@lakutata/containerd 0.0.0-stage → 3.0.0-beta.1

package/dist/cjs/containerd/options/image/ImageImportOptions.d.ts

@@ -0,0 +1,38 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link Containerd.importImage} loads the images of a tar archive into containerd, returning them: an OCI image
+ * layout (the archive of {@link ImageExportOptions}, `nerdctl save`, `docker save` of Docker 25+), or an archive of an
+ * older `docker save`. `source` is required. An archive with no image throws {@link ContainerdImageImportException}.
+ * @example
+ * ```typescript
+ * import {createReadStream} from 'node:fs'
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const images = await containerd.importImage({source: '/backup/images.tar'})
+ * //Or from a stream (an upload, a download), under another name
+ * const [copy] = await containerd.importImage({source: createReadStream('/backup/nginx.tar'), name: 'nginx:backup'})
+ * console.log(images.map(image => image.name), copy.name)
+ * ```
+ */
+export declare class ImageImportOptions extends DTO {
+    /**
+     * The archive: the path of a file, or a readable stream of it. Required.
+     */
+    source: string | NodeJS.ReadableStream;
+    /**
+     * The name given to the imported image (`'app:1.0'`, normalized to `'docker.io/library/app:1.0'`), instead of the
+     * names the archive has. Only for an archive of one image (its tags count as one): an archive of several images
+     * given a name throws {@link ContainerdImageImportException}, nothing imported. By default, the archive's names; an
+     * older `docker save` image without one is named `import-<milliseconds>@<digest>`.
+     */
+    name?: string;
+    /**
+     * Unpack the images' layers into snapshots, for the platforms the machine runs
+     * ({@link Containerd.supportedPlatforms}), so that their containers are created at once. A failure to unpack fails the import with
+     * {@link ContainerdImageImportException}, the images stored and named.
+     * @default true
+     */
+    unpack?: boolean;
+}

package/dist/cjs/containerd/options/image/ImageImportOptions.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImageImportOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+const node_stream_1 = require("node:stream");
+/**
+ * How {@link Containerd.importImage} loads the images of a tar archive into containerd, returning them: an OCI image
+ * layout (the archive of {@link ImageExportOptions}, `nerdctl save`, `docker save` of Docker 25+), or an archive of an
+ * older `docker save`. `source` is required. An archive with no image throws {@link ContainerdImageImportException}.
+ * @example
+ * ```typescript
+ * import {createReadStream} from 'node:fs'
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const images = await containerd.importImage({source: '/backup/images.tar'})
+ * //Or from a stream (an upload, a download), under another name
+ * const [copy] = await containerd.importImage({source: createReadStream('/backup/nginx.tar'), name: 'nginx:backup'})
+ * console.log(images.map(image => image.name), copy.name)
+ * ```
+ */
+class ImageImportOptions extends core_1.DTO {
+}
+exports.ImageImportOptions = ImageImportOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Alternatives(core_1.DTO.String(), core_1.DTO.InstanceOf(node_stream_1.Stream)).required()),
+    __metadata("design:type", Object)
+], ImageImportOptions.prototype, "source", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ImageImportOptions.prototype, "name", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], ImageImportOptions.prototype, "unpack", void 0);

