@lakutata/containerd 0.0.0-stage → 3.0.0-beta.0

package/dist/types/containerd/options/container/ContainerKillOptions.d.ts

@@ -0,0 +1,30 @@
+import { DTO } from '@lakutata/core';
+/**
+ * The signal {@link ContainerdContainer.kill} sends to a running container, without waiting for it to exit. Every
+ * field is optional. A `SIGKILL` also tells containerd's restart monitor not to restart the container; the other
+ * signals do not. Unlike the Docker component's options, the signal may be a number, and all the processes can be
+ * signaled.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('web')
+ * //Reload nginx's configuration
+ * await container.kill({signal: 'SIGHUP'})
+ * ```
+ */
+export declare class ContainerKillOptions extends DTO {
+    /**
+     * The signal: a name (`'SIGTERM'`, `'TERM'`), its number as a string (`'15'`), or a positive integer. An unknown
+     * name fails the call.
+     * @default 'SIGKILL'
+     */
+    signal?: string | number;
+    /**
+     * Send it to all the container's processes, not only to its main process.
+     * @default false
+     */
+    all?: boolean;
+}

package/dist/types/containerd/options/container/ContainerLogsOptions.d.ts

@@ -0,0 +1,34 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link ContainerdContainer.logs} reads a container's logs: the file its containerd shim writes its standard
+ * output and error to, interleaved and raw (no timestamps, no stream prefix), with its previous rotated file (the
+ * component's `logMaxSize` option). Every field is optional. Unlike the Docker component's options, there is no
+ * `since`, `until` nor `timestamps`.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('web')
+ * //The last 100 lines, then the new ones while it runs
+ * const logs = await container.logs({tail: 100})
+ * logs.on('data', (chunk: Buffer): void => {
+ *     process.stdout.write(chunk)
+ * })
+ * ```
+ */
+export declare class ContainerLogsOptions extends DTO {
+    /**
+     * Keep the stream open and send the new output while the container runs (polled every 250 milliseconds); it ends
+     * once the container stops without its restart monitor restarting it. Without it, the stream ends after the
+     * existing logs.
+     * @default true
+     */
+    follow?: boolean;
+    /**
+     * The number of lines read from the end of the existing logs, a non-negative integer (`0`: none of them); all of
+     * them by default.
+     */
+    tail?: number;
+}

package/dist/types/containerd/options/container/ContainerRemoveOptions.d.ts

@@ -0,0 +1,22 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link ContainerdContainer.remove} removes a container, with its snapshot, its network interfaces and its state
+ * directory (its logs); its named volumes are kept. The field is optional.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('web')
+ * await container.remove({force: true})
+ * ```
+ */
+export declare class ContainerRemoveOptions extends DTO {
+    /**
+     * Remove a running or paused container: all its processes are killed (`SIGKILL`) first, and its restart monitor
+     * told not to restart it. Without it, such a container throws {@link ContainerdContainerStateException}.
+     * @default false
+     */
+    force?: boolean;
+}

