@lakutata/containerd 0.0.0-stage → 3.0.0-beta.0

package/dist/esm/client/Rootfs.js

@@ -0,0 +1,234 @@
+import { lstat, readdir, readFile, readlink } from 'node:fs/promises';
+import path from 'node:path';
+/**
+ * The directories of the layers of the mounts of a snapshot, the top one first (overlay: its upper directory and its
+ * lower ones, bind: its source)
+ * @param mounts
+ */
+export function layerDirectories(mounts) {
+    const directories = [];
+    for (const mount of mounts) {
+        if (mount.type === 'bind' || mount.type === 'rbind') {
+            directories.push(mount.source);
+            continue;
+        }
+        if (mount.type !== 'overlay')
+            continue;
+        for (const option of mount.options) {
+            if (option.startsWith('upperdir='))
+                directories.unshift(option.slice(9));
+            if (option.startsWith('lowerdir='))
+                directories.push(...option.slice(9).split(':'));
+        }
+    }
+    return directories;
+}
+/**
+ * Read a file of the root file system of a snapshot from the directories of its layers (the snapshotter of the host,
+ * readable by root): the top layer having it first, its deletions (the whiteouts of overlay) honoured, its symbolic
+ * links resolved in the root file system
+ * @param mounts
+ * @param file an absolute path in the root file system
+ * @param depth
+ */
+export async function readRootfsFile(mounts, file, depth = 0) {
+    if (depth > 8)
+        return undefined;
+    const relative = path.posix.normalize(file).replace(/^\/+/, '');
+    for (const directory of layerDirectories(mounts)) {
+        const target = path.join(directory, relative);
+        let stats;
+        try {
+            stats = await lstat(target);
+        }
+        catch {
+            continue;
+        }
+        //Deleted by this layer
+        if (stats.isCharacterDevice() && stats.rdev === 0)
+            return undefined;
+        if (stats.isSymbolicLink()) {
+            const link = await readlink(target);
+            return await readRootfsFile(mounts, link.startsWith('/') ? link : path.posix.join(path.posix.dirname('/' + relative), link), depth + 1);
+        }
+        if (!stats.isFile())
+            return undefined;
+        return await readFile(target);
+    }
+    return undefined;
+}
+/**
+ * The entries of a file of the database of the users or of the groups (name:x:id:…)
+ * @param content
+ */
+function readEntries(content) {
+    if (!content)
+        return [];
+    return content.toString('utf8').split('\n').filter((line) => !!line.trim() && !line.startsWith('#')).map((line) => line.split(':'));
+}
+/**
+ * Resolve the user of a process in a root file system (its /etc/passwd and /etc/group): user, user:group, uid, uid:gid
+ * @param mounts
+ * @param user empty for root
+ */
+export async function resolveUser(mounts, user) {
+    const [userPart, groupPart] = (user ?? '').split(':');
+    const passwd = readEntries(await readRootfsFile(mounts, '/etc/passwd'));
+    let uid = 0;
+    let gid = 0;
+    let home = '/';
+    let name = 'root';
+    if (userPart) {
+        const entry = passwd.find((fields) => fields[0] === userPart) ?? (/^\d+$/.test(userPart) ? passwd.find((fields) => fields[2] === userPart) : undefined);
+        if (entry) {
+            uid = Number(entry[2]);
+            gid = Number(entry[3]);
+            home = entry[5] || '/';
+            name = entry[0];
+        }
+        else if (/^\d+$/.test(userPart)) {
+            uid = Number(userPart);
+            gid = Number(userPart);
+            name = undefined;
+        }
+        else {