package/dist/cjs/containerd/options/image/ImagePullOptions.d.ts

@@ -0,0 +1,53 @@
+import { DTO } from '@lakutata/core';
+import { ContainerdRegistryAuthOptions } from '../ContainerdRegistryAuthOptions.js';
+import type { ContainerdProgressCallback } from '../../types/ContainerdProgressCallback.js';
+/**
+ * How {@link Containerd.pullImage} pulls an image from its registry into containerd, returning it: the manifests of the
+ * platforms asked, their configurations and their layers. Only `image` is required. A failure throws
+ * {@link ContainerdImagePullException}; a platform the image does not have throws {@link ContainerdPlatformException}.
+ * The registries in the component's `insecureRegistries` are accessed over HTTP. Unlike the Docker component's options,
+ * the image is one reference (no `repo` and `tag`), several platforms can be pulled, and the progress is reported per
+ * blob in bytes.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image = await containerd.pullImage({
+ *     image: 'alpine:3.20',
+ *     platform: ['linux/amd64', 'linux/arm64'],
+ *     progressCallback: ({digest, current, total}): void => console.log(digest, current, '/', total)
+ * })
+ * console.log(image.name, image.platforms)
+ * ```
+ */
+export declare class ImagePullOptions extends DTO {
+    /**
+     * The image reference (`'alpine'`, `'alpine:3.20'`, `'registry.example.com:5000/app@sha256:…'`), normalized as
+     * Docker does (`'docker.io/library/alpine:latest'`), the tag `latest` when it has neither a tag nor a digest. The
+     * image is named by it in containerd. Required.
+     */
+    image: string;
+    /**
+     * The platforms pulled: one (`'linux/arm64'`, `'linux/arm/v7'`, `'arm64'` for `linux/arm64`) or several, or
+     * `'all'` for every platform of the image. The machine's platform by default.
+     */
+    platform?: string | string[];
+    /**
+     * The credentials of the image's registry; the component's credentials of that registry (`registryAuths`) by
+     * default, anonymous without them.
+     */
+    auth?: ContainerdRegistryAuthOptions;
+    /**
+     * Unpack the layers into snapshots, for the platforms pulled that the machine runs
+     * ({@link Containerd.supportedPlatforms}: its own and the ones of its emulators), so that their containers are
+     * created at once; the other platforms are only stored. Without it, a container creation unpacks them.
+     * @default true
+     */
+    unpack?: boolean;
+    /**
+     * Receive the download progress of each blob ({@link ContainerdProgressCallback}).
+     */
+    progressCallback?: ContainerdProgressCallback;
+}

package/dist/cjs/containerd/options/image/ImagePullOptions.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImagePullOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+const ContainerdRegistryAuthOptions_js_1 = require("../ContainerdRegistryAuthOptions.js");
+/**
+ * How {@link Containerd.pullImage} pulls an image from its registry into containerd, returning it: the manifests of the
+ * platforms asked, their configurations and their layers. Only `image` is required. A failure throws
+ * {@link ContainerdImagePullException}; a platform the image does not have throws {@link ContainerdPlatformException}.
+ * The registries in the component's `insecureRegistries` are accessed over HTTP. Unlike the Docker component's options,
+ * the image is one reference (no `repo` and `tag`), several platforms can be pulled, and the progress is reported per
+ * blob in bytes.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image = await containerd.pullImage({
+ *     image: 'alpine:3.20',
+ *     platform: ['linux/amd64', 'linux/arm64'],
+ *     progressCallback: ({digest, current, total}): void => console.log(digest, current, '/', total)
+ * })
+ * console.log(image.name, image.platforms)
+ * ```
+ */
+class ImagePullOptions extends core_1.DTO {
+}
+exports.ImagePullOptions = ImagePullOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().required()),
+    __metadata("design:type", String)
+], ImagePullOptions.prototype, "image", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Alternatives(core_1.DTO.String(), core_1.DTO.Array(core_1.DTO.String()).min(1)).optional()),
+    __metadata("design:type", Object)
+], ImagePullOptions.prototype, "platform", void 0);
+__decorate([
+    (0, dto_1.Expect)(ContainerdRegistryAuthOptions_js_1.ContainerdRegistryAuthOptions.optional()),
+    __metadata("design:type", ContainerdRegistryAuthOptions_js_1.ContainerdRegistryAuthOptions
+    /**
+     * Unpack the layers into snapshots, for the platforms pulled that the machine runs
+     * ({@link Containerd.supportedPlatforms}: its own and the ones of its emulators), so that their containers are
+     * created at once; the other platforms are only stored. Without it, a container creation unpacks them.
+     * @default true
+     */
+    )
+], ImagePullOptions.prototype, "auth", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], ImagePullOptions.prototype, "unpack", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Function().optional()),
+    __metadata("design:type", Function)
+], ImagePullOptions.prototype, "progressCallback", void 0);