package/dist/types/containerd/options/container/ContainerResourceOptions.d.ts

@@ -0,0 +1,63 @@
+import { DTO } from '@lakutata/core';
+import type { ContainerdRestartPolicy } from '../../types/ContainerdRestartPolicy.js';
+/**
+ * The settings {@link ContainerdContainer.update} changes without creating the container again (as `docker update`
+ * does): its resource limits and its restart policy. An update giving only these fields is validated by this class and
+ * applied to the container's runtime specification and, while it runs, to its cgroup; the fields not given keep their
+ * values. A limit set to `0` (`[]` for `cpuSet`) is removed at once, from the running container too, and from the
+ * settings the container is created again with. Every field is optional. An update with any other field of
+ * {@link ContainerCreateOptions} creates the container again instead.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('web')
+ * //Applied to the running container
+ * await container.update({memoryLimit: 512 * 1024 * 1024, cpus: 2, restartPolicy: 'on-failure:3'})
+ * ```
+ */
+export declare class ContainerResourceOptions extends DTO {
+    /**
+     * The memory limit in bytes, a non-negative integer. `0` removes it, with the swap limit (unlimited memory and
+     * swap). A swap limit of twice the memory (the default one) follows the new limit; another swap limit is kept, and
+     * must stay at least the memory limit.
+     */
+    memoryLimit?: number;
+    /**
+     * The limit of the memory and the swap together in bytes, at least the memory limit; `-1` or `0` for unlimited
+     * swap. A positive value needs a memory limit (the container's, or `memoryLimit`). Discarded when the kernel does
+     * not limit the swap of the cgroups.
+     */
+    memorySwap?: number;
+    /**
+     * The CPUs the container uses at most, a non-negative number (`1.5`), as a CFS quota per period of 100000 µs; `0`
+     * removes the limit, at once.
+     */
+    cpus?: number;
+    /**
+     * The relative CPU weight in cgroup v1 CPU shares (`1024` is the kernel's default), a non-negative integer. `0`
+     * removes it: the running container gets the default weight (`1024` shares).
+     */
+    cpuShares?: number;
+    /**
+     * The CPUs the container may run on, by their numbers (`[0, 1]`). `[]` removes the restriction: the running
+     * container may run on every online CPU of the machine.
+     */
+    cpuSet?: number[];
+    /**
+     * The processes (and threads) the container may have at most, a non-negative integer; `0` removes the limit, at
+     * once.
+     */
+    pidsLimit?: number;
+    /**
+     * Disable the kernel's OOM killer for the container (cgroup v1 only).
+     */
+    OOMKillDisable?: boolean;
+    /**
+     * The restart policy ({@link ContainerdRestartPolicy}); `''` or `'no'` removes it. A running container is then
+     * watched by containerd's restart monitor at once.
+     */
+    restartPolicy?: ContainerdRestartPolicy;
+}

package/dist/types/containerd/options/container/ContainerStopOptions.d.ts

@@ -0,0 +1,30 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link ContainerdContainer.stop} (and `restart()`) stops a container: its stop signal sent to its main process
+ * (a paused container is resumed first), then, after the timeout, `SIGKILL` sent to all its processes; its task is
+ * deleted (its exit code kept) and containerd's restart monitor told not to restart it. Every field is optional.
+ * Unlike the Docker component's options, the signal may be a number.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('db')
+ * //A minute to shut down cleanly
+ * await container.stop({signal: 'SIGINT', timeout: 60})
+ * ```
+ */
+export declare class ContainerStopOptions extends DTO {
+    /**
+     * The seconds to wait for the container to exit after the signal before killing it, a non-negative integer.
+     * @default 10
+     */
+    timeout?: number;
+    /**
+     * The signal sent first: a name (`'SIGTERM'`, `'TERM'`), its number as a string, or a positive integer. By
+     * default, the container's stop signal ({@link ContainerCreateOptions.stopSignal}, the image's one), `SIGTERM`
+     * without it.
+     */
+    signal?: string | number;
+}

package/dist/types/containerd/options/container/ContainerTTYConsoleSizeOptions.d.ts

@@ -0,0 +1,26 @@
+import { DTO } from '@lakutata/core';
+/**
+ * The size of a container terminal, in characters: the initial one ({@link ContainerTTYOptions.consoleSize}), or the
+ * new one given to {@link ContainerdContainerTTY.resize}. Both fields are required.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('web')
+ * const tty = await container.createTTY({consoleSize: {cols: 80, rows: 24}})
+ * //The user's window was resized
+ * await tty.resize({cols: 120, rows: 40})
+ * ```
+ */
+export declare class ContainerTTYConsoleSizeOptions extends DTO {
+    /**
+     * The width in columns, a positive integer.
+     */
+    cols: number;
+    /**
+     * The height in rows, a positive integer.
+     */
+    rows: number;
+}

