@lakutata/containerd 0.0.0-stage → 3.0.0-beta.1

package/dist/cjs/containerd/options/ContainerdPruneOptions.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContainerdPruneOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+/**
+ * What {@link Containerd.prune} removes; every field is optional. A resource whose removal fails is skipped. Unlike the
+ * Docker component's options, the volumes are kept by default, and `allImages` removes the tagged images too.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * //The stopped containers and the dangling images (the defaults), and the unused volumes with their data
+ * const removed = await containerd.prune({volumes: true})
+ * console.log(removed.containers, removed.images, removed.volumes)
+ * ```
+ */
+class ContainerdPruneOptions extends core_1.DTO {
+}
+exports.ContainerdPruneOptions = ContainerdPruneOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], ContainerdPruneOptions.prototype, "containers", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], ContainerdPruneOptions.prototype, "images", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(false)),
+    __metadata("design:type", Boolean)
+], ContainerdPruneOptions.prototype, "allImages", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(false)),
+    __metadata("design:type", Boolean)
+], ContainerdPruneOptions.prototype, "networks", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(false)),
+    __metadata("design:type", Boolean)
+], ContainerdPruneOptions.prototype, "volumes", void 0);

package/dist/cjs/containerd/options/ContainerdRegistryAuthOptions.d.ts

@@ -0,0 +1,32 @@
+import { DTO } from '@lakutata/core';
+/**
+ * The credentials of a container registry, given to a pull, a push or a build (their `auth` option) for the registry
+ * of the reference they name. They replace, for that operation, the ones the component's `registryAuths` option gives
+ * that registry. Every field is optional; without `username` nor `identityToken`, the registry is accessed anonymously.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * await containerd.pullImage({
+ *     image: 'registry.example.com:5000/team/app:1.0',
+ *     auth: {username: 'ci', password: process.env.REGISTRY_TOKEN ?? ''}
+ * })
+ * ```
+ */
+export declare class ContainerdRegistryAuthOptions extends DTO {
+    /**
+     * The user name, sent with `password` (HTTP basic authentication, or the registry's token service).
+     */
+    username?: string;
+    /**
+     * The password of `username`, or an access token the registry accepts as one; ignored without `username`.
+     */
+    password?: string;
+    /**
+     * An identity token (the OAuth2 refresh token the registry issued, as `docker login` stores it), exchanged with the
+     * registry's token service for an access token instead of `username` and `password`.
+     */
+    identityToken?: string;
+}

package/dist/cjs/containerd/options/ContainerdRegistryAuthOptions.js

@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContainerdRegistryAuthOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+/**
+ * The credentials of a container registry, given to a pull, a push or a build (their `auth` option) for the registry
+ * of the reference they name. They replace, for that operation, the ones the component's `registryAuths` option gives
+ * that registry. Every field is optional; without `username` nor `identityToken`, the registry is accessed anonymously.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * await containerd.pullImage({
+ *     image: 'registry.example.com:5000/team/app:1.0',
+ *     auth: {username: 'ci', password: process.env.REGISTRY_TOKEN ?? ''}
+ * })
+ * ```
+ */
+class ContainerdRegistryAuthOptions extends core_1.DTO {
+}
+exports.ContainerdRegistryAuthOptions = ContainerdRegistryAuthOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ContainerdRegistryAuthOptions.prototype, "username", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ContainerdRegistryAuthOptions.prototype, "password", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ContainerdRegistryAuthOptions.prototype, "identityToken", void 0);