package/dist/cjs/containerd/options/image/ImagePushOptions.d.ts

@@ -0,0 +1,44 @@
+import { DTO } from '@lakutata/core';
+import { ContainerdRegistryAuthOptions } from '../ContainerdRegistryAuthOptions.js';
+import type { ContainerdProgressCallback } from '../../types/ContainerdProgressCallback.js';
+/**
+ * Where and how {@link ContainerdImage.push} pushes an image to a registry: an image of one manifest as it is; the
+ * manifest of `platform` when it is given; else the whole index of a multi-platform image when the content store has
+ * all its platforms, the manifest of the machine's platform otherwise. Every field is optional. A failure throws
+ * {@link ContainerdImagePushException}. The registries in the component's `insecureRegistries` are accessed over HTTP.
+ * Unlike the Docker component's options, the destination is one reference (no `repo` and `tag`), the image is not
+ * tagged with it in containerd, and the identity tokens are sent.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image = await containerd.getImage('app:1.0')
+ * await image.push({
+ *     reference: 'registry.example.com:5000/team/app:1.0',
+ *     auth: {username: 'ci', password: process.env.REGISTRY_TOKEN ?? ''}
+ * })
+ * ```
+ */
+export declare class ImagePushOptions extends DTO {
+    /**
+     * The reference pushed to (`'registry.example.com:5000/team/app:1.0'`); the image's name by default.
+     */
+    reference?: string;
+    /**
+     * The platform whose manifest alone is pushed under the reference (`'linux/arm64'`), even when the content store
+     * has all the platforms of the image's index. Without it, the whole index is pushed when all its platforms are
+     * present, else the machine's platform. An image without the platform throws {@link ContainerdPlatformException}.
+     */
+    platform?: string;
+    /**
+     * The credentials of the registry of the reference; the component's credentials of that registry
+     * (`registryAuths`) by default.
+     */
+    auth?: ContainerdRegistryAuthOptions;
+    /**
+     * Receive the upload progress ({@link ContainerdProgressCallback}): once per blob, after its upload.
+     */
+    progressCallback?: ContainerdProgressCallback;
+}

package/dist/cjs/containerd/options/image/ImagePushOptions.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImagePushOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+const ContainerdRegistryAuthOptions_js_1 = require("../ContainerdRegistryAuthOptions.js");
+/**
+ * Where and how {@link ContainerdImage.push} pushes an image to a registry: an image of one manifest as it is; the
+ * manifest of `platform` when it is given; else the whole index of a multi-platform image when the content store has
+ * all its platforms, the manifest of the machine's platform otherwise. Every field is optional. A failure throws
+ * {@link ContainerdImagePushException}. The registries in the component's `insecureRegistries` are accessed over HTTP.
+ * Unlike the Docker component's options, the destination is one reference (no `repo` and `tag`), the image is not
+ * tagged with it in containerd, and the identity tokens are sent.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image = await containerd.getImage('app:1.0')
+ * await image.push({
+ *     reference: 'registry.example.com:5000/team/app:1.0',
+ *     auth: {username: 'ci', password: process.env.REGISTRY_TOKEN ?? ''}
+ * })
+ * ```
+ */
+class ImagePushOptions extends core_1.DTO {
+}
+exports.ImagePushOptions = ImagePushOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ImagePushOptions.prototype, "reference", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], ImagePushOptions.prototype, "platform", void 0);
+__decorate([
+    (0, dto_1.Expect)(ContainerdRegistryAuthOptions_js_1.ContainerdRegistryAuthOptions.optional()),
+    __metadata("design:type", ContainerdRegistryAuthOptions_js_1.ContainerdRegistryAuthOptions
+    /**
+     * Receive the upload progress ({@link ContainerdProgressCallback}): once per blob, after its upload.
+     */
+    )
+], ImagePushOptions.prototype, "auth", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Function().optional()),
+    __metadata("design:type", Function)
+], ImagePushOptions.prototype, "progressCallback", void 0);