package/dist/types/containerd/options/container/ContainerTTYOptions.d.ts

@@ -0,0 +1,50 @@
+import { DTO } from '@lakutata/core';
+import { ContainerTTYConsoleSizeOptions } from './ContainerTTYConsoleSizeOptions.js';
+/**
+ * The process {@link ContainerdContainer.createTTY} runs with a pseudo terminal in a running container (else it throws
+ * {@link ContainerdContainerStateException}); the terminal needs `mkfifo` on the host. Every field is optional.
+ * Unlike the Docker component's options, the environment, the working directory and the user can be set.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('web')
+ * const tty = await container.createTTY({cmd: ['/bin/bash', '-l'], consoleSize: {cols: 120, rows: 40}, user: 'www-data'})
+ * tty.onData((chunk: Buffer): void => {
+ *     process.stdout.write(chunk)
+ * })
+ * tty.write('ls -la\n')
+ * tty.write('exit\n')
+ * console.log('Exit code', await tty.wait())
+ * ```
+ */
+export declare class ContainerTTYOptions extends DTO {
+    /**
+     * The command: its arguments (`['/bin/bash', '-l']`, at least one), run as they are, or a command line run by
+     * `/bin/sh -c` (`'top -d 1'`), as {@link ContainerExecOptions.cmd} is. The default shell is `/bin/sh`, present in
+     * every image having a shell (Alpine and BusyBox have no `bash`); an image without a shell (a distroless one) needs
+     * an array naming a program of its own.
+     * @default ['/bin/sh']
+     */
+    cmd?: string | string[];
+    /**
+     * The initial size of the terminal; the runtime's default when not given.
+     */
+    consoleSize?: ContainerTTYConsoleSizeOptions;
+    /**
+     * Its environment variables, added to the container's ones (and replacing them by name); `TERM` is `xterm` unless
+     * given.
+     */
+    env?: Record<string, string>;
+    /**
+     * Its working directory; the container's one by default.
+     */
+    workingDir?: string;
+    /**
+     * Its user: `'user'`, `'user:group'`, `'uid'` or `'uid:gid'`, the names resolved by the container's `/etc/passwd`
+     * and `/etc/group`; the container's user by default.
+     */
+    user?: string;
+}

package/dist/types/containerd/options/image/ImageBuildOptions.d.ts

@@ -0,0 +1,88 @@
+import { DTO } from '@lakutata/core';
+import { ContainerdRegistryAuthOptions } from '../ContainerdRegistryAuthOptions.js';
+import type { ContainerdBuildOutputCallback } from '../../types/ContainerdBuildOutputCallback.js';
+/**
+ * How {@link Containerd.buildImage} builds an image from a Dockerfile with BuildKit (the one at the component's
+ * `buildkitAddress`, local or remote): the build context and the Dockerfile are sent by a BuildKit session, the image
+ * built is imported into containerd under `repoTag` (and pushed when asked). `workdir` and `repoTag` are required.
+ * A failure throws {@link ContainerdImageBuildException}. Unlike the Docker component's options, the context files are
+ * selected by its `.dockerignore` (there is no `files`), `repoTag` is required, several platforms can be built at once,
+ * and the image can be pushed.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image = await containerd.buildImage({
+ *     workdir: '/srv/app',
+ *     repoTag: 'registry.example.com/team/app:1.0',
+ *     platform: ['linux/amd64', 'linux/arm64'],
+ *     buildargs: {NODE_VERSION: '22'},
+ *     push: true,
+ *     outputCallback: (line: string): void => console.log(line)
+ * })
+ * console.log(image.name, image.platforms)
+ * ```
+ */
+export declare class ImageBuildOptions extends DTO {
+    /**
+     * The build context directory (absolute, or relative to the process working directory); its files excluded by its
+     * `.dockerignore` are not sent. Required.
+     */
+    workdir: string;
+    /**
+     * The Dockerfile: a path relative to `workdir`, or an absolute one (its directory is then sent to BuildKit too).
+     * @default 'Dockerfile'
+     */
+    dockerfile?: string;
+    /**
+     * The name of the image built (`'app:1.0'`, `'registry.example.com/team/app:1.0'`), normalized
+     * (`'docker.io/library/app:1.0'`); a name without a tag gets `latest`. Required.
+     */
+    repoTag: string;
+    /**
+     * The platforms built: one (`'linux/arm64'`) or several (`['linux/amd64', 'linux/arm64']`, a multi-platform
+     * image). BuildKit must build them (its workers, its emulators: {@link Containerd.buildkitPlatforms}). The platform
+     * of the machine running the application by default, even with a remote BuildKit.
+     */
+    platform?: string | string[];
+    /**
+     * The Dockerfile stage built (`FROM … AS <target>`); `''` or absent builds the last stage.
+     */
+    target?: string;
+    /**
+     * The values of the Dockerfile's `ARG`s by name (`--build-arg`).
+     */
+    buildargs?: Record<string, string>;
+    /**
+     * The labels added to the image configuration (`--label`).
+     */
+    labels?: Record<string, string>;
+    /**
+     * Run every step again, without BuildKit's cache.
+     * @default false
+     */
+    nocache?: boolean;
+    /**
+     * Resolve the base images' tags with their registries again, instead of using the ones BuildKit has (`--pull`).
+     * @default false
+     */
+    pull?: boolean;
+    /**
+     * Push the image built to the registry of `repoTag` once it is imported (as {@link ContainerdImage.push} does).
+     * @default false
+     */
+    push?: boolean;
+    /**
+     * The credentials of the registry of `repoTag`, used for the base images pulled from that registry and for the
+     * push; the other registries use the component's `registryAuths`. The component's credentials of that registry by
+     * default.
+     */
+    auth?: ContainerdRegistryAuthOptions;
+    /**
+     * Receive the build progress line by line, as `docker build --progress=plain` prints it
+     * ({@link ContainerdBuildOutputCallback}).
+     */
+    outputCallback?: ContainerdBuildOutputCallback;
+}

package/dist/types/containerd/options/image/ImageExportOptions.d.ts

@@ -0,0 +1,25 @@
+import { DTO } from '@lakutata/core';
+/**
+ * Where {@link Containerd.exportImages} and {@link ContainerdImage.export} write their tar archive: an OCI image layout
+ * holding every platform the content store has of each image, named by its annotations, with the `manifest.json`
+ * `docker load` reads (the machine's platform, or the first one). {@link Containerd.importImage}, `nerdctl load`,
+ * `ctr images import` and `docker load` load it. `destination` is required. Unlike the Docker component's options,
+ * the images keep their names (there is no `repoTag`).
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * await containerd.exportImages(['nginx:1.27', 'redis:7'], {destination: '/backup/images.tar'})
+ * const image = await containerd.getImage('nginx:1.27')
+ * await image.export({destination: '/backup/nginx.tar'})
+ * ```
+ */
+export declare class ImageExportOptions extends DTO {
+    /**
+     * Where the archive is written: the path of a file, created or replaced, or a writable stream, ended once the
+     * archive is written. Required.
+     */
+    destination: string | NodeJS.WritableStream;
+}

package/dist/types/containerd/options/image/ImageImportOptions.d.ts

@@ -0,0 +1,38 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link Containerd.importImage} loads the images of a tar archive into containerd, returning them: an OCI image
+ * layout (the archive of {@link ImageExportOptions}, `nerdctl save`, `docker save` of Docker 25+), or an archive of an
+ * older `docker save`. `source` is required. An archive with no image throws {@link ContainerdImageImportException}.
+ * @example
+ * ```typescript
+ * import {createReadStream} from 'node:fs'
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const images = await containerd.importImage({source: '/backup/images.tar'})
+ * //Or from a stream (an upload, a download), under another name
+ * const [copy] = await containerd.importImage({source: createReadStream('/backup/nginx.tar'), name: 'nginx:backup'})
+ * console.log(images.map(image => image.name), copy.name)
+ * ```
+ */
+export declare class ImageImportOptions extends DTO {
+    /**
+     * The archive: the path of a file, or a readable stream of it. Required.
+     */
+    source: string | NodeJS.ReadableStream;
+    /**
+     * The name given to the imported image (`'app:1.0'`, normalized to `'docker.io/library/app:1.0'`), instead of the
+     * names the archive has. Only for an archive of one image (its tags count as one): an archive of several images
+     * given a name throws {@link ContainerdImageImportException}, nothing imported. By default, the archive's names; an
+     * older `docker save` image without one is named `import-<milliseconds>@<digest>`.
+     */
+    name?: string;
+    /**
+     * Unpack the images' layers into snapshots, for the platforms the machine runs
+     * ({@link Containerd.supportedPlatforms}), so that their containers are created at once. A failure to unpack fails the import with
+     * {@link ContainerdImageImportException}, the images stored and named.
+     * @default true
+     */
+    unpack?: boolean;
+}

package/dist/types/containerd/options/image/ImagePullOptions.d.ts

@@ -0,0 +1,53 @@
+import { DTO } from '@lakutata/core';
+import { ContainerdRegistryAuthOptions } from '../ContainerdRegistryAuthOptions.js';
+import type { ContainerdProgressCallback } from '../../types/ContainerdProgressCallback.js';
+/**
+ * How {@link Containerd.pullImage} pulls an image from its registry into containerd, returning it: the manifests of the
+ * platforms asked, their configurations and their layers. Only `image` is required. A failure throws
+ * {@link ContainerdImagePullException}; a platform the image does not have throws {@link ContainerdPlatformException}.
+ * The registries in the component's `insecureRegistries` are accessed over HTTP. Unlike the Docker component's options,
+ * the image is one reference (no `repo` and `tag`), several platforms can be pulled, and the progress is reported per
+ * blob in bytes.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image = await containerd.pullImage({
+ *     image: 'alpine:3.20',
+ *     platform: ['linux/amd64', 'linux/arm64'],
+ *     progressCallback: ({digest, current, total}): void => console.log(digest, current, '/', total)
+ * })
+ * console.log(image.name, image.platforms)
+ * ```
+ */
+export declare class ImagePullOptions extends DTO {
+    /**
+     * The image reference (`'alpine'`, `'alpine:3.20'`, `'registry.example.com:5000/app@sha256:…'`), normalized as
+     * Docker does (`'docker.io/library/alpine:latest'`), the tag `latest` when it has neither a tag nor a digest. The
+     * image is named by it in containerd. Required.
+     */
+    image: string;
+    /**
+     * The platforms pulled: one (`'linux/arm64'`, `'linux/arm/v7'`, `'arm64'` for `linux/arm64`) or several, or
+     * `'all'` for every platform of the image. The machine's platform by default.
+     */
+    platform?: string | string[];
+    /**
+     * The credentials of the image's registry; the component's credentials of that registry (`registryAuths`) by
+     * default, anonymous without them.
+     */
+    auth?: ContainerdRegistryAuthOptions;
+    /**
+     * Unpack the layers into snapshots, for the platforms pulled that the machine runs
+     * ({@link Containerd.supportedPlatforms}: its own and the ones of its emulators), so that their containers are
+     * created at once; the other platforms are only stored. Without it, a container creation unpacks them.
+     * @default true
+     */
+    unpack?: boolean;
+    /**
+     * Receive the download progress of each blob ({@link ContainerdProgressCallback}).
+     */
+    progressCallback?: ContainerdProgressCallback;
+}

package/dist/types/containerd/options/image/ImagePushOptions.d.ts

@@ -0,0 +1,44 @@
+import { DTO } from '@lakutata/core';
+import { ContainerdRegistryAuthOptions } from '../ContainerdRegistryAuthOptions.js';
+import type { ContainerdProgressCallback } from '../../types/ContainerdProgressCallback.js';
+/**
+ * Where and how {@link ContainerdImage.push} pushes an image to a registry: an image of one manifest as it is; the
+ * manifest of `platform` when it is given; else the whole index of a multi-platform image when the content store has
+ * all its platforms, the manifest of the machine's platform otherwise. Every field is optional. A failure throws
+ * {@link ContainerdImagePushException}. The registries in the component's `insecureRegistries` are accessed over HTTP.
+ * Unlike the Docker component's options, the destination is one reference (no `repo` and `tag`), the image is not
+ * tagged with it in containerd, and the identity tokens are sent.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image = await containerd.getImage('app:1.0')
+ * await image.push({
+ *     reference: 'registry.example.com:5000/team/app:1.0',
+ *     auth: {username: 'ci', password: process.env.REGISTRY_TOKEN ?? ''}
+ * })
+ * ```
+ */
+export declare class ImagePushOptions extends DTO {
+    /**
+     * The reference pushed to (`'registry.example.com:5000/team/app:1.0'`); the image's name by default.
+     */
+    reference?: string;
+    /**
+     * The platform whose manifest alone is pushed under the reference (`'linux/arm64'`), even when the content store
+     * has all the platforms of the image's index. Without it, the whole index is pushed when all its platforms are
+     * present, else the machine's platform. An image without the platform throws {@link ContainerdPlatformException}.
+     */
+    platform?: string;
+    /**
+     * The credentials of the registry of the reference; the component's credentials of that registry
+     * (`registryAuths`) by default.
+     */
+    auth?: ContainerdRegistryAuthOptions;
+    /**
+     * Receive the upload progress ({@link ContainerdProgressCallback}): once per blob, after its upload.
+     */
+    progressCallback?: ContainerdProgressCallback;
+}

package/dist/types/containerd/options/network/NetworkCreateOptions.d.ts

@@ -0,0 +1,82 @@
+import { DTO } from '@lakutata/core';
+/**
+ * A CNI network {@link Containerd.createNetwork} creates, as `nerdctl network create` does: its configuration list
+ * `nerdctl-<name>.conflist` written to the component's `cniConfigPath` (nerdctl sees it), its main plugin followed by
+ * `portmap`, and `firewall` and `tuning` when they are installed. Containers join it by
+ * {@link ContainerCreateOptions.networks}. Only `name` is required. A name or a subnet in use throws
+ * {@link ContainerdNetworkConflictException}. Unlike the Docker component's options, the IPAM settings are flat fields
+ * (one IPv4 subnet, one IPv6 subnet), and IPv6 is enabled by giving its subnet.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const network = await containerd.createNetwork({
+ *     name: 'backend',
+ *     subnet: '10.20.0.0/24',
+ *     ipRange: '10.20.0.128/25',
+ *     labels: {project: 'shop'}
+ * })
+ * await containerd.createContainer({image: 'redis:7', networks: [{networkName: network.name, ip: '10.20.0.10'}]})
+ * ```
+ */
+export declare class NetworkCreateOptions extends DTO {
+    /**
+     * The name of the network, matching `[a-zA-Z0-9][a-zA-Z0-9_.-]*`; not `host`, `none` nor `bridge` (the default
+     * nerdctl network). Required.
+     */
+    name: string;
+    /**
+     * The main CNI plugin, installed in the component's `cniPath`: `'bridge'`, a Linux bridge (`br-<12 digits of its
+     * ID>`) with NAT to the outside; `'macvlan'` (bridge mode) or `'ipvlan'` (L2 mode), the containers on the network
+     * of the host interface `parent`.
+     * @default 'bridge'
+     */
+    driver?: 'bridge' | 'ipvlan' | 'macvlan';
+    /**
+     * The IPv4 subnet in CIDR notation (`'10.20.0.0/24'`), overlapping no other network's. By default, the first free
+     * `/24` of `10.4.0.0/16` (the nerdctl range, `10.4.0.0/24` being the default network's).
+     */
+    subnet?: string;
+    /**
+     * The IPv4 gateway, an address of the subnet without a prefix length (`'10.20.0.254'`); the first address of the
+     * subnet by default.
+     */
+    gateway?: string;
+    /**
+     * The range the container addresses are given from, in CIDR notation inside the subnet (`'10.20.0.128/25'`); the
+     * whole subnet by default.
+     */
+    ipRange?: string;
+    /**
+     * The host interface (`'eth0'`) a `macvlan` or `ipvlan` network is attached to, required by them; ignored by
+     * `bridge`.
+     */
+    parent?: string;
+    /**
+     * Cut the network from the outside: no default route in the containers and, for a bridge, no gateway on the host
+     * and no masquerading.
+     * @default false
+     */
+    internal?: boolean;
+    /**
+     * The MTU of the container interfaces in bytes, at least `68`; the plugin's default (the host's, `1500` usually)
+     * when not given.
+     */
+    mtu?: number;
+    /**
+     * An IPv6 subnet in CIDR notation (`'fd00:4:10::/64'`), besides the IPv4 one, overlapping no other network's; the
+     * network has no IPv6 without it.
+     */
+    ipv6Subnet?: string;
+    /**
+     * The IPv6 gateway, an address of `ipv6Subnet` without a prefix length; the first address of the subnet by
+     * default. Ignored without `ipv6Subnet`.
+     */
+    ipv6Gateway?: string;
+    /**
+     * The labels of the network, written to its configuration.
+     */
+    labels?: Record<string, string>;
+}

package/dist/types/containerd/options/volume/VolumeCreateOptions.d.ts

@@ -0,0 +1,26 @@
+import { DTO } from '@lakutata/core';
+/**
+ * A named volume {@link Containerd.createVolume} creates: an empty directory of the component's data root
+ * (`<dataRoot>/volumes/<namespace>/<name>/_data`), which containers mount by {@link ContainerCreateOptions.volumes}.
+ * It is not a nerdctl volume. When the volume exists, it is returned unchanged (its labels kept), as Docker does. Only
+ * `name` is required.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const volume = await containerd.createVolume({name: 'pgdata', labels: {project: 'shop'}})
+ * await containerd.createContainer({image: 'postgres:16', volumes: [{volumeName: volume.name, containerPath: '/var/lib/postgresql/data'}]})
+ * ```
+ */
+export declare class VolumeCreateOptions extends DTO {
+    /**
+     * The name of the volume, matching `[a-zA-Z0-9][a-zA-Z0-9_.-]*`. Required.
+     */
+    name: string;
+    /**
+     * The labels of the volume, kept with it ({@link ContainerdVolumeInfo.labels}); ignored when it exists.
+     */
+    labels?: Record<string, string>;
+}

package/dist/types/containerd/types/ContainerdBind.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A directory or a file of the host mounted into a container (a bind mount), given to
+ * {@link ContainerCreateOptions.binds}. Unlike the Docker component's bind, `rw` is optional and the mount propagation
+ * can be set.
+ */
+export type ContainerdBind = {
+    /**
+     * The path on the host, absolute or relative to the working directory of the process. A missing path is created
+     * as a directory when the container is created (as `docker run -v` does).
+     */
+    hostPath: string;
+    /**
+     * The absolute path in the container where it is mounted; it replaces what the image has there.
+     */
+    containerPath: string;
+    /**
+     * Whether the container can write to it; `false` mounts it read only.
+     * @default true
+     */
+    rw?: boolean;
+    /**
+     * The mount propagation (how the mounts made later under the path on either side are seen by the other side):
+     * `'private'`/`'rprivate'` none, `'shared'`/`'rshared'` both ways, `'slave'`/`'rslave'` from the host into the
+     * container only. The `r` forms apply to the mounts under the path too.
+     * @default 'rprivate'
+     */
+    propagation?: 'private' | 'rprivate' | 'shared' | 'rshared' | 'slave' | 'rslave';
+};

package/dist/types/containerd/types/ContainerdBuildOutputCallback.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Receive the progress of a BuildKit build ({@link ImageBuildOptions.outputCallback}), one line per call, as
+ * `docker build --progress=plain` prints it: the steps numbered in their order (`"#3 [2/2] RUN npm ci"`), their output,
+ * and their end (`"#3 CACHED"`, `"#3 DONE 1.2s"`, or their error). The line has no trailing newline.
+ */
+export type ContainerdBuildOutputCallback = (line: string) => void;