BIND_SERVICE",

"CAP_SYS_CHROOT",

"CAP_KILL",

"CAP_AUDIT_WRITE",

},

Permitted: []string{

"CAP_CHOWN",

"CAP_DAC_OVERRIDE",

"CAP_FSETID",

"CAP_FOWNER",

"CAP_MKNOD",

"CAP_NET_RAW",

"CAP_SETGID",

"CAP_SETUID",

"CAP_SETFCAP",

"CAP_SETPCAP",

"CAP_NET_BIND_SERVICE",

"CAP_SYS_CHROOT",

"CAP_KILL",

"CAP_AUDIT_WRITE",

},

Inheritable: []string{

"CAP_CHOWN",

"CAP_DAC_OVERRIDE",

"CAP_FSETID",

"CAP_FOWNER",

"CAP_MKNOD",

"CAP_NET_RAW",

"CAP_SETGID",

"CAP_SETUID",

"CAP_SETFCAP",

"CAP_SETPCAP",

"CAP_NET_BIND_SERVICE",

"CAP_SYS_CHROOT",

"CAP_KILL",

"CAP_AUDIT_WRITE",

},

Effective: []string{

"CAP_CHOWN",

"CAP_DAC_OVERRIDE",

"CAP_FSETID",

"CAP_FOWNER",

"CAP_MKNOD",

"CAP_NET_RAW",

"CAP_SETGID",

"CAP_SETUID",

"CAP_SETFCAP",

"CAP_SETPCAP",

"CAP_NET_BIND_SERVICE",

"CAP_SYS_CHROOT",

"CAP_KILL",

"CAP_AUDIT_WRITE",

},

Ambient: []string{

"CAP_CHOWN",

"CAP_DAC_OVERRIDE",

"CAP_FSETID",

"CAP_FOWNER",

"CAP_MKNOD",

"CAP_NET_RAW",

"CAP_SETGID",

"CAP_SETUID",

"CAP_SETFCAP",

"CAP_SETPCAP",

"CAP_NET_BIND_SERVICE",

"CAP_SYS_CHROOT",

"CAP_KILL",

"CAP_AUDIT_WRITE",

},

}

config.Mounts = []rspec.Mount{

{

Destination: "/proc",

Type: "proc",

Source: "proc",

Options: []string{"nosuid", "noexec", "nodev"},

},

{

Destination: "/dev",

Type: "tmpfs",

Source: "tmpfs",

Options: []string{"nosuid", "strictatime", "mode=755", "size=65536k"},

},

{

Destination: "/dev/pts",

Type: "devpts",

Source: "devpts",

Options: []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620", "gid=5"},

},

{

Destination: "/dev/shm",

Type: "tmpfs",

Source: "shm",

Options: []string{"nosuid", "noexec", "nodev", "mode=1777", "size=65536k"},

},

{

Destination: "/dev/mqueue",

Type: "mqueue",

Source: "mqueue",

Options: []string{"nosuid", "noexec", "nodev"},

},

{

Destination: "/sys",

Type: "sysfs",

Source: "sysfs",

Options: []string{"nosuid", "noexec", "nodev", "ro"},

},

}

config.Linux = &rspec.Linux{

Resources: &rspec.LinuxResources{

Devices: []rspec.LinuxDeviceCgroup{

{

Allow: false,

Access: "rwm",

},

},

},

Namespaces: []rspec.LinuxNamespace{

{

Type: "pid",

},

{

Type: "network",

},

{

Type: "ipc",

},

{

Type: "uts",

},

{

Type: "mount",

},

},

Seccomp: seccomp.DefaultProfile(&config),

}

case "freebsd":

config.Mounts = []rspec.Mount{

{

Destination: "/dev",

Type: "devfs",

Source: "devfs",

Options: []string{"ruleset=4"},

},

{

Destination: "/dev/fd",

Type: "fdescfs",

Source: "fdesc",

Options: []string{},

},

}

}

envCache := map[string]int{}

if config.Process != nil {

envCache = createEnvCacheMap(config.Process.Env)

}

return Generator{Config: &config, envMap: envCache}, nil

}

// NewFromSpec creates a configuration Generator from a given

// configuration.