package/dist/cjs/containerd/options/network/NetworkCreateOptions.d.ts

@@ -0,0 +1,82 @@
+import { DTO } from '@lakutata/core';
+/**
+ * A CNI network {@link Containerd.createNetwork} creates, as `nerdctl network create` does: its configuration list
+ * `nerdctl-<name>.conflist` written to the component's `cniConfigPath` (nerdctl sees it), its main plugin followed by
+ * `portmap`, and `firewall` and `tuning` when they are installed. Containers join it by
+ * {@link ContainerCreateOptions.networks}. Only `name` is required. A name or a subnet in use throws
+ * {@link ContainerdNetworkConflictException}. Unlike the Docker component's options, the IPAM settings are flat fields
+ * (one IPv4 subnet, one IPv6 subnet), and IPv6 is enabled by giving its subnet.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const network = await containerd.createNetwork({
+ *     name: 'backend',
+ *     subnet: '10.20.0.0/24',
+ *     ipRange: '10.20.0.128/25',
+ *     labels: {project: 'shop'}
+ * })
+ * await containerd.createContainer({image: 'redis:7', networks: [{networkName: network.name, ip: '10.20.0.10'}]})
+ * ```
+ */
+export declare class NetworkCreateOptions extends DTO {
+    /**
+     * The name of the network, matching `[a-zA-Z0-9][a-zA-Z0-9_.-]*`; not `host`, `none` nor `bridge` (the default
+     * nerdctl network). Required.
+     */
+    name: string;
+    /**
+     * The main CNI plugin, installed in the component's `cniPath`: `'bridge'`, a Linux bridge (`br-<12 digits of its
+     * ID>`) with NAT to the outside; `'macvlan'` (bridge mode) or `'ipvlan'` (L2 mode), the containers on the network
+     * of the host interface `parent`.
+     * @default 'bridge'
+     */
+    driver?: 'bridge' | 'ipvlan' | 'macvlan';
+    /**
+     * The IPv4 subnet in CIDR notation (`'10.20.0.0/24'`), overlapping no other network's. By default, the first free
+     * `/24` of `10.4.0.0/16` (the nerdctl range, `10.4.0.0/24` being the default network's).
+     */
+    subnet?: string;
+    /**
+     * The IPv4 gateway, an address of the subnet without a prefix length (`'10.20.0.254'`); the first address of the
+     * subnet by default.
+     */
+    gateway?: string;
+    /**
+     * The range the container addresses are given from, in CIDR notation inside the subnet (`'10.20.0.128/25'`); the
+     * whole subnet by default.
+     */
+    ipRange?: string;
+    /**
+     * The host interface (`'eth0'`) a `macvlan` or `ipvlan` network is attached to, required by them; ignored by
+     * `bridge`.
+     */
+    parent?: string;
+    /**
+     * Cut the network from the outside: no default route in the containers and, for a bridge, no gateway on the host
+     * and no masquerading.
+     * @default false
+     */
+    internal?: boolean;
+    /**
+     * The MTU of the container interfaces in bytes, at least `68`; the plugin's default (the host's, `1500` usually)
+     * when not given.
+     */
+    mtu?: number;
+    /**
+     * An IPv6 subnet in CIDR notation (`'fd00:4:10::/64'`), besides the IPv4 one, overlapping no other network's; the
+     * network has no IPv6 without it.
+     */
+    ipv6Subnet?: string;
+    /**
+     * The IPv6 gateway, an address of `ipv6Subnet` without a prefix length; the first address of the subnet by
+     * default. Ignored without `ipv6Subnet`.
+     */
+    ipv6Gateway?: string;
+    /**
+     * The labels of the network, written to its configuration.
+     */
+    labels?: Record<string, string>;
+}