+            throw new Error(`The user "${userPart}" is not in the /etc/passwd of the image`);
+        }
+    }
+    else {
+        const root = passwd.find((fields) => fields[2] === '0');
+        if (root)
+            home = root[5] || '/';
+    }
+    const groups = readEntries(await readRootfsFile(mounts, '/etc/group'));
+    if (groupPart) {
+        const entry = groups.find((fields) => fields[0] === groupPart);
+        if (entry)
+            gid = Number(entry[2]);
+        else if (/^\d+$/.test(groupPart))
+            gid = Number(groupPart);
+        else
+            throw new Error(`The group "${groupPart}" is not in the /etc/group of the image`);
+    }
+    //The groups the user is a member of (supplementary)
+    const additionalGids = name ? groups
+        .filter((fields) => (fields[3] ?? '').split(',').includes(name) && Number(fields[2]) !== gid)
+        .map((fields) => Number(fields[2])) : [];
+    return { uid: uid, gid: gid, additionalGids: [...new Set(additionalGids)], home: home };
+}
+/**
+ * The resolution of the symbolic links of a path in a file tree
+ * @param tree
+ * @param file
+ */
+async function resolveInTree(tree, file) {
+    const pending = path.posix.normalize(`/${file}`).split('/').filter(Boolean);
+    let current = '/';
+    let links = 0;
+    while (pending.length) {
+        const part = pending.shift();
+        if (part === '..') {
+            current = path.posix.dirname(current);
+            continue;
+        }
+        const candidate = path.posix.join(current, part);
+        const found = await tree.lstat(candidate);
+        if (found?.stats.isSymbolicLink()) {
+            if (++links > 40)
+                throw new Error(`The path ${file} has too many symbolic links`);
+            const target = await readlink(found.path);
+            if (target.startsWith('/'))
+                current = '/';
+            pending.unshift(...target.split('/').filter(Boolean));
+            continue;
+        }
+        current = candidate;
+    }
+    return current;
+}
+/**
+ * A file system of a directory of the host (/proc/<pid>/root: the one of a running container, its mounts with it)
+ */
+export class DirectoryTree {
+    constructor(root) {
+        this.root = root;
+    }
+    resolve(file) {
+        return resolveInTree(this, file);
+    }
+    async lstat(file) {
+        const real = path.join(this.root, path.posix.normalize(`/${file}`));
+        try {
+            return { stats: await lstat(real), path: real };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async readdir(directory) {
+        return (await readdir(path.join(this.root, path.posix.normalize(`/${directory}`)))).sort();
+    }
+}
+/**
+ * Whether stats are the ones of a whiteout of overlay (a deletion of a layer)
+ * @param stats
+ */
+function isWhiteout(stats) {
+    return stats.isCharacterDevice() && stats.rdev === 0;
+}
+/**
+ * A file system of the layers of a snapshot (the directories of overlay, the top one first): the deletions of the upper
+ * layers (their whiteouts) hide the entries of the lower ones
+ */
+export class LayersTree {
+    constructor(layers) {
+        this.layers = layers;
+    }
+    resolve(file) {
+        return resolveInTree(this, file);
+    }
+    async stat(file) {
+        try {
+            return await lstat(file);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async lstat(file) {
+        const parts = path.posix.normalize(`/${file}`).split('/').filter(Boolean);
+        for (const layer of this.layers) {
+            //An ancestor deleted (or replaced by a file) by this layer hides the path in the lower layers