func NewFromSpec(config *rspec.Spec) Generator {

envCache := map[string]int{}

if config != nil && config.Process != nil {

envCache = createEnvCacheMap(config.Process.Env)

}

return Generator{

Config: config,

envMap: envCache,

}

}

// NewFromFile loads the template specified in a file into a

// configuration Generator.

func NewFromFile(path string) (Generator, error) {

cf, err := os.Open(path)

if err != nil {

if os.IsNotExist(err) {

return Generator{}, fmt.Errorf("template configuration at %s not found", path)

}

return Generator{}, err

}

defer cf.Close()

return NewFromTemplate(cf)

}

// NewFromTemplate loads the template from io.Reader into a

// configuration Generator.

func NewFromTemplate(r io.Reader) (Generator, error) {

var config rspec.Spec

if err := json.NewDecoder(r).Decode(&config); err != nil {

return Generator{}, err

}

envCache := map[string]int{}

if config.Process != nil {

envCache = createEnvCacheMap(config.Process.Env)

}

return Generator{

Config: &config,

envMap: envCache,

}, nil

}

// createEnvCacheMap creates a hash map with the ENV variables given by the config

func createEnvCacheMap(env []string) map[string]int {

envMap := make(map[string]int, len(env))

for i, val := range env {

envMap[val] = i

}

return envMap

}

// SetSpec sets the configuration in the Generator g.

//

// Deprecated: Replace with:

//

// Use generator.Config = config

func (g *Generator) SetSpec(config *rspec.Spec) {

g.Config = config

}

// Spec gets the configuration from the Generator g.

//

// Deprecated: Replace with generator.Config.

func (g *Generator) Spec() *rspec.Spec {

return g.Config

}

// Save writes the configuration into w.

func (g *Generator) Save(w io.Writer, exportOpts ExportOptions) (err error) {

var data []byte

if g.Config.Linux != nil {

buf, err := json.Marshal(g.Config.Linux)

if err != nil {

return err

}

if string(buf) == "{}" {

g.Config.Linux = nil

}

}

if exportOpts.Seccomp {

data, err = json.MarshalIndent(g.Config.Linux.Seccomp, "", "\t")

} else {

data, err = json.MarshalIndent(g.Config, "", "\t")

}

if err != nil {

return err

}

_, err = w.Write(data)

if err != nil {

return err

}

return nil

}

// SaveToFile writes the configuration into a file.

func (g *Generator) SaveToFile(path string, exportOpts ExportOptions) error {

f, err := os.Create(path)

if err != nil {

return err

}

defer f.Close()

return g.Save(f, exportOpts)

}

// SetVersion sets g.Config.Version.

func (g *Generator) SetVersion(version string) {

g.initConfig()

g.Config.Version = version

}

// SetRootPath sets g.Config.Root.Path.

func (g *Generator) SetRootPath(path string) {

g.initConfigRoot()

g.Config.Root.Path = path

}

// SetRootReadonly sets g.Config.Root.Readonly.

func (g *Generator) SetRootReadonly(b bool) {

g.initConfigRoot()

g.Config.Root.Readonly = b

}

// SetHostname sets g.Config.Hostname.

func (g *Generator) SetHostname(s string) {

g.initConfig()

g.Config.Hostname = s

}

// SetOCIVersion sets g.Config.Version.

func (g *Generator) SetOCIVersion(s string) {

g.initConfig()

g.Config.Version = s

}

// ClearAnnotations clears g.Config.Annotations.

func (g *Generator) ClearAnnotations() {

if g.Config == nil {

return

}

g.Config.Annotations = make(map[string]string)

}

// AddAnnotation adds an annotation into g.Config.Annotations.

func (g *Generator) AddAnnotation(key, value string) {

g.initConfigAnnotations()

g.Config.Annotations[key] = value

}

// RemoveAnnotation remove an annotation from g.Config.Annotations.

func (g *Generator) RemoveAnnotation(key string) {

if g.Config == nil || g.Config.Annotations == nil {

return

}

delete(g.Config.Annotations, key)

}

// RemoveHostname removes g.Config.Hostname, setting it to an empty string.

func (g *Generator) RemoveHostname() {

if g.Config == nil {

return

}

g.Config.Hostname = ""

}

// SetProcessConsoleSize sets g.Config.Process.ConsoleSize.