package/dist/cjs/containerd/options/network/NetworkCreateOptions.js

@@ -0,0 +1,83 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetworkCreateOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+/**
+ * A CNI network {@link Containerd.createNetwork} creates, as `nerdctl network create` does: its configuration list
+ * `nerdctl-<name>.conflist` written to the component's `cniConfigPath` (nerdctl sees it), its main plugin followed by
+ * `portmap`, and `firewall` and `tuning` when they are installed. Containers join it by
+ * {@link ContainerCreateOptions.networks}. Only `name` is required. A name or a subnet in use throws
+ * {@link ContainerdNetworkConflictException}. Unlike the Docker component's options, the IPAM settings are flat fields
+ * (one IPv4 subnet, one IPv6 subnet), and IPv6 is enabled by giving its subnet.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const network = await containerd.createNetwork({
+ *     name: 'backend',
+ *     subnet: '10.20.0.0/24',
+ *     ipRange: '10.20.0.128/25',
+ *     labels: {project: 'shop'}
+ * })
+ * await containerd.createContainer({image: 'redis:7', networks: [{networkName: network.name, ip: '10.20.0.10'}]})
+ * ```
+ */
+class NetworkCreateOptions extends core_1.DTO {
+}
+exports.NetworkCreateOptions = NetworkCreateOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().pattern(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/).required()),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "name", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().valid('bridge', 'ipvlan', 'macvlan').optional().default('bridge')),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "driver", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().ip({ version: 'ipv4', cidr: 'required' }).optional()),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "subnet", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().ip({ version: 'ipv4', cidr: 'forbidden' }).optional()),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "gateway", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().ip({ version: 'ipv4', cidr: 'required' }).optional()),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "ipRange", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "parent", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Boolean().optional()),
+    __metadata("design:type", Boolean)
+], NetworkCreateOptions.prototype, "internal", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Number().integer().min(68).optional()),
+    __metadata("design:type", Number)
+], NetworkCreateOptions.prototype, "mtu", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().ip({ version: 'ipv6', cidr: 'required' }).optional()),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "ipv6Subnet", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().ip({ version: 'ipv6', cidr: 'forbidden' }).optional()),
+    __metadata("design:type", String)
+], NetworkCreateOptions.prototype, "ipv6Gateway", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Object().pattern(core_1.DTO.String(), core_1.DTO.String().allow('')).optional()),
+    __metadata("design:type", Object)
+], NetworkCreateOptions.prototype, "labels", void 0);

package/dist/cjs/containerd/options/volume/VolumeCreateOptions.d.ts

@@ -0,0 +1,26 @@
+import { DTO } from '@lakutata/core';
+/**
+ * A named volume {@link Containerd.createVolume} creates: an empty directory of the component's data root
+ * (`<dataRoot>/volumes/<namespace>/<name>/_data`), which containers mount by {@link ContainerCreateOptions.volumes}.
+ * It is not a nerdctl volume. When the volume exists, it is returned unchanged (its labels kept), as Docker does. Only
+ * `name` is required.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const volume = await containerd.createVolume({name: 'pgdata', labels: {project: 'shop'}})
+ * await containerd.createContainer({image: 'postgres:16', volumes: [{volumeName: volume.name, containerPath: '/var/lib/postgresql/data'}]})
+ * ```
+ */
+export declare class VolumeCreateOptions extends DTO {
+    /**
+     * The name of the volume, matching `[a-zA-Z0-9][a-zA-Z0-9_.-]*`. Required.
+     */
+    name: string;
+    /**
+     * The labels of the volume, kept with it ({@link ContainerdVolumeInfo.labels}); ignored when it exists.
+     */
+    labels?: Record<string, string>;
+}