+            for (let length = 1; length < parts.length; length++) {
+                const ancestor = await this.stat(path.join(layer, ...parts.slice(0, length)));
+                if (ancestor && (isWhiteout(ancestor) || !ancestor.isDirectory()))
+                    return undefined;
+            }
+            const real = path.join(layer, ...parts);
+            const stats = await this.stat(real);
+            if (!stats)
+                continue;
+            return isWhiteout(stats) ? undefined : { stats: stats, path: real };
+        }
+        return undefined;
+    }
+    async readdir(directory) {
+        const parts = path.posix.normalize(`/${directory}`).split('/').filter(Boolean);
+        const names = new Map();
+        for (const layer of this.layers) {
+            const stats = await this.stat(path.join(layer, ...parts));
+            if (!stats)
+                continue;
+            //Deleted or replaced by this layer: the lower layers are hidden
+            if (!stats.isDirectory())
+                break;
+            for (const name of await readdir(path.join(layer, ...parts))) {
+                if (names.has(name))
+                    continue;
+                const entry = await this.stat(path.join(layer, ...parts, name));
+                names.set(name, !!entry && !isWhiteout(entry));
+            }
+        }
+        return [...names].filter(([, present]) => present).map(([name]) => name).sort();
+    }
+}

package/dist/esm/client/Seccomp.js

@@ -0,0 +1,152 @@
+import { readFileSync } from 'node:fs';
+import { release } from 'node:os';
+const ALLOWED = [
+    'accept', 'accept4', 'access', 'adjtimex', 'alarm', 'bind', 'brk', 'cachestat', 'capget', 'capset', 'chdir', 'chmod',
+    'chown', 'chown32', 'clock_adjtime', 'clock_adjtime64', 'clock_getres', 'clock_getres_time64', 'clock_gettime',
+    'clock_gettime64', 'clock_nanosleep', 'clock_nanosleep_time64', 'close', 'close_range', 'connect', 'copy_file_range',
+    'creat', 'dup', 'dup2', 'dup3', 'epoll_create', 'epoll_create1', 'epoll_ctl', 'epoll_ctl_old', 'epoll_pwait',
+    'epoll_pwait2', 'epoll_wait', 'epoll_wait_old', 'eventfd', 'eventfd2', 'execve', 'execveat', 'exit', 'exit_group',
+    'faccessat', 'faccessat2', 'fadvise64', 'fadvise64_64', 'fallocate', 'fanotify_mark', 'fchdir', 'fchmod', 'fchmodat',
+    'fchmodat2', 'fchown', 'fchown32', 'fchownat', 'fcntl', 'fcntl64', 'fdatasync', 'fgetxattr', 'flistxattr', 'flock',
+    'fork', 'fremovexattr', 'fsetxattr', 'fstat', 'fstat64', 'fstatat64', 'fstatfs', 'fstatfs64', 'fsync', 'ftruncate',
+    'ftruncate64', 'futex', 'futex_requeue', 'futex_time64', 'futex_wait', 'futex_waitv', 'futex_wake', 'futimesat',
+    'getcpu', 'getcwd', 'getdents', 'getdents64', 'getegid', 'getegid32', 'geteuid', 'geteuid32', 'getgid', 'getgid32',
+    'getgroups', 'getgroups32', 'getitimer', 'getpeername', 'getpgid', 'getpgrp', 'getpid', 'getppid', 'getpriority',
+    'getrandom', 'getresgid', 'getresgid32', 'getresuid', 'getresuid32', 'getrlimit', 'get_robust_list', 'getrusage',
+    'getsid', 'getsockname', 'getsockopt', 'get_thread_area', 'gettid', 'gettimeofday', 'getuid', 'getuid32', 'getxattr',
+    'inotify_add_watch', 'inotify_init', 'inotify_init1', 'inotify_rm_watch', 'io_cancel', 'ioctl', 'io_destroy',
+    'io_getevents', 'io_pgetevents', 'io_pgetevents_time64', 'ioprio_get', 'ioprio_set', 'io_setup', 'io_submit',
+    'io_uring_enter', 'io_uring_register', 'io_uring_setup', 'ipc', 'kill', 'landlock_add_rule', 'landlock_create_ruleset',
+    'landlock_restrict_self', 'lchown', 'lchown32', 'lgetxattr', 'link', 'linkat', 'listen', 'listxattr', 'llistxattr',