package/dist/cjs/containerd/options/container/ContainerCommitOptions.d.ts

@@ -0,0 +1,57 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link ContainerdContainer.commit} saves a container's file system changes as a new image: one layer on its
+ * image, for the container's platform, with the image configuration changed as asked; the image is unpacked so it can
+ * run at once. Every field is optional. Unlike the Docker component's options, the image configuration can be changed
+ * and the commit commented, and an image committed without `repoTag` is still named.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('builder')
+ * const image = await container.commit({
+ *     repoTag: 'registry.example.com/app:1.1',
+ *     changes: {cmd: ['node', 'server.js'], env: {NODE_ENV: 'production'}, exposedPorts: ['3000/tcp']},
+ *     comment: 'Dependencies installed',
+ *     author: 'CI <ci@example.com>'
+ * })
+ * console.log(image.name, image.digest)
+ * ```
+ */
+export declare class ContainerCommitOptions extends DTO {
+    /**
+     * The name of the new image (`'app:1.1'`, normalized to `'docker.io/library/app:1.1'`). By default, the
+     * container's image repository with the tag `commit-<milliseconds since the epoch>`.
+     */
+    repoTag?: string;
+    /**
+     * Pause a running container while its changes are read, so that they are consistent; it is resumed after, even on
+     * a failure.
+     * @default true
+     */
+    pauseBeforeCommitting?: boolean;
+    /**
+     * The changes of the new image's configuration, every field optional: `cmd` and `entrypoint` replace the image's
+     * ones; `env` adds variables (replacing them by name); `workingDir` and `user` replace the image's ones; `labels`
+     * are added; `exposedPorts` adds ports as `"8080"` (TCP) or `"8080/udp"` (`tcp`, `udp` or `sctp`).
+     */
+    changes?: {
+        cmd?: string[];
+        entrypoint?: string[];
+        env?: Record<string, string>;
+        workingDir?: string;
+        user?: string;
+        labels?: Record<string, string>;
+        exposedPorts?: string[];
+    };
+    /**
+     * The comment of the commit, written to the image history.
+     */
+    comment?: string;
+    /**
+     * The author of the commit (`'Name <email>'`), written to the image configuration and its history.
+     */
+    author?: string;
+}

package/dist/cjs/containerd/options/container/ContainerCommitOptions.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContainerCommitOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+/**
+ * How {@link ContainerdContainer.commit} saves a container's file system changes as a new image: one layer on its
+ * image, for the container's platform, with the image configuration changed as asked; the image is unpacked so it can
+ * run at once. Every field is optional. Unlike the Docker component's options, the image configuration can be changed
+ * and the commit commented, and an image committed without `repoTag` is still named.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('builder')
+ * const image = await container.commit({
+ *     repoTag: 'registry.example.com/app:1.1',
+ *     changes: {cmd: ['node', 'server.js'], env: {NODE_ENV: 'production'}, exposedPorts: ['3000/tcp']},
+ *     comment: 'Dependencies installed',
+ *     author: 'CI <ci@example.com>'
+ * })
+ * console.log(image.name, image.digest)
+ * ```
+ */
+class ContainerCommitOptions extends core_1.DTO {
+}
+exports.ContainerCommitOptions = ContainerCommitOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ContainerCommitOptions.prototype, "repoTag", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], ContainerCommitOptions.prototype, "pauseBeforeCommitting", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Object({
+        cmd: core_1.DTO.Array(core_1.DTO.String()).optional(),
+        entrypoint: core_1.DTO.Array(core_1.DTO.String()).optional(),
+        env: core_1.DTO.Object().pattern(core_1.DTO.String(), core_1.DTO.String().allow('')).optional(),
+        workingDir: core_1.DTO.String().optional(),
+        user: core_1.DTO.String().optional(),
+        labels: core_1.DTO.Object().pattern(core_1.DTO.String(), core_1.DTO.String().allow('')).optional(),
+        exposedPorts: core_1.DTO.Array(core_1.DTO.String().pattern(/^\d+(\/(tcp|udp|sctp))?$/)).optional()
+    }).optional()),
+    __metadata("design:type", Object)
+], ContainerCommitOptions.prototype, "changes", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ContainerCommitOptions.prototype, "comment", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ContainerCommitOptions.prototype, "author", void 0);