package/dist/cjs/containerd/options/volume/VolumeCreateOptions.js

@@ -0,0 +1,40 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VolumeCreateOptions = void 0;
+const core_1 = require("@lakutata/core");
+const dto_1 = require("@lakutata/core/decorator/dto");
+/**
+ * A named volume {@link Containerd.createVolume} creates: an empty directory of the component's data root
+ * (`<dataRoot>/volumes/<namespace>/<name>/_data`), which containers mount by {@link ContainerCreateOptions.volumes}.
+ * It is not a nerdctl volume. When the volume exists, it is returned unchanged (its labels kept), as Docker does. Only
+ * `name` is required.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const volume = await containerd.createVolume({name: 'pgdata', labels: {project: 'shop'}})
+ * await containerd.createContainer({image: 'postgres:16', volumes: [{volumeName: volume.name, containerPath: '/var/lib/postgresql/data'}]})
+ * ```
+ */
+class VolumeCreateOptions extends core_1.DTO {
+}
+exports.VolumeCreateOptions = VolumeCreateOptions;
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.String().pattern(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/).required()),
+    __metadata("design:type", String)
+], VolumeCreateOptions.prototype, "name", void 0);
+__decorate([
+    (0, dto_1.Expect)(core_1.DTO.Object().pattern(core_1.DTO.String(), core_1.DTO.String().allow('')).optional()),
+    __metadata("design:type", Object)
+], VolumeCreateOptions.prototype, "labels", void 0);

package/dist/cjs/containerd/types/ContainerdBind.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A directory or a file of the host mounted into a container (a bind mount), given to
+ * {@link ContainerCreateOptions.binds}. Unlike the Docker component's bind, `rw` is optional and the mount propagation
+ * can be set.
+ */
+export type ContainerdBind = {
+    /**
+     * The path on the host, absolute or relative to the working directory of the process. A missing path is created
+     * as a directory when the container is created (as `docker run -v` does).
+     */
+    hostPath: string;
+    /**
+     * The absolute path in the container where it is mounted; it replaces what the image has there.
+     */
+    containerPath: string;
+    /**
+     * Whether the container can write to it; `false` mounts it read only.
+     * @default true
+     */
+    rw?: boolean;
+    /**
+     * The mount propagation (how the mounts made later under the path on either side are seen by the other side):
+     * `'private'`/`'rprivate'` none, `'shared'`/`'rshared'` both ways, `'slave'`/`'rslave'` from the host into the
+     * container only. The `r` forms apply to the mounts under the path too.
+     * @default 'rprivate'
+     */
+    propagation?: 'private' | 'rprivate' | 'shared' | 'rshared' | 'slave' | 'rslave';
+};

package/dist/cjs/containerd/types/ContainerdBind.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/containerd/types/ContainerdBuildOutputCallback.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Receive the progress of a BuildKit build ({@link ImageBuildOptions.outputCallback}), one line per call, as
+ * `docker build --progress=plain` prints it: the steps numbered in their order (`"#3 [2/2] RUN npm ci"`), their output,
+ * and their end (`"#3 CACHED"`, `"#3 DONE 1.2s"`, or their error). The line has no trailing newline.
+ */
+export type ContainerdBuildOutputCallback = (line: string) => void;

package/dist/cjs/containerd/types/ContainerdBuildOutputCallback.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/containerd/types/ContainerdContainerNetwork.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The interface of a container on one of its CNI networks ({@link ContainerdContainer.networks}). Its addresses are
+ * known while the container runs (its interface exists while its task does); the strings are empty otherwise, and for
+ * the families the network has no subnet of.
+ */
+export type ContainerdContainerNetwork = {
+    /**
+     * The name of the network (`'bridge'`, the default nerdctl network, or one created by
+     * {@link Containerd.createNetwork}).
+     */
+    networkName: string;
+    /**
+     * The name of the interface in the container: `'eth0'` on its first network, `'eth1'` on the second one…
+     */
+    interface: string;
+    /**
+     * The MAC address of the interface (`'2a:5f:…'`), `''` when unknown.
+     */
+    mac: string;
+    /**
+     * The IPv4 address of the container on the network, `''` when it has none.
+     */
+    ip: string;
+    /**
+     * The IPv4 gateway of the network, `''` when it has none.
+     */
+    gateway: string;
+    /**
+     * The prefix length of the IPv4 subnet (`24` for a `/24`), `0` when the container has no IPv4 address.
+     */
+    ipPrefixLen: number;
+    /**
+     * The IPv6 address of the container on the network, `''` when the network has no IPv6 subnet.
+     */
+    ipv6: string;
+    /**
+     * The IPv6 gateway of the network, `''` when it has none.
+     */
+    ipv6Gateway: string;
+};

package/dist/cjs/containerd/types/ContainerdContainerNetwork.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });