@lakutata/containerd 0.0.0-stage → 3.0.0-beta.0

package/dist/cjs/client/Rootfs.d.ts

@@ -0,0 +1,83 @@
+import type { Stats } from 'node:fs';
+import type { SnapshotMount } from './ContainerdClient.js';
+/**
+ * The user of a process: its identifiers and its groups
+ */
+export type ProcessUser = {
+    uid: number;
+    gid: number;
+    additionalGids: number[];
+    home: string;
+};
+/**
+ * The directories of the layers of the mounts of a snapshot, the top one first (overlay: its upper directory and its
+ * lower ones, bind: its source)
+ * @param mounts
+ */
+export declare function layerDirectories(mounts: SnapshotMount[]): string[];
+/**
+ * Read a file of the root file system of a snapshot from the directories of its layers (the snapshotter of the host,
+ * readable by root): the top layer having it first, its deletions (the whiteouts of overlay) honoured, its symbolic
+ * links resolved in the root file system
+ * @param mounts
+ * @param file an absolute path in the root file system
+ * @param depth
+ */
+export declare function readRootfsFile(mounts: SnapshotMount[], file: string, depth?: number): Promise<Buffer | undefined>;
+/**
+ * Resolve the user of a process in a root file system (its /etc/passwd and /etc/group): user, user:group, uid, uid:gid
+ * @param mounts
+ * @param user empty for root
+ */
+export declare function resolveUser(mounts: SnapshotMount[], user: string | undefined): Promise<ProcessUser>;
+/**
+ * A file system read from the host: a directory (the root of a process), or the directories of the layers of a snapshot
+ */
+export interface FileTree {
+    /**
+     * A path whose symbolic links are resolved in the file system (not in the one of the host)
+     * @param file an absolute path in the file system
+     */
+    resolve(file: string): Promise<string>;
+    /**
+     * The stats of a path (its link not followed) and the path of the host to read it, undefined when it does not exist
+     * @param file
+     */
+    lstat(file: string): Promise<{
+        stats: Stats;
+        path: string;
+    } | undefined>;
+    /**
+     * The names of the entries of a directory, sorted
+     * @param directory
+     */
+    readdir(directory: string): Promise<string[]>;
+}
+/**
+ * A file system of a directory of the host (/proc/<pid>/root: the one of a running container, its mounts with it)
+ */
+export declare class DirectoryTree implements FileTree {
+    protected readonly root: string;
+    constructor(root: string);
+    resolve(file: string): Promise<string>;
+    lstat(file: string): Promise<{
+        stats: Stats;
+        path: string;
+    } | undefined>;
+    readdir(directory: string): Promise<string[]>;
+}
+/**
+ * A file system of the layers of a snapshot (the directories of overlay, the top one first): the deletions of the upper
+ * layers (their whiteouts) hide the entries of the lower ones
+ */
+export declare class LayersTree implements FileTree {
+    protected readonly layers: string[];
+    constructor(layers: string[]);
+    resolve(file: string): Promise<string>;
+    protected stat(file: string): Promise<Stats | undefined>;
+    lstat(file: string): Promise<{
+        stats: Stats;
+        path: string;
+    } | undefined>;
+    readdir(directory: string): Promise<string[]>;
+}

package/dist/cjs/client/Rootfs.js

@@ -0,0 +1,245 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LayersTree = exports.DirectoryTree = void 0;
+exports.layerDirectories = layerDirectories;
+exports.readRootfsFile = readRootfsFile;