package/dist/cjs/containerd/options/container/ContainerCreateOptions.d.ts

@@ -0,0 +1,273 @@
+import { DTO } from '@lakutata/core';
+import type { ContainerdRestartPolicy } from '../../types/ContainerdRestartPolicy.js';
+import type { ContainerdBind } from '../../types/ContainerdBind.js';
+import type { ContainerdDevice } from '../../types/ContainerdDevice.js';
+import type { ContainerdTmpfs } from '../../types/ContainerdTmpfs.js';
+import type { ContainerdVolume } from '../../types/ContainerdVolume.js';
+/**
+ * The settings of a container created by {@link Containerd.createContainer}: its image, its process, its mounts, its
+ * networks, its resources and its security. Only `image` is required; the container is created stopped (`start()` it)
+ * as a nerdctl container (`nerdctl ps` lists it), with an OCI runtime specification built as nerdctl builds it. The
+ * component keeps these settings: {@link ContainerdContainer.update} creates the container again with the ones it
+ * changes.
+ *
+ * As with the Docker component, the container joins the default network `bridge` unless `network` or `networks` is
+ * given (here a CNI network, the CNI plugins needed); its ports are published only on a CNI network, and its named volumes are directories the component keeps (not Docker's nor
+ * nerdctl's volumes).
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * await containerd.pullImage({image: 'nginx:1.27'})
+ * const container = await containerd.createContainer({
+ *     image: 'nginx:1.27',
+ *     name: 'web',
+ *     env: {NGINX_PORT: '80'},
+ *     binds: [{hostPath: '/srv/www', containerPath: '/usr/share/nginx/html', rw: false}],
+ *     volumes: [{volumeName: 'web-cache', containerPath: '/var/cache/nginx'}],
+ *     //The default nerdctl network, its port 80 published on the host port 8080
+ *     networks: [{networkName: 'bridge'}],
+ *     ports: [{port: 80, hostPorts: [8080]}],
+ *     memoryLimit: 256 * 1024 * 1024,
+ *     cpus: 0.5,
+ *     restartPolicy: 'unless-stopped'
+ * })
+ * await container.start()
+ * ```
+ */
+export declare class ContainerCreateOptions extends DTO {
+    /**
+     * The image of the container: its name or a reference (`'alpine:3.20'`, `'docker.io/library/alpine:3.20'`,
+     * `'registry.example.com/app@sha256:…'`). Required. The image must be in containerd already (pull, import or build
+     * it first): a missing one throws {@link ContainerdImageNotFoundException}.
+     */
+    image: string;
+    /**
+     * The platform of the image run (`'linux/amd64'`, `'linux/arm/v7'`, or `'arm64'` for `linux/arm64`), pulled
+     * beforehand; another architecture than the machine's needs a QEMU emulator registered in binfmt_misc
+     * ({@link Containerd.supportedPlatforms}). The machine's platform by default; an image without it throws
+     * {@link ContainerdPlatformException}.
+     */
+    platform?: string;
+    /**
+     * The name of the container, matching `[a-zA-Z0-9][a-zA-Z0-9_.-]*` and unique in the namespace (a name in use
+     * throws {@link ContainerdContainerNameConflictException}). By default, the last part of the image name and the
+     * first 5 hexadecimal digits of the container ID (`'nginx-3fa2c'`).
+     */
+    name?: string;
+    /**
+     * The host name of the container, written to its `/etc/hostname` and its `HOSTNAME` variable. By default, the
+     * host's name on the host network, the first 12 digits of the container ID otherwise.
+     */
+    hostname?: string;
+    /**
+     * The command of the container, its arguments (`['nginx', '-g', 'daemon off;']`), run after the entry point. The
+     * image's command by default; dropped when `entrypoint` is given without it (as Docker does).
+     */
+    cmd?: string[];
+    /**
+     * The entry point of the container, its arguments, replacing the image's; `['']` removes the image's entry point.
+     * The image's entry point by default. A container left with neither an entry point nor a command fails to be
+     * created.
+     */
+    entrypoint?: string[];
+    /**
+     * The environment variables of the container, added to the image's ones (and replacing them by name). The
+     * container also gets `HOSTNAME`, and `PATH` and `HOME` (the user's home directory) when the image has none.
+     */
+    env?: Record<string, string>;
+    /**
+     * The working directory of the container's process; the image's one by default, `/` without it.
+     */
+    workingDir?: string;
+    /**
+     * The user of the container's process: `'user'`, `'user:group'`, `'uid'` or `'uid:gid'`, the names resolved by
+     * the image's `/etc/passwd` and `/etc/group`. The image's user by default, root without it.
+     */