+    '_llseek', 'lremovexattr', 'lseek', 'lsetxattr', 'lstat', 'lstat64', 'madvise', 'membarrier', 'memfd_create',
+    'memfd_secret', 'mincore', 'mkdir', 'mkdirat', 'mknod', 'mknodat', 'mlock', 'mlock2', 'mlockall', 'map_shadow_stack',
+    'mmap', 'mmap2', 'mprotect', 'mq_getsetattr', 'mq_notify', 'mq_open', 'mq_timedreceive', 'mq_timedreceive_time64',
+    'mq_timedsend', 'mq_timedsend_time64', 'mq_unlink', 'mremap', 'msgctl', 'msgget', 'msgrcv', 'msgsnd', 'msync',
+    'munlock', 'munlockall', 'munmap', 'name_to_handle_at', 'nanosleep', 'newfstatat', '_newselect', 'open', 'openat',
+    'openat2', 'pause', 'pidfd_open', 'pidfd_send_signal', 'pipe', 'pipe2', 'pkey_alloc', 'pkey_free', 'pkey_mprotect',
+    'poll', 'ppoll', 'ppoll_time64', 'prctl', 'pread64', 'preadv', 'preadv2', 'prlimit64', 'process_mrelease', 'pselect6',
+    'pselect6_time64', 'pwrite64', 'pwritev', 'pwritev2', 'read', 'readahead', 'readlink', 'readlinkat', 'readv', 'recv',
+    'recvfrom', 'recvmmsg', 'recvmmsg_time64', 'recvmsg', 'remap_file_pages', 'removexattr', 'rename', 'renameat',
+    'renameat2', 'restart_syscall', 'rmdir', 'rseq', 'rt_sigaction', 'rt_sigpending', 'rt_sigprocmask', 'rt_sigqueueinfo',
+    'rt_sigreturn', 'rt_sigsuspend', 'rt_sigtimedwait', 'rt_sigtimedwait_time64', 'rt_tgsigqueueinfo', 'sched_getaffinity',
+    'sched_getattr', 'sched_getparam', 'sched_get_priority_max', 'sched_get_priority_min', 'sched_getscheduler',
+    'sched_rr_get_interval', 'sched_rr_get_interval_time64', 'sched_setaffinity', 'sched_setattr', 'sched_setparam',
+    'sched_setscheduler', 'sched_yield', 'seccomp', 'select', 'semctl', 'semget', 'semop', 'semtimedop',
+    'semtimedop_time64', 'send', 'sendfile', 'sendfile64', 'sendmmsg', 'sendmsg', 'sendto', 'setfsgid', 'setfsgid32',
+    'setfsuid', 'setfsuid32', 'setgid', 'setgid32', 'setgroups', 'setgroups32', 'setitimer', 'setpgid', 'setpriority',
+    'setregid', 'setregid32', 'setresgid', 'setresgid32', 'setresuid', 'setresuid32', 'setreuid', 'setreuid32',
+    'setrlimit', 'set_robust_list', 'setsid', 'setsockopt', 'set_thread_area', 'set_tid_address', 'setuid', 'setuid32',
+    'setxattr', 'shmat', 'shmctl', 'shmdt', 'shmget', 'shutdown', 'sigaltstack', 'signalfd', 'signalfd4', 'sigprocmask',
+    'sigreturn', 'socketcall', 'socketpair', 'splice', 'stat', 'stat64', 'statfs', 'statfs64', 'statx', 'symlink',
+    'symlinkat', 'sync', 'sync_file_range', 'syncfs', 'sysinfo', 'tee', 'tgkill', 'time', 'timer_create', 'timer_delete',
+    'timer_getoverrun', 'timer_gettime', 'timer_gettime64', 'timer_settime', 'timer_settime64', 'timerfd_create',
+    'timerfd_gettime', 'timerfd_gettime64', 'timerfd_settime', 'timerfd_settime64', 'times', 'tkill', 'truncate',
+    'truncate64', 'ugetrlimit', 'umask', 'uname', 'unlink', 'unlinkat', 'utime', 'utimensat', 'utimensat_time64', 'utimes',
+    'vfork', 'vmsplice', 'wait4', 'waitid', 'waitpid', 'write', 'writev'
+];
+/**
+ * The architectures of the system calls filtered, by the architecture of the machine (the emulated containers run its
+ * system calls: their emulators are processes of the machine)
+ */
+const ARCHITECTURES = {
+    x64: ['SCMP_ARCH_X86_64', 'SCMP_ARCH_X86', 'SCMP_ARCH_X32'],
+    arm64: ['SCMP_ARCH_ARM', 'SCMP_ARCH_AARCH64'],
+    mips64: ['SCMP_ARCH_MIPS', 'SCMP_ARCH_MIPS64', 'SCMP_ARCH_MIPS64N32'],
+    mips64el: ['SCMP_ARCH_MIPSEL', 'SCMP_ARCH_MIPSEL64', 'SCMP_ARCH_MIPSEL64N32'],
+    s390x: ['SCMP_ARCH_S390', 'SCMP_ARCH_S390X'],
+    riscv64: ['SCMP_ARCH_RISCV64']
+};
+/**
+ * The system calls of the architectures of the machine
+ */
+const ARCHITECTURE_SYSCALLS = {
+    ppc64: ['sync_file_range2', 'swapcontext'],