func (g *Generator) SetProcessConsoleSize(width, height uint) {

g.initConfigProcessConsoleSize()

g.Config.Process.ConsoleSize.Width = width

g.Config.Process.ConsoleSize.Height = height

}

// SetProcessUID sets g.Config.Process.User.UID.

func (g *Generator) SetProcessUID(uid uint32) {

g.initConfigProcess()

g.Config.Process.User.UID = uid

}

// SetProcessUsername sets g.Config.Process.User.Username.

func (g *Generator) SetProcessUsername(username string) {

g.initConfigProcess()

g.Config.Process.User.Username = username

}

// SetProcessUmask sets g.Config.Process.User.Umask.

func (g *Generator) SetProcessUmask(umask uint32) {

g.initConfigProcess()

u := umask

g.Config.Process.User.Umask = &u

}

// SetProcessGID sets g.Config.Process.User.GID.

func (g *Generator) SetProcessGID(gid uint32) {

g.initConfigProcess()

g.Config.Process.User.GID = gid

}

// SetProcessCwd sets g.Config.Process.Cwd.

func (g *Generator) SetProcessCwd(cwd string) {

g.initConfigProcess()

g.Config.Process.Cwd = cwd

}

// SetProcessNoNewPrivileges sets g.Config.Process.NoNewPrivileges.

func (g *Generator) SetProcessNoNewPrivileges(b bool) {

g.initConfigProcess()

g.Config.Process.NoNewPrivileges = b

}

// SetProcessTerminal sets g.Config.Process.Terminal.

func (g *Generator) SetProcessTerminal(b bool) {

g.initConfigProcess()

g.Config.Process.Terminal = b

}

// SetProcessApparmorProfile sets g.Config.Process.ApparmorProfile.

func (g *Generator) SetProcessApparmorProfile(prof string) {

g.initConfigProcess()

g.Config.Process.ApparmorProfile = prof

}

// SetProcessArgs sets g.Config.Process.Args.

func (g *Generator) SetProcessArgs(args []string) {

g.initConfigProcess()

g.Config.Process.Args = args

}

// ClearProcessEnv clears g.Config.Process.Env.

func (g *Generator) ClearProcessEnv() {

if g.Config == nil || g.Config.Process == nil {

return

}

g.Config.Process.Env = []string{}

// Clear out the env cache map as well

g.envMap = map[string]int{}

}

// AddProcessEnv adds name=value into g.Config.Process.Env, or replaces an

// existing entry with the given name.

func (g *Generator) AddProcessEnv(name, value string) {

if name == "" {

return

}

g.initConfigProcess()

g.addEnv(fmt.Sprintf("%s=%s", name, value), name)

}

// AddMultipleProcessEnv adds multiple name=value into g.Config.Process.Env, or replaces

// existing entries with the given name.

func (g *Generator) AddMultipleProcessEnv(envs []string) {

g.initConfigProcess()

for _, val := range envs {

split := strings.SplitN(val, "=", 2)

g.addEnv(val, split[0])

}

}

// addEnv looks through adds ENV to the Process and checks envMap for

// any duplicates

// This is called by both AddMultipleProcessEnv and AddProcessEnv

func (g *Generator) addEnv(env, key string) {

if idx, ok := g.envMap[key]; ok {

// The ENV exists in the cache, so change its value in g.Config.Process.Env

g.Config.Process.Env[idx] = env

} else {

// else the env doesn't exist, so add it and add it's index to g.envMap

g.Config.Process.Env = append(g.Config.Process.Env, env)

g.envMap[key] = len(g.Config.Process.Env) - 1

}

}

// AddProcessRlimits adds rlimit into g.Config.Process.Rlimits.

func (g *Generator) AddProcessRlimits(rType string, rHard uint64, rSoft uint64) {

g.initConfigProcess()

for i, rlimit := range g.Config.Process.Rlimits {

if rlimit.Type == rType {

g.Config.Process.Rlimits[i].Hard = rHard

g.Config.Process.Rlimits[i].Soft = rSoft

return

}

}

newRlimit := rspec.POSIXRlimit{

Type: rType,

Hard: rHard,

Soft: rSoft,

}

g.Config.Process.Rlimits = append(g.Config.Process.Rlimits, newRlimit)

}

// RemoveProcessRlimits removes a rlimit from g.Config.Process.Rlimits.

func (g *Generator) RemoveProcessRlimits(rType string) {

if g.Config == nil || g.Config.Process == nil {

return

}

for i, rlimit := range g.Config.Process.Rlimits {

if rlimit.Type == rType {

g.Config.Process.Rlimits = append(g.Config.Process.Rlimits[:i], g.Config.Process.Rlimits[i+1:]...)

return

}

}

}

// ClearProcessRlimits clear g.Config.Process.Rlimits.

func (g *Generator) ClearProcessRlimits() {

if g.Config == nil || g.Config.Process == nil {

return

}

g.Config.Process.Rlimits = []rspec.POSIXRlimit{}

}

// ClearProcessAdditionalGids clear g.Config.Process.AdditionalGids.

func (g *Generator) ClearProcessAdditionalGids() {

if g.Config == nil || g.Config.Process == nil {

return

}

g.Config.Process.User.AdditionalGids = []uint32{}

}

// AddProcessAdditionalGid adds an additional gid into g.Config.Process.AdditionalGids.

func (g *Generator) AddProcessAdditionalGid(gid uint32) { //nolint:staticcheck // Ignore ST1003: method AddProcessAdditionalGid should be AddProcessAdditionalGID

g.initConfigProcess()

if slices.Contains(g.Config.Process.User.AdditionalGids, gid) {

return

}

g.Config.Process.User.AdditionalGids = append(g.Config.Process.User.AdditionalGids, gid)

}

// SetProcessSelinuxLabel sets g.Config.Process.SelinuxLabel.

func (g *Generator) SetProcessSelinuxLabel(label string) {

g.initConfigProcess()

g.Config.Process.SelinuxLabel = label

}

// SetLinuxCgroupsPath sets g.Config.Linux.CgroupsPath.

func (g *Generator) SetLinuxCgroupsPath(path string) {

g.initConfigLinux()

g.Config.Linux.CgroupsPath = path

}

// SetLinuxIntelRdtClosID sets g.Config.Linux.IntelRdt.ClosID

func (g *Generator) SetLinuxIntelRdtClosID(clos string) {

g.initConfigLinuxIntelRdt()

g.Config.Linux.IntelRdt.ClosID = clos

}

// SetLinuxIntelRdtL3CacheSchema sets g.Config.Linux.IntelRdt.L3CacheSchema

func (g *Generator) SetLinuxIntelRdtL3CacheSchema(schema string) {

g.initConfigLinuxIntelRdt()

g.Config.Linux.IntelRdt.L3CacheSchema = schema

}

// SetLinuxTimeOffset sets g.Config.Linux.TimeOffsets[clock]

func (g *Generator) SetLinuxTimeOffset(clock string, offset rspec.LinuxTimeOffset) {

g.initConfigLinuxTimeOffsets()

g.Config.Linux.TimeOffsets[clock] = offset

}

// SetLinuxMountLabel sets g.Config.Linux.MountLabel.

func (g *Generator) SetLinuxMountLabel(label string) {

g.initConfigLinux()

g.Config.Linux.MountLabel = label

}

// SetProcessOOMScoreAdj sets g.Config.Process.OOMScoreAdj.

func (g *Generator) SetProcessOOMScoreAdj(adj int) {

g.initConfigProcess()

g.Config.Process.OOMScoreAdj = &adj

}

// SetLinuxResourcesBlockIOLeafWeight sets g.Config.Linux.Resources.BlockIO.LeafWeight.

func (g *Generator) SetLinuxResourcesBlockIOLeafWeight(weight uint16) {

g.initConfigLinuxResourcesBlockIO()

g.Config.Linux.Resources.BlockIO.LeafWeight = &weight

}

// AddLinuxResourcesBlockIOLeafWeightDevice adds or sets g.Config.Linux.Resources.BlockIO.WeightDevice.LeafWeight.

func (g *Generator) AddLinuxResourcesBlockIOLeafWeightDevice(major int64, minor int64, weight uint16) {

g.initConfigLinuxResourcesBlockIO()

for i, weightDevice := range g.Config.Linux.Resources.BlockIO.WeightDevice {

if weightDevice.Major == major && weightDevice.Minor == minor {

g.Config.Linux.Resources.BlockIO.WeightDevice[i].LeafWeight = &weight

return

}

}

weightDevice := new(rspec.LinuxWeightDevice)

weightDevice.Major = major

weightDevice.Minor = minor

weightDevice.LeafWeight = &weight

g.Config.Linux.Resources.BlockIO.WeightDevice = append(g.Config.Linux.Resources.BlockIO.WeightDevice, *weightDevice)

}

// DropLinuxResourcesBlockIOLeafWeightDevice drops a item form g.Config.Linux.Resources.BlockIO.WeightDevice.LeafWeight

func (g *Generator) DropLinuxResourcesBlockIOLeafWeightDevice(major int64, minor int64) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.BlockIO == nil {

return

}

for i, weightDevice := range g.Config.Linux.Resources.BlockIO.WeightDevice {

if weightDevice.Major == major && weightDevice.Minor == minor {

if weightDevice.Weight != nil {

newWeightDevice := new(rspec.LinuxWeightDevice)

newWeightDevice.Major = major

newWeightDevice.Minor = minor

newWeightDevice.Weight = weightDevice.Weight

g.Config.Linux.Resources.BlockIO.WeightDevice[i] = *newWeightDevice

} else {

g.Config.Linux.Resources.BlockIO.WeightDevice = append(g.Config.Linux.Resources.BlockIO.WeightDevice[:i], g.Config.Linux.Resources.BlockIO.WeightDevice[i+1:]...)

}

return

}

}

}

// SetLinuxResourcesBlockIOWeight sets g.Config.Linux.Resources.BlockIO.Weight.

func (g *Generator) SetLinuxResourcesBlockIOWeight(weight uint16) {

g.initConfigLinuxResourcesBlockIO()

g.Config.Linux.Resources.BlockIO.Weight = &weight

}

// AddLinuxResourcesBlockIOWeightDevice adds or sets g.Config.Linux.Resources.BlockIO.WeightDevice.Weight.

func (g *Generator) AddLinuxResourcesBlockIOWeightDevice(major int64, minor int64, weight uint16) {

g.initConfigLinuxResourcesBlockIO()

for i, weightDevice := range g.Config.Linux.Resources.BlockIO.WeightDevice {

if weightDevice.Major == major && weightDevice.Minor == minor {

g.Config.Linux.Resources.BlockIO.WeightDevice[i].Weight = &weight

return

}

}

weightDevice := new(rspec.LinuxWeightDevice)

weightDevice.Major = major

weightDevice.Minor = minor

weightDevice.Weight = &weight

g.Config.Linux.Resources.BlockIO.WeightDevice = append(g.Config.Linux.Resources.BlockIO.WeightDevice, *weightDevice)

}

// DropLinuxResourcesBlockIOWeightDevice drops a item form g.Config.Linux.Resources.BlockIO.WeightDevice.Weight

func (g *Generator) DropLinuxResourcesBlockIOWeightDevice(major int64, minor int64) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.BlockIO == nil {

return

}

for i, weightDevice := range g.Config.Linux.Resources.BlockIO.WeightDevice {

if weightDevice.Major == major && weightDevice.Minor == minor {

if weightDevice.LeafWeight != nil {

newWeightDevice := new(rspec.LinuxWeightDevice)

newWeightDevice.Major = major

newWeightDevice.Minor = minor

newWeightDevice.LeafWeight = weightDevice.LeafWeight

g.Config.Linux.Resources.BlockIO.WeightDevice[i] = *newWeightDevice

} else {

g.Config.Linux.Resources.BlockIO.WeightDevice = append(g.Config.Linux.Resources.BlockIO.WeightDevice[:i], g.Config.Linux.Resources.BlockIO.WeightDevice[i+1:]...)

}

return

}

}

}

// AddLinuxResourcesBlockIOThrottleReadBpsDevice adds or sets g.Config.Linux.Resources.BlockIO.ThrottleReadBpsDevice.

func (g *Generator) AddLinuxResourcesBlockIOThrottleReadBpsDevice(major int64, minor int64, rate uint64) {

g.initConfigLinuxResourcesBlockIO()

throttleDevices := addOrReplaceBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleReadBpsDevice, major, minor, rate)

g.Config.Linux.Resources.BlockIO.ThrottleReadBpsDevice = throttleDevices

}

// DropLinuxResourcesBlockIOThrottleReadBpsDevice drops a item from g.Config.Linux.Resources.BlockIO.ThrottleReadBpsDevice.

func (g *Generator) DropLinuxResourcesBlockIOThrottleReadBpsDevice(major int64, minor int64) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.BlockIO == nil {

return

}

throttleDevices := dropBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleReadBpsDevice, major, minor)

g.Config.Linux.Resources.BlockIO.ThrottleReadBpsDevice = throttleDevices

}

// AddLinuxResourcesBlockIOThrottleReadIOPSDevice adds or sets g.Config.Linux.Resources.BlockIO.ThrottleReadIOPSDevice.

func (g *Generator) AddLinuxResourcesBlockIOThrottleReadIOPSDevice(major int64, minor int64, rate uint64) {

g.initConfigLinuxResourcesBlockIO()

throttleDevices := addOrReplaceBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleReadIOPSDevice, major, minor, rate)

g.Config.Linux.Resources.BlockIO.ThrottleReadIOPSDevice = throttleDevices

}

// DropLinuxResourcesBlockIOThrottleReadIOPSDevice drops a item from g.Config.Linux.Resources.BlockIO.ThrottleReadIOPSDevice.

func (g *Generator) DropLinuxResourcesBlockIOThrottleReadIOPSDevice(major int64, minor int64) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.BlockIO == nil {

return

}

throttleDevices := dropBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleReadIOPSDevice, major, minor)

g.Config.Linux.Resources.BlockIO.ThrottleReadIOPSDevice = throttleDevices

}

// AddLinuxResourcesBlockIOThrottleWriteBpsDevice adds or sets g.Config.Linux.Resources.BlockIO.ThrottleWriteBpsDevice.

func (g *Generator) AddLinuxResourcesBlockIOThrottleWriteBpsDevice(major int64, minor int64, rate uint64) {

g.initConfigLinuxResourcesBlockIO()

throttleDevices := addOrReplaceBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleWriteBpsDevice, major, minor, rate)

g.Config.Linux.Resources.BlockIO.ThrottleWriteBpsDevice = throttleDevices

}

// DropLinuxResourcesBlockIOThrottleWriteBpsDevice drops a item from g.Config.Linux.Resources.BlockIO.ThrottleWriteBpsDevice.

func (g *Generator) DropLinuxResourcesBlockIOThrottleWriteBpsDevice(major int64, minor int64) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.BlockIO == nil {

return

}

throttleDevices := dropBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleWriteBpsDevice, major, minor)

g.Config.Linux.Resources.BlockIO.ThrottleWriteBpsDevice = throttleDevices

}

// AddLinuxResourcesBlockIOThrottleWriteIOPSDevice adds or sets g.Config.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice.

func (g *Generator) AddLinuxResourcesBlockIOThrottleWriteIOPSDevice(major int64, minor int64, rate uint64) {

g.initConfigLinuxResourcesBlockIO()

throttleDevices := addOrReplaceBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice, major, minor, rate)

g.Config.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice = throttleDevices

}

// DropLinuxResourcesBlockIOThrottleWriteIOPSDevice drops a item from g.Config.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice.

func (g *Generator) DropLinuxResourcesBlockIOThrottleWriteIOPSDevice(major int64, minor int64) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.BlockIO == nil {

return

}

throttleDevices := dropBlockIOThrottleDevice(g.Config.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice, major, minor)

g.Config.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice = throttleDevices

}

// SetLinuxResourcesCPUShares sets g.Config.Linux.Resources.CPU.Shares.

func (g *Generator) SetLinuxResourcesCPUShares(shares uint64) {

g.InitConfigLinuxResourcesCPU()

g.Config.Linux.Resources.CPU.Shares = &shares

}

// SetLinuxResourcesCPUQuota sets g.Config.Linux.Resources.CPU.Quota.

func (g *Generator) SetLinuxResourcesCPUQuota(quota int64) {

g.InitConfigLinuxResourcesCPU()

g.Config.Linux.Resources.CPU.Quota = &quota

}

// SetLinuxResourcesCPUPeriod sets g.Config.Linux.Resources.CPU.Period.

