@lakutata/containerd 0.0.0-stage → 3.0.0-beta.1

package/dist/cjs/containerd/Containerd.js

@@ -0,0 +1,929 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Containerd = void 0;
+const core_1 = require("@lakutata/core");
+const di_1 = require("@lakutata/core/decorator/di");
+const dto_1 = require("@lakutata/core/decorator/dto");
+const ContainerdClient_js_1 = require("../client/ContainerdClient.js");
+const ImageStore_js_1 = require("../client/ImageStore.js");
+const ContainerStore_js_1 = require("../client/ContainerStore.js");
+const Platforms_js_1 = require("../client/Platforms.js");
+const Reference_js_1 = require("../client/Reference.js");
+const Networks_js_1 = require("../client/Networks.js");
+const grpc_1 = require("@lakutata/grpc");
+const BuildKit_js_1 = require("../client/BuildKit.js");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const ContainerdImage_js_1 = require("./lib/ContainerdImage.js");
+const ContainerdContainer_js_1 = require("./lib/ContainerdContainer.js");
+const ContainerdContainerTTY_js_1 = require("./lib/ContainerdContainerTTY.js");
+const ContainerdPruneOptions_js_1 = require("./options/ContainerdPruneOptions.js");
+const VolumeCreateOptions_js_1 = require("./options/volume/VolumeCreateOptions.js");
+const ContainerdVolumeNotFoundException_js_1 = require("./exceptions/ContainerdVolumeNotFoundException.js");
+const ContainerdVolumeInUseException_js_1 = require("./exceptions/ContainerdVolumeInUseException.js");
+const Volumes_js_1 = require("../client/Volumes.js");
+const Time_1 = require("@lakutata/utils/Time");
+const ContainerdErrors_js_1 = require("./lib/ContainerdErrors.js");
+const ImagePullOptions_js_1 = require("./options/image/ImagePullOptions.js");
+const ImageImportOptions_js_1 = require("./options/image/ImageImportOptions.js");
+const ImageExportOptions_js_1 = require("./options/image/ImageExportOptions.js");
+const ContainerCreateOptions_js_1 = require("./options/container/ContainerCreateOptions.js");
+const ContainerdConnectionException_js_1 = require("./exceptions/ContainerdConnectionException.js");
+const ContainerdImageNotFoundException_js_1 = require("./exceptions/ContainerdImageNotFoundException.js");
+const ContainerdImagePullException_js_1 = require("./exceptions/ContainerdImagePullException.js");
+const ContainerdImageImportException_js_1 = require("./exceptions/ContainerdImageImportException.js");
+const ContainerdImageExportException_js_1 = require("./exceptions/ContainerdImageExportException.js");
+const ContainerdContainerNotFoundException_js_1 = require("./exceptions/ContainerdContainerNotFoundException.js");
+const ContainerdNetworkNotFoundException_js_1 = require("./exceptions/ContainerdNetworkNotFoundException.js");
+const ContainerdNetworkConflictException_js_1 = require("./exceptions/ContainerdNetworkConflictException.js");
+const NetworkCreateOptions_js_1 = require("./options/network/NetworkCreateOptions.js");
+const ImageBuildOptions_js_1 = require("./options/image/ImageBuildOptions.js");
+const ContainerdImageBuildException_js_1 = require("./exceptions/ContainerdImageBuildException.js");
+/**
+ * The containerd component: manages the images, containers, CNI networks and volumes of one containerd namespace by
+ * talking to containerd's gRPC socket directly, without a Docker daemon and without nerdctl. Use it on the Linux machines
+ * running containerd alone (embedded devices, servers without Docker); the application needs access to the socket (root,
+ * or a member of the group owning it). Register it in the `components` of an application (`{class: Containerd, ...}`)
+ * and get it with `getObject()` or `@Inject`; it is a singleton.
+ *
+ * Its API follows the Docker component's (`pullImage`, `createContainer`, `container.exec()`…). The containers it creates
+ * are nerdctl's: they carry nerdctl's labels (`nerdctl/name`…), so `nerdctl ps` lists them; containerd's shim writes
+ * their output to a log file and containerd's restart monitor applies their restart policy, also while the application
+ * is not running. The component pulls, pushes, imports and exports the images itself; it sends the builds to BuildKit
+ * (a local or remote `buildkitd`).
+ *
+ * The component connects when it is created: it fails with {@link ContainerdConnectionException} when containerd does
+ * not answer on `socketPath` (or `buildkitTLS` is given with a unix socket), and it creates its namespace when the
+ * namespace does not exist. BuildKit is only reached by
+ * the builds. When the component is destroyed, it ends its event streams, aborts its pulls, pushes and builds in
+ * progress, and closes its connections.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {Containerd, type ContainerdContainer, type ContainerdExecResult, type ContainerdImage} from 'lakutata/com/containerd'
+ *
+ * Application
+ *     .run(() => ({
+ *         id: 'device.app',
+ *         name: 'Device',
+ *         components: {
+ *             containerd: {
+ *                 class: Containerd,
+ *                 socketPath: '/run/containerd/containerd.sock',
+ *                 namespace: 'default',
+ *                 registryAuths: {'registry.example.com': {username: 'deploy', password: 'secret'}}
+ *             }
+ *         },
+ *         bootstrap: ['containerd']
+ *     }))
+ *     .onLaunched(async (app: Application): Promise<void> => {
+ *         const containerd: Containerd = await app.getObject('containerd')
+ *         //Pulled for the machine's platform, unpacked into the snapshotter
+ *         const image: ContainerdImage = await containerd.pullImage({image: 'alpine:3.20'})
+ *         const container: ContainerdContainer = await containerd.createContainer({
+ *             image: image.name,
+ *             name: 'worker',
+ *             cmd: ['sleep', 'infinity'],
+ *             //Restarted by containerd, even when the application is not running
+ *             restartPolicy: 'always'
+ *         })
+ *         await container.start()
+ *         const result: ContainerdExecResult = await container.exec({cmd: 'cat /etc/os-release'})
+ *         console.log(result.exitCode, result.stdout)
+ *     })
+ * ```
+ */
+let Containerd = class Containerd extends core_1.Component {
+    #client;
+    #images;
+    #containers;
+    #networks;
+    #buildkit;
+    #platforms;
+    #abortController = new AbortController();
+    /**
+     * Connect to containerd and create the namespace when it does not exist.
+     * @throws {ContainerdConnectionException} containerd does not answer on `socketPath` (not running, no access to the
+     * socket), or `buildkitTLS` is given with a unix socket `buildkitAddress`.
+     * @protected
+     */
+    async init() {
+        await Promise.all([
+            this.container.register(ContainerdImage_js_1.ContainerdImage),
+            this.container.register(ContainerdContainer_js_1.ContainerdContainer),
+            this.container.register(ContainerdContainerTTY_js_1.ContainerdContainerTTY)
+        ]);
+        //Not connected until a build: its options checked
+        try {
+            this.#buildkit = new grpc_1.GRPCConnection(this.buildkitAddress, this.buildkitTLS);
+        }
+        catch (e) {
+            throw new ContainerdConnectionException_js_1.ContainerdConnectionException(`Cannot connect to BuildKit (${this.buildkitAddress}): ${e.message}`);
+        }
+        this.#client = new ContainerdClient_js_1.ContainerdClient(this.socketPath, this.namespace);
+        try {
+            await this.#client.version();
+            await this.#client.ensureNamespace();
+        }
+        catch (e) {
+            throw new ContainerdConnectionException_js_1.ContainerdConnectionException(`Cannot connect to containerd (${this.socketPath}): ${e.message}`);
+        }
+        //The platforms of the machine unpacked by the pulls and the imports
+        this.#images = new ImageStore_js_1.ImageStore(this.#client, this.snapshotter, node_path_1.default.join(this.dataRoot, 'tmp'), () => this.#platforms.map(Platforms_js_1.parsePlatform));
+        this.#networks = new Networks_js_1.NetworkStore(this.cniConfigPath, this.cniPath);
+        this.#containers = new ContainerStore_js_1.ContainerStore(this.#client, this.#images, this.#networks, {
+            snapshotter: this.snapshotter,
+            runtime: this.runtime,
+            cgroupManager: this.cgroupManager,
+            dataRoot: this.dataRoot,
+            logMaxSize: this.logMaxSize
+        });
+        this.#platforms = (0, Platforms_js_1.supportedPlatforms)().map(Platforms_js_1.formatPlatform);
+    }
+    /**
+     * End the event streams, abort the pulls, pushes and builds in progress, and close the connections to containerd and
+     * BuildKit. The containers keep running.
+     * @protected
+     */
+    async destroy() {
+        this.#abortController.abort();
+        this.#client?.close();
+        this.#buildkit?.close();
+    }
+    /**
+     * Build the registry options of a pull, a push or a build: the configured credentials (`auth` replacing the ones of
+     * the reference's registry), the insecure registries, and the component's abort signal.
+     * @param reference The image reference whose registry gets `auth` (`registry.example.com/team/app:1.0`).
+     * @param auth The credentials of the reference's registry; ignored without `reference`.
+     * @returns The registry options.
+     * @protected
+     */
+    registryOptions(reference, auth) {
+        const credentials = { ...this.registryAuths ?? {} };
+        if (reference && auth)
+            credentials[(0, Reference_js_1.parseReference)(reference).registry] = auth;
+        return { credentials: credentials, insecure: this.insecureRegistries ?? [], signal: this.#abortController.signal };
+    }
+    /** Containerd Common Operations **/
+    /**
+     * Get the version of containerd.
+     * @returns Its version (`1.7.36`, `v2.4.1`) and its git revision.
+     * @throws {GRPCError} containerd no longer answers (from `@lakutata/grpc`).
+     */
+    async version() {
+        return await this.#client.version();
+    }
+    /**
+     * List the platforms this machine runs containers of: its own, and the ones of the emulators registered in
+     * `binfmt_misc` (QEMU, Rosetta), as detected when the component was created or by
+     * {@link Containerd.detectPlatforms}. An image is described for the first of its platforms in this list.
+     * @returns A copy of the list, formatted `os/architecture[/variant]` (`linux/arm64/v8`, `linux/amd64`).
+     */
+    supportedPlatforms() {
+        return [...this.#platforms];
+    }
+    /**
+     * Detect again the platforms this machine runs, after emulators were registered or removed in `binfmt_misc`.
+     * @returns The platforms detected, as {@link Containerd.supportedPlatforms} returns them from now on.
+     */
+    detectPlatforms() {
+        this.#platforms = (0, Platforms_js_1.supportedPlatforms)().map(Platforms_js_1.formatPlatform);
+        return this.supportedPlatforms();
+    }
+    /**
+     * Stream containerd's events in the component's namespace (`/tasks/exit`, `/containers/create`, `/images/delete`…)
+     * as they happen. The stream ends without an error when `signal` aborts or when the component is destroyed. The
+     * fields of the task, container, image and snapshot events are decoded; the other events have an empty `event`.
+     * @param signal Ends the stream when aborted; without it, the stream lasts as long as the component.
+     * @returns The events, in their order.
+     * @throws {GRPCError} The connection to containerd fails or is lost (from `@lakutata/grpc`).
+     */
+    async *events(signal) {
+        const abort = signal ? AbortSignal.any([signal, this.#abortController.signal]) : this.#abortController.signal;
+        yield* this.#client.subscribe([`namespace==${this.namespace}`], abort);
+    }
+    /** Containerd Image Operations **/
+    /**
+     * List the images of the namespace, each one described as {@link Containerd.getImage} does. The images whose content
+     * is not complete (a pull in progress, content collected) or that have none of their platforms' content are left
+     * out.
+     * @returns The images.
+     */
+    async listImages() {
+        const images = await this.#client.listImages();
+        const result = [];
+        for (const image of images) {
+            try {
+                result.push(await this.getImage(image.name));
+            }
+            catch (error) {
+                //An image whose content is not complete (pulled meanwhile, collected)
+                if (!(error instanceof ContainerdImageNotFoundException_js_1.ContainerdImageNotFoundException) && error.errno !== 'E_CONTAINERD_PLATFORM')
+                    throw error;
+            }
+        }
+        return result;
+    }
+    /**
+     * Get an image present in containerd; it is not pulled. The image is described for the first platform it has among
+     * {@link Containerd.supportedPlatforms}, or for the first platform it has.
+     * @param name Its name or a reference, normalized as Docker does (`alpine` is `docker.io/library/alpine:latest`).
+     * @returns The image.
+     * @throws {ContainerdImageNotFoundException} No image has this name.
+     * @throws {ContainerdPlatformException} The content of none of its platforms is present.
+     */
+    async getImage(name) {
+        return await this.getObject(ContainerdImage_js_1.ContainerdImage, {
+            getStore: () => this.#images,
+            getContainerd: () => this,
+            getRegistryOptions: () => this.registryOptions(),
+            name: name
+        });
+    }
+    /**
+     * Pull an image from its registry: the manifests of the platforms asked, their configurations and layers, then
+     * unpack the ones the machine runs ({@link Containerd.supportedPlatforms}) into the snapshotter so that containers
+     * can run them; the other platforms are only stored. The image is named by its normalized reference
+     * (`docker.io/library/alpine:3.20`); an image of the same name is replaced. The pull is aborted when the component
+     * is destroyed.
+     * @param options The reference, the platforms (the machine's by default, `'all'` for every one), the registry
+     * credentials (`auth`, else the `registryAuths` of its registry), `unpack` and the progress callback.
+     * @returns The image pulled.
+     * @throws {ContainerdPlatformException} The image has no manifest for one of the platforms asked.
+     * @throws {ContainerdImagePullException} The registry cannot be reached, refuses the credentials, or does not have
+     * the reference; the transfer fails or is aborted; the unpacking fails (the image is stored).
+     */
+    async pullImage(options) {
+        let platforms;
+        if (options.platform === 'all' || (Array.isArray(options.platform) && options.platform.includes('all')))
+            platforms = 'all';
+        else if (options.platform)
+            platforms = (Array.isArray(options.platform) ? options.platform : [options.platform]).map(Platforms_js_1.parsePlatform);
+        let name;
+        try {
+            name = await this.#images.pull(options.image, {
+                platforms: platforms,
+                registry: this.registryOptions(options.image, options.auth),
+                unpack: options.unpack,
+                progress: options.progressCallback
+            });
+        }
+        catch (error) {
+            throw (0, ContainerdErrors_js_1.containerdError)(error, ContainerdImagePullException_js_1.ContainerdImagePullException);
+        }
+        return await this.getImage(name);
+    }
+    /**
+     * Get the version of the BuildKit daemon at `buildkitAddress`.
+     * @returns Its package (`github.com/moby/buildkit`), version and revision.
+     * @throws {ContainerdImageBuildException} BuildKit cannot be reached.
+     */
+    async buildkitVersion() {
+        try {
+            return await (0, BuildKit_js_1.buildKitVersion)(this.#buildkit);
+        }
+        catch (error) {
+            throw new ContainerdImageBuildException_js_1.ContainerdImageBuildException(`Cannot connect to BuildKit (${this.buildkitAddress}): ${error.message}`);
+        }
+    }
+    /**
+     * List the platforms the BuildKit daemon builds for: the ones of its workers, including the emulators of its own
+     * machine.
+     * @returns The platforms, formatted `os/architecture[/variant]`.
+     * @throws {ContainerdImageBuildException} BuildKit cannot be reached.
+     */
+    async buildkitPlatforms() {
+        try {
+            return (await (0, BuildKit_js_1.buildKitPlatforms)(this.#buildkit)).map(Platforms_js_1.formatPlatform);
+        }
+        catch (error) {
+            throw new ContainerdImageBuildException_js_1.ContainerdImageBuildException(`Cannot connect to BuildKit (${this.buildkitAddress}): ${error.message}`);
+        }
+    }
+    /**
+     * Build an image with BuildKit (the local or remote daemon at `buildkitAddress`), as `docker buildx build` does: the
+     * build context (without the files its `.dockerignore` excludes) and the Dockerfile are sent over a BuildKit session,
+     * then the image built is imported into containerd, named by `repoTag`, and pushed when `push` is set. The base
+     * images are pulled by BuildKit with the component's registry credentials (or `auth`). The build is aborted when the
+     * component is destroyed.
+     * @param options The context directory, the Dockerfile, the name, the platforms (the machine's by default), the build
+     * arguments, labels and target, `nocache`, `pull`, `push`, the credentials and the output callback.
+     * @returns The image built.
+     * @throws {ContainerdImageBuildException} BuildKit cannot be reached, the build fails, or its import fails.
+     * @throws {ContainerdImagePushException} With `push`, the push fails; the image is built and imported.
+     */
+    async buildImage(options) {
+        const name = (0, Reference_js_1.parseReference)(options.repoTag).name;
+        const platforms = options.platform ? (Array.isArray(options.platform) ? options.platform : [options.platform]).map(Platforms_js_1.parsePlatform) : [(0, Platforms_js_1.hostPlatform)()];
+        const temporary = node_path_1.default.join(this.dataRoot, 'tmp');
+        await (0, promises_1.mkdir)(temporary, { recursive: true });
+        const archive = node_path_1.default.join(temporary, `lakutata-build-${(0, node_crypto_1.randomBytes)(8).toString('hex')}.tar`);
+        const registry = this.registryOptions(options.repoTag, options.auth);
+        try {
+            await (0, BuildKit_js_1.buildKitBuild)(this.#buildkit, {
+                context: options.workdir,
+                dockerfile: options.dockerfile,
+                target: options.target || undefined,
+                buildArgs: options.buildargs,
+                labels: options.labels,
+                platforms: platforms,
+                noCache: options.nocache,
+                pull: options.pull,
+                name: name,
+                output: archive,
+                credentials: (host) => registry.credentials?.[host],
+                progress: options.outputCallback,
+                signal: this.#abortController.signal
+            });
+            await this.#images.import(archive, { name: name });
+        }
+        catch (error) {
+            throw new ContainerdImageBuildException_js_1.ContainerdImageBuildException(error.message);
+        }
+        finally {
+            await (0, promises_1.rm)(archive, { force: true });
+        }
+        const image = await this.getImage(name);
+        if (options.push)
+            await image.push({ auth: options.auth });
+        return image;
+    }
+    /**
+     * Import the images of an archive: an OCI image layout (`nerdctl save`, `docker save` of Docker 25+, the archives of
+     * {@link Containerd.exportImages}) or an older `docker save` archive. The images are named as the archive names
+     * them (or by `name`, for an archive of one image), replace the images of the same names, and the platforms the
+     * machine runs ({@link Containerd.supportedPlatforms}) are unpacked unless `unpack: false`. The images of an OCI
+     * layout without a name annotation are not imported unless `name` is given.
+     * @param options The archive (a file path or a readable stream), the name to give, and `unpack`.
+     * @returns The images imported.
+     * @throws {ContainerdImageImportException} The archive cannot be read or is not an image archive; `name` is given
+     * with an archive of several images (nothing is imported); the unpacking fails (the images are stored and named).
+     */
+    async importImage(options) {
+        let names;
+        try {
+            names = await this.#images.import(options.source, { name: options.name, unpack: options.unpack });
+        }
+        catch (error) {
+            throw (0, ContainerdErrors_js_1.containerdError)(error, ContainerdImageImportException_js_1.ContainerdImageImportException);
+        }
+        return await Promise.all(names.map((name) => this.getImage(name)));
+    }
+    /**
+     * Export images into one archive: an OCI image layout with the `manifest.json` of `docker load`, loaded by
+     * `docker load`, `nerdctl load` and {@link Containerd.importImage}. The archive has the platforms each image has in
+     * containerd.
+     * @param names The names or references of the images (one at least).
+     * @param options The destination: a file path (created or replaced) or a writable stream.
+     * @throws {ContainerdImageNotFoundException} One of the images does not exist.
+     * @throws {ContainerdImageExportException} The archive cannot be written.
+     */
+    async exportImages(names, options) {
+        try {
+            await this.#images.export(names, options.destination);
+        }
+        catch (error) {
+            throw (0, ContainerdErrors_js_1.containerdError)(error, ContainerdImageExportException_js_1.ContainerdImageExportException);
+        }
+    }
+    /** Containerd Network Operations **/
+    /**
+     * Describe a CNI network.
+     * @param network The network, as read from its configuration file.
+     * @returns Its information.
+     * @protected
+     */
+    networkInfo(network) {
+        const main = network.plugins[0] ?? {};
+        return {
+            id: network.id,
+            name: network.name,
+            driver: network.driver,
+            reserved: !network.managed || network.labels['nerdctl/default-network'] === 'true',
+            internal: network.driver === 'bridge' && main.isGateway === false && main.ipMasq === false,
+            enableIPv6: network.subnets.some((subnet) => subnet.includes(':')),
+            subnets: network.subnets,
+            gateways: network.gateways,
+            labels: network.labels,
+            file: network.file
+        };
+    }
+    /**
+     * List the networks: `host` and `none`, then the CNI networks of `cniConfigPath`, among them nerdctl's default
+     * `bridge` once it exists (it is created when a container or {@link Containerd.getNetwork} first asks for it).
+     * @returns The networks.
+     */
+    async listNetworks() {
+        const system = ['host', 'none'].map((name) => ({ id: name, name: name, driver: name, reserved: true, internal: name === 'none', enableIPv6: false, subnets: [], gateways: [], labels: {} }));
+        return [...system, ...(await this.#networks.list()).map((network) => this.networkInfo(network))];
+    }
+    /**
+     * Get a network. Asking for `bridge` creates nerdctl's default network when it does not exist.
+     * @param nameOrId Its name, its identifier, or a prefix of its identifier (3 characters at least).
+     * @returns The network.
+     * @throws {ContainerdNetworkNotFoundException} No network matches.
+     */
+    async getNetwork(nameOrId) {
+        if (nameOrId === 'host' || nameOrId === 'none')
+            return (await this.listNetworks()).find((network) => network.name === nameOrId);
+        const network = await this.#networks.get(nameOrId);
+        if (!network)
+            throw new ContainerdNetworkNotFoundException_js_1.ContainerdNetworkNotFoundException(`The network ${nameOrId} does not exist`);
+        return this.networkInfo(network);
+    }
+    /**
+     * Create a CNI network as `nerdctl network create` does: its configuration `nerdctl-<name>.conflist` written in
+     * `cniConfigPath`, so nerdctl sees it. Its bridge and firewall rules are set up when the first container joins it.
+     * @param options Its name, driver (`bridge`, `macvlan`, `ipvlan`), IPv4 subnet (a free one of `10.4.0.0/16` by
+     * default), gateway and range, IPv6 subnet, parent interface, `internal`, MTU and labels.
+     * @returns The network created.
+     * @throws {ContainerdNetworkConflictException} The name is taken (`host`, `none` and `bridge` included), or the subnet
+     * overlaps another network's.
+     */
+    async createNetwork(options) {
+        try {
+            return this.networkInfo(await this.#networks.create(options));
+        }
+        catch (error) {
+            if (error.code === 'CONFLICT')
+                throw new ContainerdNetworkConflictException_js_1.ContainerdNetworkConflictException(error.message);
+            throw error;
+        }
+    }
+    /**
+     * Remove a CNI network created by nerdctl or by the component, as `nerdctl network rm` does: its configuration, its
+     * bridge and the leases of its addresses.
+     * @param nameOrId Its name, its identifier, or a prefix of its identifier.
+     * @throws {ContainerdNetworkNotFoundException} No network matches (`host` and `none` included).
+     * @throws {ContainerdNetworkConflictException} A container of the namespace uses it, it is the default `bridge`, or
+     * it was not created by nerdctl (its configuration is left to remove by hand).
+     */
+    async removeNetwork(nameOrId) {
+        const network = nameOrId === Networks_js_1.DEFAULT_NETWORK ? (await this.#networks.list()).find((item) => item.name === nameOrId) : await this.#networks.get(nameOrId);
+        if (!network)
+            throw new ContainerdNetworkNotFoundException_js_1.ContainerdNetworkNotFoundException(`The network ${nameOrId} does not exist`);
+        const users = (await this.#containers.list())
+            .filter((record) => {
+            try {
+                return JSON.parse(record.labels?.['nerdctl/networks'] ?? '[]').includes(network.name);
+            }
+            catch {
+                return false;
+            }
+        })
+            .map((record) => ContainerStore_js_1.ContainerStore.Name(record));
+        if (users.length)
+            throw new ContainerdNetworkConflictException_js_1.ContainerdNetworkConflictException(`The network ${network.name} is used by the containers ${users.join(', ')}`);
+        try {
+            await this.#networks.remove(network);
+        }
+        catch (error) {
+            throw new ContainerdNetworkConflictException_js_1.ContainerdNetworkConflictException(error.message);
+        }
+    }
+    /** Containerd Container Operations **/
+    /**
+     * List the containers of the namespace, running or not, the ones created by nerdctl included.
+     * @param labels Only the containers having all these labels with these values (`{app: 'web'}`); all of them by
+     * default.
+     * @returns The containers.
+     */
+    async listContainers(labels) {
+        const filters = labels && Object.keys(labels).length ? [Object.entries(labels).map(([key, value]) => `labels."${key}"==${value}`).join(',')] : [];
+        const records = await this.#containers.list(filters);
+        const result = [];
+        for (const record of records) {
+            try {
+                result.push(await this.getContainer(record.id));
+            }
+            catch (error) {
+                //Removed meanwhile
+                if (!(error instanceof ContainerdContainerNotFoundException_js_1.ContainerdContainerNotFoundException))
+                    throw error;
+            }
+        }
+        return result;
+    }
+    /**
+     * Get a container.
+     * @param idOrName Its identifier, its name, or a prefix of its identifier (3 hexadecimal characters at least).
+     * @returns The container, its information read from containerd.
+     * @throws {ContainerdContainerNotFoundException} No container matches.
+     * @throws {Error} The prefix matches several containers.
+     */
+    async getContainer(idOrName) {
+        return await this.getObject(ContainerdContainer_js_1.ContainerdContainer, {
+            getStore: () => this.#containers,
+            getClient: () => this.#client,
+            getContainerd: () => this,
+            id: idOrName
+        });
+    }
+    /**
+     * Create a container of an image present in containerd (it is not pulled): its snapshot, its OCI specification and
+     * its state directory (log file, `hosts`, `resolv.conf`, `hostname`). The container is not started. It joins the
+     * default CNI network `bridge` by default (created when first used, the CNI plugins needed), as with Docker; `network:
+     * 'host'` gives it the host's network. Its `ports` are published on its first CNI network. Its system calls are filtered by containerd's default seccomp profile, unless it is privileged or
+     * `seccompProfile` says otherwise. The settings are kept so that {@link ContainerdContainer.update} can create it
+     * again.
+     * @param options The image and the container's settings (name, command, environment, user, mounts, devices,
+     * networks, ports, resources, restart policy…).
+     * @returns The container created.
+     * @throws {ContainerdImageNotFoundException} The image does not exist.
+     * @throws {ContainerdPlatformException} The image has no manifest for the platform asked (the machine's by default).
+     * @throws {ContainerdContainerNameConflictException} Another container has the name.
+     * @throws {ContainerdNetworkNotFoundException} One of the CNI networks does not exist.
+     * @throws {Error} The settings cannot be applied: ports without a CNI network, no command, no CNI plugin installed, a
+     * device or a seccomp profile file that cannot be read.
+     */
+    async createContainer(options) {
+        const mounts = [
+            ...(options.binds ?? []).map((bind) => ({ type: 'bind', source: bind.hostPath, target: bind.containerPath, readonly: bind.rw === false, options: bind.propagation ? [bind.propagation] : undefined })),
+            ...(options.tmpfs ?? []).map((tmpfs) => ({ type: 'tmpfs', target: tmpfs.containerPath, options: [...tmpfs.size ? [`size=${tmpfs.size}`] : [], ...tmpfs.mode ? [`mode=${tmpfs.mode}`] : []] })),
+            ...(options.volumes ?? []).map((volume) => ({ type: 'volume', source: volume.volumeName, target: volume.containerPath, readonly: volume.readonly }))
+        ];
+        const ports = (options.ports ?? []).flatMap((port) => port.hostPorts.map((hostPort) => ({ hostPort: hostPort, containerPort: port.port, protocol: port.type ?? 'tcp', hostIP: port.hostIP })));
+        let record;
+        try {
+            record = await this.#containers.create({
+                image: options.image,
+                platform: options.platform ? (0, Platforms_js_1.parsePlatform)(options.platform) : undefined,
+                name: options.name,
+                hostname: options.hostname,
+                cmd: options.cmd,
+                entrypoint: options.entrypoint,
+                env: options.env,
+                workingDir: options.workingDir,
+                user: options.user,
+                labels: options.labels,
+                privileged: options.privileged,
+                readonlyRootfs: options.readonlyRootfs,
+                capAdd: options.capabilities,
+                capDrop: options.capabilitiesDrop,
+                seccompProfile: options.seccompProfile,
+                mounts: mounts,
+                devices: (options.devices ?? []).map(device => ({ hostPath: device.hostPath, containerPath: device.containerPath, permissions: device.cgroupPermissions })),
+                deviceCgroupRules: options.deviceCgroupRules,
+                //Without network: the default CNI network bridge, as Docker and nerdctl
+                network: options.networks?.length
+                    ? options.networks.map((network) => ({ name: network.networkName, ip: network.ip || undefined, ipv6: network.ipv6 || undefined }))
+                    : options.network ?? [{ name: Networks_js_1.DEFAULT_NETWORK }],
+                ports: ports,
+                pidHost: options.pidMode === 'host',
+                ipcHost: options.ipcMode === 'host',
+                cgroupns: options.cgroupns,
+                memory: options.memoryLimit || undefined,
+                memorySwap: options.memorySwap,
+                cpus: options.cpus,
+                cpuShares: options.cpuShares,
+                cpuset: options.cpuSet?.length ? options.cpuSet.join(',') : undefined,
+                pidsLimit: options.pidsLimit,
+                oomKillDisable: options.OOMKillDisable,
+                sysctls: options.sysctls,
+                shmSize: options.shmSize,
+                restart: options.restartPolicy || undefined,
+                stopSignal: options.stopSignal,
+                extraHosts: options.extraHosts,
+                dns: options.dns
+            });
+        }
+        catch (error) {
+            throw (0, ContainerdErrors_js_1.containerdError)(error);
+        }
+        //Its settings: the ones it is created again with by its update
+        await this.#containers.writeSettings(record.id, Object.fromEntries(Object.entries(options).filter(([, value]) => value !== undefined && typeof value !== 'function')));
+        return await this.getContainer(record.id);
+    }
+    /**
+     * Replace a container by a new one created with other settings, as {@link ContainerdContainer.update} does: the old
+     * container is renamed, the new one created with `options`, then the old one removed by force, and the new one
+     * started when the old one was running or paused. When the creation fails, the old container gets its name back
+     * and keeps running.
+     * @param record The containerd record of the container to replace.
+     * @param options The complete settings of the new container.
+     * @returns The new container.
+     * @throws {ContainerdContainerNotFoundException} The container no longer exists.
+     * @throws {ContainerdImageNotFoundException} From the creation, as {@link Containerd.createContainer} throws.
+     */
+    async recreateContainer(record, options) {
+        const old = await this.getContainer(record.id);
+        const running = old.state.running || old.state.paused;
+        const name = old.name;
+        await this.#containers.rename(record, `${name}-replaced-${(0, node_crypto_1.randomBytes)(4).toString('hex')}`);
+        let created;
+        try {
+            created = await this.createContainer(options);
+        }
+        catch (error) {
+            await this.#containers.rename((await this.#containers.find(record.id)), name).catch(() => undefined);
+            throw error;
+        }
+        await old.remove({ force: true });
+        if (running)
+            await created.start();
+        return created;
+    }
+    /** Containerd Volume Operations **/
+    /**
+     * Describe a named volume.
+     * @param volume The volume, as read from its directory.
+     * @returns Its information.
+     * @protected
+     */
+    volumeInfo(volume) {
+        return { name: volume.name, mountpoint: volume.mountpoint, labels: volume.labels, createdAt: new Time_1.Time(volume.createdAt) };
+    }
+    /**
+     * The store of the namespace's named volumes, under `<dataRoot>/volumes/<namespace>`.
+     * @protected
+     */
+    get volumes() {
+        return this.#containers.volumes;
+    }
+    /**
+     * List the containers mounting a volume, running or not.
+     * @param name The volume's name.
+     * @returns The names of the containers.
+     * @protected
+     */
+    async volumeUsers(name) {
+        return (await this.#containers.list())
+            .filter((record) => ContainerStore_js_1.ContainerStore.Volumes(record).includes(name))
+            .map((record) => ContainerStore_js_1.ContainerStore.Name(record));
+    }
+    /**
+     * List the named volumes of the namespace, sorted by name.
+     * @returns The volumes.
+     */
+    async listVolumes() {
+        return (await this.volumes.list()).map((volume) => this.volumeInfo(volume));
+    }
+    /**
+     * Get a named volume.
+     * @param name The volume's name.
+     * @returns The volume: its host directory (`mountpoint`), labels and creation time.
+     * @throws {ContainerdVolumeNotFoundException} The volume does not exist, or the name is not a valid one.
+     */
+    async getVolume(name) {
+        const volume = Volumes_js_1.VolumeStore.ValidName(name) ? await this.volumes.get(name) : undefined;
+        if (!volume)
+            throw new ContainerdVolumeNotFoundException_js_1.ContainerdVolumeNotFoundException(`The volume ${name} does not exist`);
+        return this.volumeInfo(volume);
+    }
+    /**
+     * Create a named volume: a directory under `dataRoot` that containers mount by name. As Docker does, a volume that
+     * exists is returned unchanged (its labels are not updated). A container mounting a missing volume creates it too.
+     * @param options The name (letters, digits, `_`, `.` and `-`) and the labels.
+     * @returns The volume.
+     */
+    async createVolume(options) {
+        return this.volumeInfo(await this.volumes.create(options.name, options.labels ?? {}));
+    }
+    /**
+     * Remove a named volume and its data.
+     * @param name The volume's name.
+     * @throws {ContainerdVolumeNotFoundException} The volume does not exist.
+     * @throws {ContainerdVolumeInUseException} A container of the namespace mounts it, even a stopped one.
+     */
+    async removeVolume(name) {
+        await this.getVolume(name);
+        const users = await this.volumeUsers(name);
+        if (users.length)
+            throw new ContainerdVolumeInUseException_js_1.ContainerdVolumeInUseException(`The volume ${name} is used by the containers ${users.join(', ')}`);
+        await this.volumes.remove(name);
+    }
+    /** Containerd Common Operations **/
+    /**
+     * Remove the unused resources of the namespace, in this order: the containers that are not running (created or
+     * exited), the images no container uses (the dangling ones, without a tag, or all of them with `allImages`), the CNI
+     * networks no container uses (except the default `bridge` and the ones nerdctl did not create), and the volumes no
+     * container mounts. A container, image, network or volume that fails to be removed is skipped (left out of the
+     * result).
+     * @param options What to remove: `containers` and `images` by default, `allImages`, `networks` and `volumes` when
+     * set.
+     * @returns The names (identifiers of the containers) of what was removed.
+     */
+    async prune(options) {
+        if (!options)
+            return await this.prune({});
+        const result = { containers: [], images: [], networks: [], volumes: [] };
+        if (options.containers) {
+            for (const container of await this.listContainers()) {
+                if (container.state.status !== 'exited' && container.state.status !== 'created')
+                    continue;
+                await container.remove({ force: false }).then(() => result.containers.push(container.id), () => undefined);
+            }
+        }
+        const records = await this.#containers.list();
+        if (options.images || options.allImages) {
+            const used = new Set(records.map((record) => record.image));
+            for (const image of await this.#client.listImages()) {
+                if (used.has(image.name))
+                    continue;
+                const dangling = (() => {
+                    try {
+                        return !(0, Reference_js_1.parseReference)(image.name).tag;
+                    }
+                    catch {
+                        return true;
+                    }
+                })();
+                if (!options.allImages && !dangling)
+                    continue;
+                await this.#images.remove(image.name).then(() => result.images.push(image.name), () => undefined);
+            }
+        }
+        if (options.networks) {
+            const usedNetworks = new Set(records.flatMap((record) => {
+                try {
+                    return JSON.parse(record.labels?.['nerdctl/networks'] ?? '[]');
+                }
+                catch {
+                    return [];
+                }
+            }));
+            for (const network of await this.#networks.list()) {
+                if (!network.managed || network.labels['nerdctl/default-network'] === 'true' || usedNetworks.has(network.name))
+                    continue;
+                await this.#networks.remove(network).then(() => result.networks.push(network.name), () => undefined);
+            }
+        }
+        if (options.volumes) {
+            const usedVolumes = new Set(records.flatMap((record) => ContainerStore_js_1.ContainerStore.Volumes(record)));
+            for (const volume of await this.volumes.list()) {
+                if (usedVolumes.has(volume.name))
+                    continue;
+                await this.volumes.remove(volume.name).then(() => result.volumes.push(volume.name), () => undefined);
+            }
+        }
+        return result;
+    }
+};
+exports.Containerd = Containerd;
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional().default('/run/containerd/containerd.sock')),
+    __metadata("design:type", String)
+], Containerd.prototype, "socketPath", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().pattern(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/).optional().default('default')),
+    __metadata("design:type", String)
+], Containerd.prototype, "namespace", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional().default('overlayfs')),
+    __metadata("design:type", String)
+], Containerd.prototype, "snapshotter", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional().default('io.containerd.runc.v2')),
+    __metadata("design:type", String)
+], Containerd.prototype, "runtime", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().valid('cgroupfs', 'systemd').optional().default('cgroupfs')),
+    __metadata("design:type", String)
+], Containerd.prototype, "cgroupManager", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional().default('/var/lib/lakutata/containerd')),
+    __metadata("design:type", String)
+], Containerd.prototype, "dataRoot", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Number().integer().min(0).optional().default(0)),
+    __metadata("design:type", Number)
+], Containerd.prototype, "logMaxSize", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional().default('/etc/cni/net.d')),
+    __metadata("design:type", String)
+], Containerd.prototype, "cniConfigPath", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Array(core_1.DTO.String()).optional().default(['/opt/cni/bin', '/usr/lib/cni', '/usr/libexec/cni'])),
+    __metadata("design:type", Array)
+], Containerd.prototype, "cniPath", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().pattern(/^(\/|unix:\/\/\/|tcp:\/\/)/).optional().default('unix:///run/buildkit/buildkitd.sock')),
+    __metadata("design:type", String)
+], Containerd.prototype, "buildkitAddress", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Object({
+        ca: core_1.DTO.Alternatives(core_1.DTO.String(), core_1.DTO.Binary()).optional(),
+        cert: core_1.DTO.Alternatives(core_1.DTO.String(), core_1.DTO.Binary()).optional(),
+        key: core_1.DTO.Alternatives(core_1.DTO.String(), core_1.DTO.Binary()).optional(),
+        servername: core_1.DTO.String().optional()
+    }).optional()),
+    __metadata("design:type", Object)
+], Containerd.prototype, "buildkitTLS", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Object().pattern(core_1.DTO.String(), core_1.DTO.Object({
+        username: core_1.DTO.String().optional(),
+        password: core_1.DTO.String().optional(),
+        identityToken: core_1.DTO.String().optional()
+    })).optional()),
+    __metadata("design:type", Object)
+], Containerd.prototype, "registryAuths", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Array(core_1.DTO.String()).optional()),
+    __metadata("design:type", Array)
+], Containerd.prototype, "insecureRegistries", void 0);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.String().required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "getImage", null);
+__decorate([
+    (0, dto_1.Accept)(ImagePullOptions_js_1.ImagePullOptions.required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ImagePullOptions_js_1.ImagePullOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "pullImage", null);
+__decorate([
+    (0, dto_1.Accept)(ImageBuildOptions_js_1.ImageBuildOptions.required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ImageBuildOptions_js_1.ImageBuildOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "buildImage", null);
+__decorate([
+    (0, dto_1.Accept)(ImageImportOptions_js_1.ImageImportOptions.required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ImageImportOptions_js_1.ImageImportOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "importImage", null);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.Array(core_1.DTO.String()).min(1).required(), ImageExportOptions_js_1.ImageExportOptions.required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Array, ImageExportOptions_js_1.ImageExportOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "exportImages", null);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.String().required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "getNetwork", null);
+__decorate([
+    (0, dto_1.Accept)(NetworkCreateOptions_js_1.NetworkCreateOptions.required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [NetworkCreateOptions_js_1.NetworkCreateOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "createNetwork", null);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.String().required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "removeNetwork", null);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.Object().pattern(core_1.DTO.String(), core_1.DTO.String().allow('')).optional()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "listContainers", null);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.String().required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "getContainer", null);
+__decorate([
+    (0, dto_1.Accept)(ContainerCreateOptions_js_1.ContainerCreateOptions.required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ContainerCreateOptions_js_1.ContainerCreateOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "createContainer", null);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.String().required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "getVolume", null);
+__decorate([
+    (0, dto_1.Accept)(VolumeCreateOptions_js_1.VolumeCreateOptions.required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [VolumeCreateOptions_js_1.VolumeCreateOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "createVolume", null);
+__decorate([
+    (0, dto_1.Accept)(core_1.DTO.String().required()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "removeVolume", null);
+__decorate([
+    (0, dto_1.Accept)(ContainerdPruneOptions_js_1.ContainerdPruneOptions.optional()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ContainerdPruneOptions_js_1.ContainerdPruneOptions]),
+    __metadata("design:returntype", Promise)
+], Containerd.prototype, "prune", null);
+exports.Containerd = Containerd = __decorate([
+    (0, di_1.Singleton)()
+], Containerd);