+    arm: ['arm_fadvise64_64', 'arm_sync_file_range', 'sync_file_range2', 'breakpoint', 'cacheflush', 'set_tls'],
+    arm64: ['arm_fadvise64_64', 'arm_sync_file_range', 'sync_file_range2', 'breakpoint', 'cacheflush', 'set_tls'],
+    x64: ['arch_prctl', 'modify_ldt'],
+    ia32: ['modify_ldt'],
+    s390x: ['s390_pci_mmio_read', 's390_pci_mmio_write', 's390_runtime_instr'],
+    riscv64: ['riscv_flush_icache']
+};
+/**
+ * The system calls allowed with the capabilities
+ */
+const CAPABILITY_SYSCALLS = {
+    CAP_DAC_READ_SEARCH: ['open_by_handle_at'],
+    CAP_SYS_ADMIN: [
+        'bpf', 'clone', 'clone3', 'fanotify_init', 'fsconfig', 'fsmount', 'fsopen', 'fspick', 'lookup_dcookie', 'mount',
+        'mount_setattr', 'move_mount', 'open_tree', 'perf_event_open', 'quotactl', 'quotactl_fd', 'setdomainname',
+        'sethostname', 'setns', 'syslog', 'umount', 'umount2', 'unshare'
+    ],
+    CAP_SYS_BOOT: ['reboot'],
+    CAP_SYS_CHROOT: ['chroot'],
+    CAP_SYS_MODULE: ['delete_module', 'init_module', 'finit_module'],
+    CAP_SYS_PACCT: ['acct'],
+    CAP_SYS_PTRACE: ['kcmp', 'pidfd_getfd', 'process_madvise', 'process_vm_readv', 'process_vm_writev', 'ptrace'],
+    CAP_SYS_RAWIO: ['iopl', 'ioperm'],
+    CAP_SYS_TIME: ['settimeofday', 'stime', 'clock_settime', 'clock_settime64'],
+    CAP_SYS_TTY_CONFIG: ['vhangup'],
+    CAP_SYS_NICE: ['get_mempolicy', 'mbind', 'set_mempolicy', 'set_mempolicy_home_node'],
+    CAP_SYSLOG: ['syslog'],
+    CAP_BPF: ['bpf'],
+    CAP_PERFMON: ['perf_event_open']
+};
+const AF_VSOCK = 40;
+const ENOSYS = 38;
+/**
+ * The flags of clone creating namespaces (NEWNS, NEWUTS, NEWIPC, NEWUSER, NEWPID, NEWNET, NEWCGROUP)
+ */
+const CLONE_NAMESPACES = 0x00020000 | 0x04000000 | 0x08000000 | 0x10000000 | 0x20000000 | 0x40000000 | 0x02000000;
+/**
+ * Whether a release of Linux (6.1.0-13-arm64) is at least a version
+ * @param kernel
+ * @param major
+ * @param minor
+ */
+function kernelAtLeast(kernel, major, minor) {
+    const match = kernel.match(/^(\d+)\.(\d+)/);
+    if (!match)
+        return false;
+    return Number(match[1]) > major || (Number(match[1]) === major && Number(match[2]) >= minor);
+}
+/**
+ * Whether the kernel filters the system calls (the Seccomp field of the status of the processes)
+ * @param status the status of a process
+ */
+export function seccompSupported(status) {
+    try {
+        return /^Seccomp:/m.test(status ?? readFileSync('/proc/self/status', 'utf8'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The default profile of seccomp of a container, by its capabilities (its bounding set)
+ * @param capabilities
+ * @param arch the architecture of the machine, as Node.js names it
+ * @param kernel the release of its kernel
+ */
+export function defaultSeccompProfile(capabilities, arch = process.arch, kernel = release()) {
+    const allow = (names, args) => ({ names: names, action: 'SCMP_ACT_ALLOW', args: args ?? [] });
+    const syscalls = [
+        allow([...ALLOWED]),
+        allow(['socket'], [{ index: 0, value: AF_VSOCK, op: 'SCMP_CMP_NE' }]),
+        ...[0x0, 0x0008, 0x20000, 0x20008, 0xffffffff].map((value) => allow(['personality'], [{ index: 0, value: value, op: 'SCMP_CMP_EQ' }]))
+    ];
+    if (kernelAtLeast(kernel, 4, 8))
+        syscalls.push(allow(['process_vm_readv', 'process_vm_writev', 'ptrace']));
+    if (ARCHITECTURE_SYSCALLS[arch])
+        syscalls.push(allow([...ARCHITECTURE_SYSCALLS[arch]]));
+    for (const capability of capabilities) {
+        if (CAPABILITY_SYSCALLS[capability])
+            syscalls.push(allow([...CAPABILITY_SYSCALLS[capability]]));
+    }
+    if (!capabilities.includes('CAP_SYS_ADMIN')) {