func (g *Generator) SetLinuxResourcesCPUPeriod(period uint64) {

g.InitConfigLinuxResourcesCPU()

g.Config.Linux.Resources.CPU.Period = &period

}

// SetLinuxResourcesCPURealtimeRuntime sets g.Config.Linux.Resources.CPU.RealtimeRuntime.

func (g *Generator) SetLinuxResourcesCPURealtimeRuntime(time int64) {

g.InitConfigLinuxResourcesCPU()

g.Config.Linux.Resources.CPU.RealtimeRuntime = &time

}

// SetLinuxResourcesCPURealtimePeriod sets g.Config.Linux.Resources.CPU.RealtimePeriod.

func (g *Generator) SetLinuxResourcesCPURealtimePeriod(period uint64) {

g.InitConfigLinuxResourcesCPU()

g.Config.Linux.Resources.CPU.RealtimePeriod = &period

}

// SetLinuxResourcesCPUCpus sets g.Config.Linux.Resources.CPU.Cpus.

func (g *Generator) SetLinuxResourcesCPUCpus(cpus string) {

g.InitConfigLinuxResourcesCPU()

g.Config.Linux.Resources.CPU.Cpus = cpus

}

// SetLinuxResourcesCPUMems sets g.Config.Linux.Resources.CPU.Mems.

func (g *Generator) SetLinuxResourcesCPUMems(mems string) {

g.InitConfigLinuxResourcesCPU()

g.Config.Linux.Resources.CPU.Mems = mems

}

// AddLinuxResourcesHugepageLimit adds or sets g.Config.Linux.Resources.HugepageLimits.

func (g *Generator) AddLinuxResourcesHugepageLimit(pageSize string, limit uint64) {

hugepageLimit := rspec.LinuxHugepageLimit{

Pagesize: pageSize,

Limit: limit,

}

g.initConfigLinuxResources()

for i, pageLimit := range g.Config.Linux.Resources.HugepageLimits {

if pageLimit.Pagesize == pageSize {

g.Config.Linux.Resources.HugepageLimits[i].Limit = limit

return

}

}

g.Config.Linux.Resources.HugepageLimits = append(g.Config.Linux.Resources.HugepageLimits, hugepageLimit)

}

// DropLinuxResourcesHugepageLimit drops a hugepage limit from g.Config.Linux.Resources.HugepageLimits.

func (g *Generator) DropLinuxResourcesHugepageLimit(pageSize string) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil {

return

}

for i, pageLimit := range g.Config.Linux.Resources.HugepageLimits {

if pageLimit.Pagesize == pageSize {

g.Config.Linux.Resources.HugepageLimits = append(g.Config.Linux.Resources.HugepageLimits[:i], g.Config.Linux.Resources.HugepageLimits[i+1:]...)

return

}

}

}

// SetLinuxResourcesUnified sets the g.Config.Linux.Resources.Unified.

func (g *Generator) SetLinuxResourcesUnified(unified map[string]string) {

g.initConfigLinuxResourcesUnified()

for k, v := range unified {

g.Config.Linux.Resources.Unified[k] = v

}

}

// AddLinuxResourcesUnified adds or updates the key-value pair from g.Config.Linux.Resources.Unified

func (g *Generator) AddLinuxResourcesUnified(key, val string) {

g.initConfigLinuxResourcesUnified()

g.Config.Linux.Resources.Unified[key] = val

}

// DropLinuxResourcesUnified drops a key-value pair from g.Config.Linux.Resources.Unified

func (g *Generator) DropLinuxResourcesUnified(key string) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.Unified == nil {

return

}

delete(g.Config.Linux.Resources.Unified, key)

}

// SetLinuxResourcesMemoryLimit sets g.Config.Linux.Resources.Memory.Limit.

func (g *Generator) SetLinuxResourcesMemoryLimit(limit int64) {

g.initConfigLinuxResourcesMemory()

g.Config.Linux.Resources.Memory.Limit = &limit

}

// SetLinuxResourcesMemoryReservation sets g.Config.Linux.Resources.Memory.Reservation.

func (g *Generator) SetLinuxResourcesMemoryReservation(reservation int64) {

g.initConfigLinuxResourcesMemory()

g.Config.Linux.Resources.Memory.Reservation = &reservation

}

// SetLinuxResourcesMemorySwap sets g.Config.Linux.Resources.Memory.Swap.