+    user?: string;
+    /**
+     * The labels of the container, added to the image's ones; the ones the component sets (`nerdctl/…`,
+     * `containerd.io/restart.…`) cannot be overridden. {@link Containerd.listContainers} filters by them.
+     */
+    labels?: Record<string, string>;
+    /**
+     * Give the container all the capabilities, access to every device by its cgroup, the host's devices in its `/dev`
+     * (the character and block devices of the host's `/dev` when the container is created, as nerdctl gives them; a
+     * device plugged later needs a bind of `/dev`), `/sys` and `/sys/fs/cgroup` writable, no masked paths, no seccomp
+     * filter and no `no_new_privs`.
+     * @default false
+     */
+    privileged?: boolean;
+    /**
+     * Mount the container's root file system read only (its mounts, tmpfs and volumes stay writable).
+     * @default false
+     */
+    readonlyRootfs?: boolean;
+    /**
+     * The Linux capabilities added to the default ones (the 14 Docker gives: `CHOWN`, `DAC_OVERRIDE`, `FSETID`,
+     * `FOWNER`, `MKNOD`, `NET_RAW`, `SETGID`, `SETUID`, `SETFCAP`, `SETPCAP`, `NET_BIND_SERVICE`, `SYS_CHROOT`, `KILL`,
+     * `AUDIT_WRITE`), with or without the `CAP_` prefix, in any case (`'NET_ADMIN'`, `'cap_sys_time'`); `'ALL'` adds
+     * them all. Added after `capabilitiesDrop` is applied. Unlike the Docker component, the names are not checked
+     * against a list.
+     */
+    capabilities?: string[];
+    /**
+     * The Linux capabilities removed from the default ones, with or without the `CAP_` prefix (`'NET_RAW'`); `'ALL'`
+     * removes them all, before `capabilities` adds its ones.
+     */
+    capabilitiesDrop?: string[];
+    /**
+     * The seccomp profile filtering the system calls of the container: `'default'`, the default profile of containerd
+     * and nerdctl (the system calls allowed by the container's capabilities), applied when the kernel supports seccomp;
+     * `'unconfined'`, no filter; or the path of a JSON file holding an OCI seccomp profile (the `linux.seccomp` object
+     * of a runtime specification), read when the container is created. Privileged containers have no filter.
+     * @default 'default'
+     */
+    seccompProfile?: 'default' | 'unconfined' | string;
+    /**
+     * The host directories and files mounted into the container. Each needs `hostPath` and `containerPath`; `rw`
+     * defaults to `true`, `propagation` to `'rprivate'`.
+     */
+    binds?: ContainerdBind[];
+    /**
+     * The named volumes mounted into the container, created empty when they do not exist ({@link ContainerdVolume}).
+     * Each needs `volumeName` (`[a-zA-Z0-9][a-zA-Z0-9_.-]*`) and `containerPath`.
+     */
+    volumes?: ContainerdVolume[];
+    /**
+     * The tmpfs mounted into the container ({@link ContainerdTmpfs}). Each needs `containerPath`; `size` is a positive
+     * integer of bytes, `mode` three or four octal digits.
+     */
+    tmpfs?: ContainerdTmpfs[];
+    /**
+     * The host devices given to the container ({@link ContainerdDevice}): a device node, or a directory of them. Each
+     * needs `hostPath`; `cgroupPermissions` is one to three of `r`, `w` and `m`, each at most once, in any order
+     * (`'rw'`, `'mr'`), `'rwm'` by default.
+     */
+    devices?: ContainerdDevice[];
+    /**
+     * The devices the container's cgroup allows besides the ones given, as Docker's `--device-cgroup-rule` writes them:
+     * a type (`c` character, `b` block, `a` all), the major and minor numbers or `*`, the access (one to three of `r`,
+     * `w`, `m`, each at most once): `"c 188:* rwm"` for the USB serial ports. They let the container use the devices
+     * plugged after its start, with a bind of `/dev` (or of `/dev/serial`, `/dev/bus/usb`).
+     */
+    deviceCgroupRules?: string[];
+    /**
+     * The network of a container without `networks`: `'host'`, the host's network stack, or `'none'`, a network
+     * namespace with only its loopback. Ignored when `networks` is given. Without both, the container joins the default
+     * CNI network `bridge`, as with Docker and nerdctl (its ports published there; the CNI plugins needed).
+     * @default the network `bridge`
+     */
+    network?: 'host' | 'none';
+    /**
+     * The CNI networks the container joins, in order (its interfaces `eth0`, `eth1`…): `'bridge'`, the default nerdctl
+     * network (`10.4.0.0/24`, created when first used), or one created by {@link Containerd.createNetwork}. Each needs
+     * `networkName`, of an existing network other than `host` and `none` (a missing one throws
+     * {@link ContainerdNetworkNotFoundException}), given once; `ip` and `ipv6` set its address on the network (`''` or
+     * absent: one given by the network's IPAM). Requires the CNI plugins in the component's `cniPath`.
+     */
+    networks?: {
+        networkName: string;
+        ip?: string;
+        ipv6?: string;
+    }[];
+    /**
+     * The container ports published on the host, by the CNI `portmap` plugin on its first network: it needs `networks`
+     * (ports on the host or `none` network fail the creation). Each needs `port`, the container port, and `hostPorts`,
+     * one or more host ports forwarding to it; `type` is `'tcp'` (the default), `'udp'` or `'sctp'`; `hostIP` limits
+     * them to one host address (all of them by default). Unlike the Docker component, `hostPorts` is required and
+     * `type` is optional.
+     */
+    ports?: {
+        port: number;
+        type?: 'tcp' | 'udp' | 'sctp';
+        hostPorts: number[];
+        hostIP?: string;
+    }[];
+    /**
+     * `'host'` shares the host's PID namespace (the container sees the host processes); a namespace of its own when
+     * not given.
+     */
+    pidMode?: 'host';
+    /**
+     * `'host'` shares the host's IPC namespace (its shared memory and message queues); a namespace of its own when not
+     * given.
+     */
+    ipcMode?: 'host';
+    /**
+     * The cgroup namespace: `'private'`, one of its own (its cgroup seen as the root of its `/sys/fs/cgroup`), applied
+     * on cgroup v2 hosts only; `'host'`, the host's one.
+     * @default 'private'
+     */
+    cgroupns?: 'private' | 'host';
+    /**
+     * The memory limit in bytes, a non-negative integer; `0` or absent for no limit. With it, the swap is limited too
+     * (see `memorySwap`).
+     */
+    memoryLimit?: number;
+    /**
+     * The limit of the memory and the swap together in bytes, as Docker's and nerdctl's `--memory-swap`: at least
+     * `memoryLimit` (equal to it, no swap), or `-1` for unlimited swap. `0` or absent with `memoryLimit`: twice
+     * `memoryLimit` (as much swap as memory). A positive value needs `memoryLimit`: without it, the options are
+     * refused. Discarded when the kernel does not limit the swap of the cgroups (as Docker discards it).
+     */
+    memorySwap?: number;
+    /**
+     * The CPUs the container uses at most, a positive number (`1.5`): a CFS quota of `cpus × 100000` µs per period of
+     * 100000 µs. No limit by default.
+     */
+    cpus?: number;
+    /**
+     * The relative CPU weight of the container against the others when the CPUs are busy, in cgroup v1 CPU shares
+     * (`1024` is the kernel's default; runc converts them to a `cpu.weight` on cgroup v2). A positive integer; the
+     * kernel's default when not given.
+     */
+    cpuShares?: number;
+    /**
+     * The CPUs the container may run on, by their numbers (`[0, 1]`); all of them by default.
+     */
+    cpuSet?: number[];
+    /**
+     * The processes (and threads) the container may have at most, a positive integer; no limit by default.
+     */
+    pidsLimit?: number;
+    /**
+     * Disable the kernel's OOM killer for the container: its processes wait for memory instead of being killed at its
+     * memory limit. Supported on cgroup v1 only.
+     * @default false
+     */
+    OOMKillDisable?: boolean;
+    /**
+     * The kernel parameters set in the container's namespaces (`{'net.ipv4.ip_forward': '1'}`); runc accepts only the
+     * namespaced ones (`net.*` outside the host network, `kernel.shm*`, `kernel.msg*`, `fs.mqueue.*`…).
+     */
+    sysctls?: Record<string, string>;
+    /**
+     * The size of the container's `/dev/shm` in bytes, a positive integer.
+     * @default 67108864
+     */
+    shmSize?: number;
+    /**
+     * The restart policy, applied by containerd's restart monitor ({@link ContainerdRestartPolicy}): `''` or `'no'`,
+     * `'always'`, `'unless-stopped'`, `'on-failure'`, `'on-failure:N'`. Never restarted by default.
+     */
+    restartPolicy?: ContainerdRestartPolicy;
+    /**
+     * The signal `stop()` sends first (`'SIGTERM'`, `'SIGQUIT'`, `'TERM'`, `'15'`); the image's stop signal by default,
+     * `SIGTERM` without it.
+     */
+    stopSignal?: string;
+    /**
+     * The host names added to the container's `/etc/hosts`, each mapped to an IP address
+     * (`{'db.local': '10.4.1.5'}`).
+     */
+    extraHosts?: Record<string, string>;
+    /**
+     * The IP addresses of the name servers of the container's `/etc/resolv.conf`, replacing the host's. By default,
+     * the host's `/etc/resolv.conf`, without its loopback name servers outside the host network (and with `8.8.8.8`
+     * and `8.8.4.4` when none is left, as Docker does).
+     */
+    dns?: string[];
+}