+        //clone without the flags creating namespaces (its second argument on s390x)
+        syscalls.push(allow(['clone'], [{ index: arch === 's390x' ? 1 : 0, value: CLONE_NAMESPACES, valueTwo: 0, op: 'SCMP_CMP_MASKED_EQ' }]));
+        //clone3 refused with ENOSYS: the C libraries fall back to clone
+        syscalls.push({ names: ['clone3'], action: 'SCMP_ACT_ERRNO', errnoRet: ENOSYS });
+    }
+    return { defaultAction: 'SCMP_ACT_ERRNO', architectures: [...ARCHITECTURES[arch] ?? []], syscalls: syscalls };
+}

package/dist/esm/client/Spec.js

@@ -0,0 +1,220 @@
+/**
+ * The capabilities of the containers by default (the ones of containerd, Docker and nerdctl)
+ */
+export const DEFAULT_CAPABILITIES = [
+    'CAP_CHOWN',
+    'CAP_DAC_OVERRIDE',
+    'CAP_FSETID',
+    'CAP_FOWNER',
+    'CAP_MKNOD',
+    'CAP_NET_RAW',
+    'CAP_SETGID',
+    'CAP_SETUID',
+    'CAP_SETFCAP',
+    'CAP_SETPCAP',
+    'CAP_NET_BIND_SERVICE',
+    'CAP_SYS_CHROOT',
+    'CAP_KILL',
+    'CAP_AUDIT_WRITE'
+];
+/**
+ * All the capabilities of Linux (the privileged containers)
+ */
+export const ALL_CAPABILITIES = [
+    'CAP_CHOWN', 'CAP_DAC_OVERRIDE', 'CAP_DAC_READ_SEARCH', 'CAP_FOWNER', 'CAP_FSETID', 'CAP_KILL', 'CAP_SETGID',
+    'CAP_SETUID', 'CAP_SETPCAP', 'CAP_LINUX_IMMUTABLE', 'CAP_NET_BIND_SERVICE', 'CAP_NET_BROADCAST', 'CAP_NET_ADMIN',
+    'CAP_NET_RAW', 'CAP_IPC_LOCK', 'CAP_IPC_OWNER', 'CAP_SYS_MODULE', 'CAP_SYS_RAWIO', 'CAP_SYS_CHROOT', 'CAP_SYS_PTRACE',
+    'CAP_SYS_PACCT', 'CAP_SYS_ADMIN', 'CAP_SYS_BOOT', 'CAP_SYS_NICE', 'CAP_SYS_RESOURCE', 'CAP_SYS_TIME',
+    'CAP_SYS_TTY_CONFIG', 'CAP_MKNOD', 'CAP_LEASE', 'CAP_AUDIT_WRITE', 'CAP_AUDIT_CONTROL', 'CAP_SETFCAP',
+    'CAP_MAC_OVERRIDE', 'CAP_MAC_ADMIN', 'CAP_SYSLOG', 'CAP_WAKE_ALARM', 'CAP_BLOCK_SUSPEND', 'CAP_AUDIT_READ',
+    'CAP_PERFMON', 'CAP_BPF', 'CAP_CHECKPOINT_RESTORE'
+];
+/**
+ * The paths masked in the containers (not privileged)
+ */
+const MASKED_PATHS = [
+    '/proc/acpi', '/proc/asound', '/proc/kcore', '/proc/keys', '/proc/latency_stats', '/proc/timer_list',
+    '/proc/timer_stats', '/proc/sched_debug', '/proc/scsi', '/sys/firmware', '/sys/devices/virtual/powercap'
+];
+/**
+ * The paths read only in the containers (not privileged)
+ */
+const READONLY_PATHS = ['/proc/bus', '/proc/fs', '/proc/irq', '/proc/sys', '/proc/sysrq-trigger'];
+/**
+ * The devices of the containers allowed by default (the ones of runc: null, zero, full, tty, random, urandom, the
+ * pseudo terminals)
+ */
+const DEFAULT_DEVICE_RULES = [
+    { allow: false, access: 'rwm' },
+    { allow: true, type: 'c', major: 1, minor: 3, access: 'rwm' },
+    { allow: true, type: 'c', major: 1, minor: 8, access: 'rwm' },
+    { allow: true, type: 'c', major: 1, minor: 7, access: 'rwm' },
+    { allow: true, type: 'c', major: 5, minor: 0, access: 'rwm' },
+    { allow: true, type: 'c', major: 1, minor: 5, access: 'rwm' },
+    { allow: true, type: 'c', major: 1, minor: 9, access: 'rwm' },
+    { allow: true, type: 'c', major: 5, minor: 2, access: 'rwm' },
+    { allow: true, type: 'c', major: 136, access: 'rwm' }
+];
+/**
+ * Parse a rule of the devices of a cgroup as Docker writes it: "c 188:* rwm", "b 8:16 r", "a *:* rwm"
+ * @param rule
+ */
+export function parseDeviceCgroupRule(rule) {
+    const match = rule.trim().match(/^([acb]) (\*|\d+):(\*|\d+) ([rwm]{1,3})$/);
+    if (!match || new Set(match[4]).size !== match[4].length)
+        throw new Error(`The rule of the devices "${rule}" is not valid ("c 188:* rwm": a type a, c or b, the major and the minor numbers or *, the access of r, w and m)`);
+    return {
+        type: match[1],
+        ...match[2] === '*' ? {} : { major: Number(match[2]) },
+        ...match[3] === '*' ? {} : { minor: Number(match[3]) },
+        access: match[4]
+    };
+}
+/**
+ * The capability of a name (NET_ADMIN, CAP_NET_ADMIN)
+ * @param name
+ */
+function normalizeCapability(name) {
+    const upper = name.trim().toUpperCase();
+    return upper.startsWith('CAP_') ? upper : `CAP_${upper}`;
+}
+/**
+ * The capabilities of a container: the ones by default (all for the privileged containers), the ones added, without
+ * the ones dropped (ALL drops all)
+ * @param options
+ */
+export function containerCapabilities(options) {
+    let capabilities = new Set(options.privileged ? ALL_CAPABILITIES : DEFAULT_CAPABILITIES);
+    const drop = (options.capDrop ?? []).map(normalizeCapability);
+    if (drop.includes('CAP_ALL'))
+        capabilities = new Set();
+    else
+        drop.forEach((capability) => capabilities.delete(capability));
+    const add = (options.capAdd ?? []).map(normalizeCapability);
+    if (add.includes('CAP_ALL'))
+        ALL_CAPABILITIES.forEach((capability) => capabilities.add(capability));
+    else
+        add.forEach((capability) => capabilities.add(capability));
+    return [...capabilities];
+}
+/**
+ * The specification of the runtime (OCI) of a container on Linux, as containerd and nerdctl generate it
+ * @param options
+ */
+export function generateSpec(options) {
+    const capabilities = containerCapabilities(options);
+    const namespaces = [{ type: 'mount' }, { type: 'uts' }];
+    if (!options.pidHost)
+        namespaces.push({ type: 'pid' });
+    if (!options.ipcHost)
+        namespaces.push({ type: 'ipc' });
+    if (options.cgroupNamespace)
+        namespaces.push({ type: 'cgroup' });
+    if (options.network.mode === 'none' || options.network.mode === 'cni')
+        namespaces.push({ type: 'network' });
+    if (options.network.mode === 'path')
+        namespaces.push({ type: 'network', path: options.network.path });
+    const mounts = [
+        { destination: '/proc', type: 'proc', source: 'proc', options: ['nosuid', 'noexec', 'nodev'] },
+        { destination: '/dev', type: 'tmpfs', source: 'tmpfs', options: ['nosuid', 'strictatime', 'mode=755', 'size=65536k'] },
+        { destination: '/dev/pts', type: 'devpts', source: 'devpts', options: ['nosuid', 'noexec', 'newinstance', 'ptmxmode=0666', 'mode=0620', 'gid=5'] },
+        { destination: '/dev/shm', type: 'tmpfs', source: 'shm', options: ['nosuid', 'noexec', 'nodev', 'mode=1777', `size=${options.shmSize ?? 64 * 1024 * 1024}`] },
+        { destination: '/dev/mqueue', type: 'mqueue', source: 'mqueue', options: ['nosuid', 'noexec', 'nodev'] },
+        { destination: '/sys', type: 'sysfs', source: 'sysfs', options: ['nosuid', 'noexec', 'nodev', options.privileged ? 'rw' : 'ro'] },
+        { destination: '/sys/fs/cgroup', type: 'cgroup', source: 'cgroup', options: ['nosuid', 'noexec', 'nodev', 'relatime', options.privileged ? 'rw' : 'ro'] }
+    ];
+    for (const mount of options.mounts ?? []) {
+        //A mount given replaces the one of its destination
+        const index = mounts.findIndex((existing) => existing.destination === mount.destination);
+        if (index >= 0)
+            mounts.splice(index, 1);
+        mounts.push({ type: mount.type ?? 'bind', source: mount.source, destination: mount.destination, options: mount.options ?? ['rbind', 'rprivate'] });
+    }
+    const devices = options.devices ?? [];
+    const resources = {
+        devices: options.privileged ? [{ allow: true, access: 'rwm' }] : [
+            ...DEFAULT_DEVICE_RULES,
+            ...devices.map((device) => ({ allow: true, type: device.type, major: device.major, minor: device.minor, access: device.permissions })),
+            ...(options.deviceCgroupRules ?? []).map((rule) => ({ allow: true, ...rule }))
+        ]
+    };
+    if (options.memory || options.oomKillDisable) {
+        resources.memory = {};
+        if (options.memory)
+            resources.memory.limit = options.memory;
+        if (options.memorySwap)
+            resources.memory.swap = options.memorySwap;
+        if (options.oomKillDisable)
+            resources.memory.disableOOMKiller = true;
+    }
+    if (options.cpuQuota || options.cpuShares || options.cpuset) {
+        resources.cpu = {};
+        if (options.cpuQuota) {
+            resources.cpu.quota = options.cpuQuota;
+            resources.cpu.period = options.cpuPeriod ?? 100000;
+        }
+        if (options.cpuShares)
+            resources.cpu.shares = options.cpuShares;
+        if (options.cpuset)
+            resources.cpu.cpus = options.cpuset;
+    }
+    if (options.pidsLimit)
+        resources.pids = { limit: options.pidsLimit };
+    return {
+        ociVersion: '1.0.2-dev',
+        process: {
+            terminal: !!options.terminal,
+            user: { uid: options.uid, gid: options.gid, ...options.additionalGids.length ? { additionalGids: options.additionalGids } : {} },
+            args: options.args,
+            env: options.env,
+            cwd: options.cwd || '/',
+            capabilities: { bounding: capabilities, effective: capabilities, permitted: capabilities },
+            rlimits: options.rlimits ?? [{ type: 'RLIMIT_NOFILE', hard: 1024, soft: 1024 }],
+            noNewPrivileges: !options.privileged
+        },
+        root: { path: 'rootfs', readonly: !!options.readonlyRootfs },
+        hostname: options.hostname,
+        mounts: mounts,
+        ...options.hooks ? { hooks: options.hooks } : {},
+        annotations: options.annotations ?? {},
+        linux: {
+            resources: resources,
+            cgroupsPath: options.cgroupsPath,
+            namespaces: namespaces,
+            devices: devices.map((device) => ({
+                path: device.containerPath,
+                type: device.type,
+                major: device.major,
+                minor: device.minor,
+                fileMode: device.fileMode ?? 0o666,
+                uid: device.uid ?? 0,
+                gid: device.gid ?? 0
+            })),
+            ...options.sysctls && Object.keys(options.sysctls).length ? { sysctl: options.sysctls } : {},
+            ...options.seccomp ? { seccomp: options.seccomp } : {},
+            ...options.privileged ? {} : { maskedPaths: [...MASKED_PATHS], readonlyPaths: [...READONLY_PATHS] }
+        }
+    };
+}
+/**
+ * The specification of a process executed in a container (exec): the one of the container, its arguments, its
+ * environment, its directory, its user and its terminal changed
+ * @param spec the specification of the container
+ * @param options
+ */
+export function execProcessSpec(spec, options) {
+    const process = structuredClone(spec.process ?? {});
+    process.args = options.args;
+    process.terminal = !!options.terminal;
+    if (options.env?.length) {
+        const env = new Map((process.env ?? []).map((entry) => [entry.split('=')[0], entry]));
+        for (const entry of options.env)
+            env.set(entry.split('=')[0], entry);
+        process.env = [...env.values()];
+    }
+    if (options.cwd)
+        process.cwd = options.cwd;
+    if (options.uid !== undefined)
+        process.user = { uid: options.uid, gid: options.gid ?? 0, ...options.additionalGids?.length ? { additionalGids: options.additionalGids } : {} };
+    return process;
+}