func (g *Generator) SetLinuxResourcesMemorySwap(swap int64) {

g.initConfigLinuxResourcesMemory()

g.Config.Linux.Resources.Memory.Swap = &swap

}

// SetLinuxResourcesMemoryKernel sets g.Config.Linux.Resources.Memory.Kernel.

func (g *Generator) SetLinuxResourcesMemoryKernel(kernel int64) {

g.initConfigLinuxResourcesMemory()

g.Config.Linux.Resources.Memory.Kernel = &kernel //nolint:staticcheck // Ignore SA1019: g.Config.Linux.Resources.Memory.Kernel is deprecated

}

// SetLinuxResourcesMemoryKernelTCP sets g.Config.Linux.Resources.Memory.KernelTCP.

func (g *Generator) SetLinuxResourcesMemoryKernelTCP(kernelTCP int64) {

g.initConfigLinuxResourcesMemory()

g.Config.Linux.Resources.Memory.KernelTCP = &kernelTCP

}

// SetLinuxResourcesMemorySwappiness sets g.Config.Linux.Resources.Memory.Swappiness.

func (g *Generator) SetLinuxResourcesMemorySwappiness(swappiness uint64) {

g.initConfigLinuxResourcesMemory()

g.Config.Linux.Resources.Memory.Swappiness = &swappiness

}

// SetLinuxResourcesMemoryDisableOOMKiller sets g.Config.Linux.Resources.Memory.DisableOOMKiller.

func (g *Generator) SetLinuxResourcesMemoryDisableOOMKiller(disable bool) {

g.initConfigLinuxResourcesMemory()

g.Config.Linux.Resources.Memory.DisableOOMKiller = &disable

}

// SetLinuxResourcesNetworkClassID sets g.Config.Linux.Resources.Network.ClassID.

func (g *Generator) SetLinuxResourcesNetworkClassID(classid uint32) {

g.initConfigLinuxResourcesNetwork()

g.Config.Linux.Resources.Network.ClassID = &classid

}

// AddLinuxResourcesNetworkPriorities adds or sets g.Config.Linux.Resources.Network.Priorities.

func (g *Generator) AddLinuxResourcesNetworkPriorities(name string, prio uint32) {

g.initConfigLinuxResourcesNetwork()

for i, netPriority := range g.Config.Linux.Resources.Network.Priorities {

if netPriority.Name == name {

g.Config.Linux.Resources.Network.Priorities[i].Priority = prio

return

}

}

interfacePrio := new(rspec.LinuxInterfacePriority)

interfacePrio.Name = name

interfacePrio.Priority = prio

g.Config.Linux.Resources.Network.Priorities = append(g.Config.Linux.Resources.Network.Priorities, *interfacePrio)

}

// DropLinuxResourcesNetworkPriorities drops one item from g.Config.Linux.Resources.Network.Priorities.

func (g *Generator) DropLinuxResourcesNetworkPriorities(name string) {

if g.Config == nil || g.Config.Linux == nil || g.Config.Linux.Resources == nil || g.Config.Linux.Resources.Network == nil {

return

}

for i, netPriority := range g.Config.Linux.Resources.Network.Priorities {

if netPriority.Name == name {

g.Config.Linux.Resources.Network.Priorities = append(g.Config.Linux.Resources.Network.Priorities[:i], g.Config.Linux.Resources.Network.Priorities[i+1:]...)

return

}

}

}

// SetLinuxResourcesPidsLimit sets g.Config.Linux.Resources.Pids.Limit.

func (g *Generator) SetLinuxResourcesPidsLimit(limit int64) {

g.initConfigLinuxResourcesPids()

g.Config.Linux.Resources.Pids.Limit = &limit

}

// ClearLinuxSysctl clears g.Config.Linux.Sysctl.

func (g *Generator) ClearLinuxSysctl() {

if g.Config == nil || g.Config.Linux == nil {

return

}

g.Config.Linux.Sysctl = make(map[string]string)

}

// AddLinuxSysctl adds a new sysctl config into g.Config.Linux.Sysctl.

func (g *Generator) AddLinuxSysctl(key, value string) {

g.initConfigLinuxSysctl()

g.Config.Linux.Sysctl[key] = value

}