+exports.resolveUser = resolveUser;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * The directories of the layers of the mounts of a snapshot, the top one first (overlay: its upper directory and its
+ * lower ones, bind: its source)
+ * @param mounts
+ */
+function layerDirectories(mounts) {
+    const directories = [];
+    for (const mount of mounts) {
+        if (mount.type === 'bind' || mount.type === 'rbind') {
+            directories.push(mount.source);
+            continue;
+        }
+        if (mount.type !== 'overlay')
+            continue;
+        for (const option of mount.options) {
+            if (option.startsWith('upperdir='))
+                directories.unshift(option.slice(9));
+            if (option.startsWith('lowerdir='))
+                directories.push(...option.slice(9).split(':'));
+        }
+    }
+    return directories;
+}
+/**
+ * Read a file of the root file system of a snapshot from the directories of its layers (the snapshotter of the host,
+ * readable by root): the top layer having it first, its deletions (the whiteouts of overlay) honoured, its symbolic
+ * links resolved in the root file system
+ * @param mounts
+ * @param file an absolute path in the root file system
+ * @param depth
+ */
+async function readRootfsFile(mounts, file, depth = 0) {
+    if (depth > 8)
+        return undefined;
+    const relative = node_path_1.default.posix.normalize(file).replace(/^\/+/, '');
+    for (const directory of layerDirectories(mounts)) {
+        const target = node_path_1.default.join(directory, relative);
+        let stats;
+        try {
+            stats = await (0, promises_1.lstat)(target);
+        }
+        catch {
+            continue;
+        }
+        //Deleted by this layer
+        if (stats.isCharacterDevice() && stats.rdev === 0)
+            return undefined;
+        if (stats.isSymbolicLink()) {
+            const link = await (0, promises_1.readlink)(target);
+            return await readRootfsFile(mounts, link.startsWith('/') ? link : node_path_1.default.posix.join(node_path_1.default.posix.dirname('/' + relative), link), depth + 1);
+        }
+        if (!stats.isFile())
+            return undefined;
+        return await (0, promises_1.readFile)(target);
+    }
+    return undefined;
+}
+/**
+ * The entries of a file of the database of the users or of the groups (name:x:id:…)
+ * @param content
+ */
+function readEntries(content) {
+    if (!content)
+        return [];
+    return content.toString('utf8').split('\n').filter((line) => !!line.trim() && !line.startsWith('#')).map((line) => line.split(':'));
+}
+/**
+ * Resolve the user of a process in a root file system (its /etc/passwd and /etc/group): user, user:group, uid, uid:gid
+ * @param mounts
+ * @param user empty for root
+ */
+async function resolveUser(mounts, user) {
+    const [userPart, groupPart] = (user ?? '').split(':');
+    const passwd = readEntries(await readRootfsFile(mounts, '/etc/passwd'));
+    let uid = 0;
+    let gid = 0;
+    let home = '/';
+    let name = 'root';
+    if (userPart) {
+        const entry = passwd.find((fields) => fields[0] === userPart) ?? (/^\d+$/.test(userPart) ? passwd.find((fields) => fields[2] === userPart) : undefined);
+        if (entry) {
+            uid = Number(entry[2]);
+            gid = Number(entry[3]);
+            home = entry[5] || '/';
+            name = entry[0];
+        }
+        else if (/^\d+$/.test(userPart)) {
+            uid = Number(userPart);
+            gid = Number(userPart);
+            name = undefined;
+        }
+        else {
+            throw new Error(`The user "${userPart}" is not in the /etc/passwd of the image`);
+        }
+    }
+    else {
+        const root = passwd.find((fields) => fields[2] === '0');
+        if (root)
+            home = root[5] || '/';
+    }
+    const groups = readEntries(await readRootfsFile(mounts, '/etc/group'));
+    if (groupPart) {
+        const entry = groups.find((fields) => fields[0] === groupPart);
+        if (entry)
+            gid = Number(entry[2]);
+        else if (/^\d+$/.test(groupPart))
+            gid = Number(groupPart);
+        else
+            throw new Error(`The group "${groupPart}" is not in the /etc/group of the image`);
+    }
+    //The groups the user is a member of (supplementary)
+    const additionalGids = name ? groups
+        .filter((fields) => (fields[3] ?? '').split(',').includes(name) && Number(fields[2]) !== gid)
+        .map((fields) => Number(fields[2])) : [];
+    return { uid: uid, gid: gid, additionalGids: [...new Set(additionalGids)], home: home };
+}
+/**
+ * The resolution of the symbolic links of a path in a file tree
+ * @param tree
+ * @param file
+ */
+async function resolveInTree(tree, file) {
+    const pending = node_path_1.default.posix.normalize(`/${file}`).split('/').filter(Boolean);
+    let current = '/';
+    let links = 0;
+    while (pending.length) {
+        const part = pending.shift();
+        if (part === '..') {
+            current = node_path_1.default.posix.dirname(current);
+            continue;
+        }
+        const candidate = node_path_1.default.posix.join(current, part);
+        const found = await tree.lstat(candidate);
+        if (found?.stats.isSymbolicLink()) {
+            if (++links > 40)
+                throw new Error(`The path ${file} has too many symbolic links`);
+            const target = await (0, promises_1.readlink)(found.path);
+            if (target.startsWith('/'))
+                current = '/';
+            pending.unshift(...target.split('/').filter(Boolean));
+            continue;
+        }
+        current = candidate;
+    }
+    return current;
+}
+/**
+ * A file system of a directory of the host (/proc/<pid>/root: the one of a running container, its mounts with it)
+ */
+class DirectoryTree {
+    constructor(root) {
+        this.root = root;
+    }
+    resolve(file) {
+        return resolveInTree(this, file);
+    }
+    async lstat(file) {
+        const real = node_path_1.default.join(this.root, node_path_1.default.posix.normalize(`/${file}`));
+        try {
+            return { stats: await (0, promises_1.lstat)(real), path: real };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async readdir(directory) {
+        return (await (0, promises_1.readdir)(node_path_1.default.join(this.root, node_path_1.default.posix.normalize(`/${directory}`)))).sort();
+    }
+}
+exports.DirectoryTree = DirectoryTree;
+/**
+ * Whether stats are the ones of a whiteout of overlay (a deletion of a layer)
+ * @param stats
+ */
+function isWhiteout(stats) {
+    return stats.isCharacterDevice() && stats.rdev === 0;
+}
+/**
+ * A file system of the layers of a snapshot (the directories of overlay, the top one first): the deletions of the upper
+ * layers (their whiteouts) hide the entries of the lower ones
+ */
+class LayersTree {
+    constructor(layers) {
+        this.layers = layers;
+    }
+    resolve(file) {
+        return resolveInTree(this, file);
+    }
+    async stat(file) {
+        try {
+            return await (0, promises_1.lstat)(file);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async lstat(file) {
+        const parts = node_path_1.default.posix.normalize(`/${file}`).split('/').filter(Boolean);
+        for (const layer of this.layers) {
+            //An ancestor deleted (or replaced by a file) by this layer hides the path in the lower layers
+            for (let length = 1; length < parts.length; length++) {
+                const ancestor = await this.stat(node_path_1.default.join(layer, ...parts.slice(0, length)));
+                if (ancestor && (isWhiteout(ancestor) || !ancestor.isDirectory()))
+                    return undefined;
+            }
+            const real = node_path_1.default.join(layer, ...parts);
+            const stats = await this.stat(real);
+            if (!stats)
+                continue;
+            return isWhiteout(stats) ? undefined : { stats: stats, path: real };
+        }
+        return undefined;
+    }
+    async readdir(directory) {
+        const parts = node_path_1.default.posix.normalize(`/${directory}`).split('/').filter(Boolean);
+        const names = new Map();
+        for (const layer of this.layers) {
+            const stats = await this.stat(node_path_1.default.join(layer, ...parts));
+            if (!stats)
+                continue;
+            //Deleted or replaced by this layer: the lower layers are hidden
+            if (!stats.isDirectory())
+                break;
+            for (const name of await (0, promises_1.readdir)(node_path_1.default.join(layer, ...parts))) {
+                if (names.has(name))
+                    continue;
+                const entry = await this.stat(node_path_1.default.join(layer, ...parts, name));
+                names.set(name, !!entry && !isWhiteout(entry));
+            }
+        }
+        return [...names].filter(([, present]) => present).map(([name]) => name).sort();
+    }
+}
+exports.LayersTree = LayersTree;

package/dist/cjs/client/Seccomp.d.ts

@@ -0,0 +1,36 @@
+/**
+ * A rule of a profile of seccomp (OCI)
+ */
+export type SeccompSyscall = {
+    names: string[];
+    action: string;
+    errnoRet?: number;
+    args?: {
+        index: number;
+        value: number;
+        valueTwo?: number;
+        op: string;
+    }[];
+};
+/**
+ * A profile of seccomp (the linux.seccomp of the specification of OCI)
+ */
+export type SeccompProfile = {
+    defaultAction: string;
+    defaultErrnoRet?: number;
+    architectures?: string[];
+    flags?: string[];
+    syscalls?: SeccompSyscall[];
+};
+/**
+ * Whether the kernel filters the system calls (the Seccomp field of the status of the processes)
+ * @param status the status of a process
+ */
+export declare function seccompSupported(status?: string): boolean;
+/**
+ * The default profile of seccomp of a container, by its capabilities (its bounding set)
+ * @param capabilities
+ * @param arch the architecture of the machine, as Node.js names it
+ * @param kernel the release of its kernel
+ */
+export declare function defaultSeccompProfile(capabilities: string[], arch?: string, kernel?: string): SeccompProfile;

package/dist/cjs/client/Seccomp.js

@@ -0,0 +1,156 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seccompSupported = seccompSupported;
+exports.defaultSeccompProfile = defaultSeccompProfile;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const ALLOWED = [
+    'accept', 'accept4', 'access', 'adjtimex', 'alarm', 'bind', 'brk', 'cachestat', 'capget', 'capset', 'chdir', 'chmod',
+    'chown', 'chown32', 'clock_adjtime', 'clock_adjtime64', 'clock_getres', 'clock_getres_time64', 'clock_gettime',
+    'clock_gettime64', 'clock_nanosleep', 'clock_nanosleep_time64', 'close', 'close_range', 'connect', 'copy_file_range',
+    'creat', 'dup', 'dup2', 'dup3', 'epoll_create', 'epoll_create1', 'epoll_ctl', 'epoll_ctl_old', 'epoll_pwait',
+    'epoll_pwait2', 'epoll_wait', 'epoll_wait_old', 'eventfd', 'eventfd2', 'execve', 'execveat', 'exit', 'exit_group',
+    'faccessat', 'faccessat2', 'fadvise64', 'fadvise64_64', 'fallocate', 'fanotify_mark', 'fchdir', 'fchmod', 'fchmodat',
+    'fchmodat2', 'fchown', 'fchown32', 'fchownat', 'fcntl', 'fcntl64', 'fdatasync', 'fgetxattr', 'flistxattr', 'flock',
+    'fork', 'fremovexattr', 'fsetxattr', 'fstat', 'fstat64', 'fstatat64', 'fstatfs', 'fstatfs64', 'fsync', 'ftruncate',
+    'ftruncate64', 'futex', 'futex_requeue', 'futex_time64', 'futex_wait', 'futex_waitv', 'futex_wake', 'futimesat',
+    'getcpu', 'getcwd', 'getdents', 'getdents64', 'getegid', 'getegid32', 'geteuid', 'geteuid32', 'getgid', 'getgid32',
+    'getgroups', 'getgroups32', 'getitimer', 'getpeername', 'getpgid', 'getpgrp', 'getpid', 'getppid', 'getpriority',
+    'getrandom', 'getresgid', 'getresgid32', 'getresuid', 'getresuid32', 'getrlimit', 'get_robust_list', 'getrusage',
+    'getsid', 'getsockname', 'getsockopt', 'get_thread_area', 'gettid', 'gettimeofday', 'getuid', 'getuid32', 'getxattr',
+    'inotify_add_watch', 'inotify_init', 'inotify_init1', 'inotify_rm_watch', 'io_cancel', 'ioctl', 'io_destroy',
+    'io_getevents', 'io_pgetevents', 'io_pgetevents_time64', 'ioprio_get', 'ioprio_set', 'io_setup', 'io_submit',
+    'io_uring_enter', 'io_uring_register', 'io_uring_setup', 'ipc', 'kill', 'landlock_add_rule', 'landlock_create_ruleset',
+    'landlock_restrict_self', 'lchown', 'lchown32', 'lgetxattr', 'link', 'linkat', 'listen', 'listxattr', 'llistxattr',
+    '_llseek', 'lremovexattr', 'lseek', 'lsetxattr', 'lstat', 'lstat64', 'madvise', 'membarrier', 'memfd_create',
+    'memfd_secret', 'mincore', 'mkdir', 'mkdirat', 'mknod', 'mknodat', 'mlock', 'mlock2', 'mlockall', 'map_shadow_stack',
+    'mmap', 'mmap2', 'mprotect', 'mq_getsetattr', 'mq_notify', 'mq_open', 'mq_timedreceive', 'mq_timedreceive_time64',
+    'mq_timedsend', 'mq_timedsend_time64', 'mq_unlink', 'mremap', 'msgctl', 'msgget', 'msgrcv', 'msgsnd', 'msync',
+    'munlock', 'munlockall', 'munmap', 'name_to_handle_at', 'nanosleep', 'newfstatat', '_newselect', 'open', 'openat',
+    'openat2', 'pause', 'pidfd_open', 'pidfd_send_signal', 'pipe', 'pipe2', 'pkey_alloc', 'pkey_free', 'pkey_mprotect',
+    'poll', 'ppoll', 'ppoll_time64', 'prctl', 'pread64', 'preadv', 'preadv2', 'prlimit64', 'process_mrelease', 'pselect6',
+    'pselect6_time64', 'pwrite64', 'pwritev', 'pwritev2', 'read', 'readahead', 'readlink', 'readlinkat', 'readv', 'recv',
+    'recvfrom', 'recvmmsg', 'recvmmsg_time64', 'recvmsg', 'remap_file_pages', 'removexattr', 'rename', 'renameat',
+    'renameat2', 'restart_syscall', 'rmdir', 'rseq', 'rt_sigaction', 'rt_sigpending', 'rt_sigprocmask', 'rt_sigqueueinfo',
+    'rt_sigreturn', 'rt_sigsuspend', 'rt_sigtimedwait', 'rt_sigtimedwait_time64', 'rt_tgsigqueueinfo', 'sched_getaffinity',
+    'sched_getattr', 'sched_getparam', 'sched_get_priority_max', 'sched_get_priority_min', 'sched_getscheduler',
+    'sched_rr_get_interval', 'sched_rr_get_interval_time64', 'sched_setaffinity', 'sched_setattr', 'sched_setparam',
+    'sched_setscheduler', 'sched_yield', 'seccomp', 'select', 'semctl', 'semget', 'semop', 'semtimedop',
+    'semtimedop_time64', 'send', 'sendfile', 'sendfile64', 'sendmmsg', 'sendmsg', 'sendto', 'setfsgid', 'setfsgid32',
+    'setfsuid', 'setfsuid32', 'setgid', 'setgid32', 'setgroups', 'setgroups32', 'setitimer', 'setpgid', 'setpriority',
+    'setregid', 'setregid32', 'setresgid', 'setresgid32', 'setresuid', 'setresuid32', 'setreuid', 'setreuid32',
+    'setrlimit', 'set_robust_list', 'setsid', 'setsockopt', 'set_thread_area', 'set_tid_address', 'setuid', 'setuid32',
+    'setxattr', 'shmat', 'shmctl', 'shmdt', 'shmget', 'shutdown', 'sigaltstack', 'signalfd', 'signalfd4', 'sigprocmask',
+    'sigreturn', 'socketcall', 'socketpair', 'splice', 'stat', 'stat64', 'statfs', 'statfs64', 'statx', 'symlink',
+    'symlinkat', 'sync', 'sync_file_range', 'syncfs', 'sysinfo', 'tee', 'tgkill', 'time', 'timer_create', 'timer_delete',
+    'timer_getoverrun', 'timer_gettime', 'timer_gettime64', 'timer_settime', 'timer_settime64', 'timerfd_create',
+    'timerfd_gettime', 'timerfd_gettime64', 'timerfd_settime', 'timerfd_settime64', 'times', 'tkill', 'truncate',
+    'truncate64', 'ugetrlimit', 'umask', 'uname', 'unlink', 'unlinkat', 'utime', 'utimensat', 'utimensat_time64', 'utimes',
+    'vfork', 'vmsplice', 'wait4', 'waitid', 'waitpid', 'write', 'writev'
+];
+/**
+ * The architectures of the system calls filtered, by the architecture of the machine (the emulated containers run its
+ * system calls: their emulators are processes of the machine)
+ */
+const ARCHITECTURES = {
+    x64: ['SCMP_ARCH_X86_64', 'SCMP_ARCH_X86', 'SCMP_ARCH_X32'],
+    arm64: ['SCMP_ARCH_ARM', 'SCMP_ARCH_AARCH64'],
+    mips64: ['SCMP_ARCH_MIPS', 'SCMP_ARCH_MIPS64', 'SCMP_ARCH_MIPS64N32'],
+    mips64el: ['SCMP_ARCH_MIPSEL', 'SCMP_ARCH_MIPSEL64', 'SCMP_ARCH_MIPSEL64N32'],
+    s390x: ['SCMP_ARCH_S390', 'SCMP_ARCH_S390X'],
+    riscv64: ['SCMP_ARCH_RISCV64']
+};
+/**
+ * The system calls of the architectures of the machine
+ */
+const ARCHITECTURE_SYSCALLS = {
+    ppc64: ['sync_file_range2', 'swapcontext'],
+    arm: ['arm_fadvise64_64', 'arm_sync_file_range', 'sync_file_range2', 'breakpoint', 'cacheflush', 'set_tls'],
+    arm64: ['arm_fadvise64_64', 'arm_sync_file_range', 'sync_file_range2', 'breakpoint', 'cacheflush', 'set_tls'],
+    x64: ['arch_prctl', 'modify_ldt'],
+    ia32: ['modify_ldt'],
+    s390x: ['s390_pci_mmio_read', 's390_pci_mmio_write', 's390_runtime_instr'],
+    riscv64: ['riscv_flush_icache']
+};
+/**
+ * The system calls allowed with the capabilities
+ */
+const CAPABILITY_SYSCALLS = {
+    CAP_DAC_READ_SEARCH: ['open_by_handle_at'],
+    CAP_SYS_ADMIN: [
+        'bpf', 'clone', 'clone3', 'fanotify_init', 'fsconfig', 'fsmount', 'fsopen', 'fspick', 'lookup_dcookie', 'mount',
+        'mount_setattr', 'move_mount', 'open_tree', 'perf_event_open', 'quotactl', 'quotactl_fd', 'setdomainname',
+        'sethostname', 'setns', 'syslog', 'umount', 'umount2', 'unshare'
+    ],
+    CAP_SYS_BOOT: ['reboot'],
+    CAP_SYS_CHROOT: ['chroot'],
+    CAP_SYS_MODULE: ['delete_module', 'init_module', 'finit_module'],
+    CAP_SYS_PACCT: ['acct'],
+    CAP_SYS_PTRACE: ['kcmp', 'pidfd_getfd', 'process_madvise', 'process_vm_readv', 'process_vm_writev', 'ptrace'],
+    CAP_SYS_RAWIO: ['iopl', 'ioperm'],
+    CAP_SYS_TIME: ['settimeofday', 'stime', 'clock_settime', 'clock_settime64'],
+    CAP_SYS_TTY_CONFIG: ['vhangup'],
+    CAP_SYS_NICE: ['get_mempolicy', 'mbind', 'set_mempolicy', 'set_mempolicy_home_node'],
+    CAP_SYSLOG: ['syslog'],
+    CAP_BPF: ['bpf'],
+    CAP_PERFMON: ['perf_event_open']
+};
+const AF_VSOCK = 40;
+const ENOSYS = 38;
+/**
+ * The flags of clone creating namespaces (NEWNS, NEWUTS, NEWIPC, NEWUSER, NEWPID, NEWNET, NEWCGROUP)
+ */
+const CLONE_NAMESPACES = 0x00020000 | 0x04000000 | 0x08000000 | 0x10000000 | 0x20000000 | 0x40000000 | 0x02000000;
+/**
+ * Whether a release of Linux (6.1.0-13-arm64) is at least a version
+ * @param kernel
+ * @param major
+ * @param minor
+ */
+function kernelAtLeast(kernel, major, minor) {
+    const match = kernel.match(/^(\d+)\.(\d+)/);
+    if (!match)
+        return false;
+    return Number(match[1]) > major || (Number(match[1]) === major && Number(match[2]) >= minor);
+}
+/**
+ * Whether the kernel filters the system calls (the Seccomp field of the status of the processes)
+ * @param status the status of a process
+ */
+function seccompSupported(status) {
+    try {
+        return /^Seccomp:/m.test(status ?? (0, node_fs_1.readFileSync)('/proc/self/status', 'utf8'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The default profile of seccomp of a container, by its capabilities (its bounding set)
+ * @param capabilities
+ * @param arch the architecture of the machine, as Node.js names it
+ * @param kernel the release of its kernel
+ */
+function defaultSeccompProfile(capabilities, arch = process.arch, kernel = (0, node_os_1.release)()) {
+    const allow = (names, args) => ({ names: names, action: 'SCMP_ACT_ALLOW', args: args ?? [] });
+    const syscalls = [
+        allow([...ALLOWED]),
+        allow(['socket'], [{ index: 0, value: AF_VSOCK, op: 'SCMP_CMP_NE' }]),
+        ...[0x0, 0x0008, 0x20000, 0x20008, 0xffffffff].map((value) => allow(['personality'], [{ index: 0, value: value, op: 'SCMP_CMP_EQ' }]))
+    ];
+    if (kernelAtLeast(kernel, 4, 8))
+        syscalls.push(allow(['process_vm_readv', 'process_vm_writev', 'ptrace']));
+    if (ARCHITECTURE_SYSCALLS[arch])
+        syscalls.push(allow([...ARCHITECTURE_SYSCALLS[arch]]));
+    for (const capability of capabilities) {
+        if (CAPABILITY_SYSCALLS[capability])
+            syscalls.push(allow([...CAPABILITY_SYSCALLS[capability]]));
+    }
+    if (!capabilities.includes('CAP_SYS_ADMIN')) {
+        //clone without the flags creating namespaces (its second argument on s390x)
+        syscalls.push(allow(['clone'], [{ index: arch === 's390x' ? 1 : 0, value: CLONE_NAMESPACES, valueTwo: 0, op: 'SCMP_CMP_MASKED_EQ' }]));
+        //clone3 refused with ENOSYS: the C libraries fall back to clone
+        syscalls.push({ names: ['clone3'], action: 'SCMP_ACT_ERRNO', errnoRet: ENOSYS });
+    }
+    return { defaultAction: 'SCMP_ACT_ERRNO', architectures: [...ARCHITECTURES[arch] ?? []], syscalls: syscalls };
+}

package/dist/cjs/client/Spec.d.ts

@@ -0,0 +1,151 @@
+import type { SeccompProfile } from './Seccomp.js';
+/**
+ * The capabilities of the containers by default (the ones of containerd, Docker and nerdctl)
+ */
+export declare const DEFAULT_CAPABILITIES: readonly string[];
+/**
+ * All the capabilities of Linux (the privileged containers)
+ */
+export declare const ALL_CAPABILITIES: readonly string[];
+/**
+ * A bind mount of a container
+ */
+export type SpecMount = {
+    type?: string;
+    source: string;
+    destination: string;
+    options?: string[];
+};
+/**
+ * A device of the host given to a container
+ */
+export type SpecDevice = {
+    path: string;
+    containerPath: string;
+    type: 'c' | 'b';
+    major: number;
+    minor: number;
+    fileMode?: number;
+    uid?: number;
+    gid?: number;
+    permissions: string;
+};
+/**
+ * A rule of the devices of the cgroup of a container: the devices of a type (a: all), of a major and a minor number
+ * (all when they are not given), and their access (r, w, m)
+ */
+export type DeviceCgroupRule = {
+    type: 'a' | 'c' | 'b';
+    major?: number;
+    minor?: number;
+    access: string;
+};
+/**
+ * Parse a rule of the devices of a cgroup as Docker writes it: "c 188:* rwm", "b 8:16 r", "a *:* rwm"
+ * @param rule
+ */
+export declare function parseDeviceCgroupRule(rule: string): DeviceCgroupRule;
+/**
+ * The options of the specification of a container
+ */
+export type SpecOptions = {
+    id: string;
+    namespace: string;
+    args: string[];
+    env: string[];
+    cwd: string;
+    uid: number;
+    gid: number;
+    additionalGids: number[];
+    hostname: string;
+    terminal?: boolean;
+    privileged?: boolean;
+    readonlyRootfs?: boolean;
+    capAdd?: string[];
+    capDrop?: string[];
+    mounts?: SpecMount[];
+    devices?: SpecDevice[];
+    /**
+     * The devices the cgroup allows besides the ones given (the ones plugged later, by a bind mount of /dev)
+     */
+    deviceCgroupRules?: DeviceCgroupRule[];
+    /**
+     * The network: the one of the host, or a namespace of its own (only its loopback, or the path of the one prepared)
+     */
+    network: {
+        mode: 'host';
+    } | {
+        mode: 'none';
+    } | {
+        mode: 'path';
+        path: string;
+    } | {
+        mode: 'cni';
+    };
+    pidHost?: boolean;
+    ipcHost?: boolean;
+    /**
+     * A cgroup namespace of its own (the private one of Docker and nerdctl on cgroup v2): its cgroup is the root of its
+     * /sys/fs/cgroup
+     */
+    cgroupNamespace?: boolean;
+    /**
+     * The path of the cgroup (/default/id with cgroupfs, system.slice:lakutata:id with systemd)
+     */
+    cgroupsPath: string;
+    memory?: number;
+    memorySwap?: number;
+    cpuQuota?: number;
+    cpuPeriod?: number;
+    cpuShares?: number;
+    cpuset?: string;
+    pidsLimit?: number;
+    oomKillDisable?: boolean;
+    sysctls?: Record<string, string>;
+    shmSize?: number;
+    rlimits?: {
+        type: string;
+        hard: number;
+        soft: number;
+    }[];
+    annotations?: Record<string, string>;
+    /**
+     * The profile of seccomp of the processes (none: unconfined)
+     */
+    seccomp?: SeccompProfile;
+    /**
+     * The hooks of the runtime (createRuntime, poststop…)
+     */
+    hooks?: Record<string, {
+        path: string;
+        args?: string[];
+        env?: string[];
+        timeout?: number;
+    }[]>;
+};
+/**
+ * The capabilities of a container: the ones by default (all for the privileged containers), the ones added, without
+ * the ones dropped (ALL drops all)
+ * @param options
+ */
+export declare function containerCapabilities(options: Pick<SpecOptions, 'privileged' | 'capAdd' | 'capDrop'>): string[];
+/**
+ * The specification of the runtime (OCI) of a container on Linux, as containerd and nerdctl generate it
+ * @param options
+ */
+export declare function generateSpec(options: SpecOptions): Record<string, any>;
+/**
+ * The specification of a process executed in a container (exec): the one of the container, its arguments, its
+ * environment, its directory, its user and its terminal changed
+ * @param spec the specification of the container
+ * @param options
+ */
+export declare function execProcessSpec(spec: Record<string, any>, options: {
+    args: string[];
+    env?: string[];
+    cwd?: string;
+    uid?: number;
+    gid?: number;
+    additionalGids?: number[];
+    terminal?: boolean;
+}): Record<string, any>;