@lakutata/containerd 0.0.0-stage → 3.0.0-beta.1

package/dist/types/containerd/lib/ContainerdImage.d.ts

@@ -0,0 +1,149 @@
+import { Provider } from '@lakutata/core';
+import { Time } from '@lakutata/utils/Time';
+import type { ImageStore } from '../../client/ImageStore.js';
+import type { RegistryOptions } from '../../client/Registry.js';
+import { type Containerd } from '../Containerd.js';
+import type { ContainerdImageConfig } from '../types/ContainerdImageConfig.js';
+import { ImagePushOptions } from '../options/image/ImagePushOptions.js';
+import { ImageExportOptions } from '../options/image/ImageExportOptions.js';
+/**
+ * An image of the {@link Containerd} component's namespace: its name, digest, platforms, size and configuration, and
+ * the operations tag, push, export and remove. Get it from {@link Containerd.getImage}, {@link Containerd.listImages},
+ * {@link Containerd.pullImage}, {@link Containerd.buildImage}, {@link Containerd.importImage} or
+ * {@link ContainerdContainer.commit}; do not create it yourself. Each call returns a new object (transient).
+ *
+ * An image may hold several platforms (an index): the object describes one of them, the first one the machine runs
+ * ({@link Containerd.supportedPlatforms}), or the first one present. Its properties are a snapshot taken when it was
+ * obtained; {@link ContainerdImage.syncImageInfo} takes a new one.
+ * @example
+ * ```typescript
+ * import {type Containerd, type ContainerdImage} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const image: ContainerdImage = await containerd.pullImage({image: 'alpine:3.20', platform: ['linux/amd64', 'linux/arm64']})
+ * //docker.io/library/alpine:3.20, its platforms, the command its containers run
+ * console.log(image.name, image.platforms, image.config.cmd)
+ * const tagged: ContainerdImage = await image.tag('registry.example.com/team/alpine:3.20')
+ * await tagged.push({auth: {username: 'deploy', password: 'secret'}})
+ * //An archive loaded by docker load and nerdctl load
+ * await image.export({destination: '/tmp/alpine.tar'})
+ * await tagged.remove()
+ * ```
+ */
+export declare class ContainerdImage extends Provider {
+    /**
+     * Gives the component's image store; set by the component.
+     */
+    protected readonly getStore: () => ImageStore;
+    /**
+     * Gives the component that created the object.
+     */
+    protected readonly getContainerd: () => Containerd;
+    /**
+     * Gives the component's registry options (credentials, insecure registries) for the pushes.
+     */
+    protected readonly getRegistryOptions: () => RegistryOptions;
+    /**
+     * The image's name, normalized as Docker does (`docker.io/library/alpine:3.20`).
+     */
+    name: string;
+    /**
+     * The digest of the image's target: its index for a multi-platform image, else its manifest (`sha256:…`), as a
+     * registry knows it.
+     */
+    digest: string;
+    /**
+     * The media type of the image's target: an OCI or Docker index, or a manifest.
+     */
+    mediaType: string;
+    /**
+     * The labels of the image's containerd record (not the ones of its configuration: see `config.labels`).
+     */
+    labels: Record<string, string>;
+    /**
+     * When the image was created in containerd (pulled, imported, built).
+     */
+    createdAt: Time;
+    /**
+     * When the image's record was last updated in containerd (pulled again, tagged over).
+     */
+    updatedAt: Time;
+    /**
+     * The platforms whose content is present (the ones pulled), formatted `os/architecture[/variant]`.
+     */
+    platforms: string[];
+    /**
+     * The platform the object describes: the first one the machine runs, or the first one present.
+     */
+    platform: string;
+    /**
+     * The operating system of the platform described (`linux`).
+     */
+    os: string;
+    /**
+     * The architecture of the platform described (`amd64`, `arm64`).
+     */
+    arch: string;
+    /**
+     * The variant of the platform described (`v8`, `v7`); `undefined` when it has none.
+     */
+    variant: string | undefined;
+    /**
+     * The size of the platform described, in bytes: its configuration and its compressed layers.
+     */
+    size: number;
+    /**
+     * The configuration the image gives its containers, for the platform described: environment, command, entry point,
+     * working directory, user, exposed ports, volumes, labels and stop signal.
+     */
+    config: ContainerdImageConfig;
+    /**
+     * Read the image's information.
+     * @throws {ContainerdImageNotFoundException} The image does not exist.
+     * @throws {ContainerdPlatformException} The content of none of its platforms is present.
+     * @protected
+     */
+    protected init(): Promise<void>;
+    /**
+     * Read the image's information again from containerd into the object's properties.
+     * @throws {ContainerdImageNotFoundException} The image no longer exists.
+     * @throws {ContainerdPlatformException} The content of none of its platforms is present.
+     */
+    syncImageInfo(): Promise<void>;
+    /**
+     * Give the image another name, as `docker tag` does: a new image record with the same content. An image that has
+     * this name already is replaced. This object keeps its name.
+     * @param name The new name or reference (`registry.example.com/team/alpine:3.20`), normalized as Docker does.
+     * @returns The image under its new name.
+     * @throws {ContainerdImageNotFoundException} The image no longer exists.
+     */
+    tag(name: string): Promise<ContainerdImage>;
+    /**
+     * Push the image to its registry, or to another reference. With `platform`, only the manifest of that platform is
+     * pushed under the tag. Without it, when the content of all the platforms of its index is present, all of them and
+     * the index are pushed; otherwise only the manifest of the machine's platform. The credentials are `auth`, else the
+     * component's `registryAuths`. The push is aborted when the component is destroyed.
+     * @param options The `reference` to push to (the image's name by default), the `platform`, the credentials and the
+     * progress callback.
+     * @throws {ContainerdImageNotFoundException} The image no longer exists.
+     * @throws {ContainerdPlatformException} The platform to push (`platform`, or the machine's when only some platforms
+     * are present) is not present.
+     * @throws {ContainerdImagePushException} The registry cannot be reached or refuses the push (credentials, rights).
+     */
+    push(options?: ImagePushOptions): Promise<void>;
+    /**
+     * Export the image into an archive: an OCI image layout with the `manifest.json` of `docker load`, loaded by
+     * `docker load`, `nerdctl load` and {@link Containerd.importImage}.
+     * @param options The destination: a file path (created or replaced) or a writable stream.
+     * @throws {ContainerdImageNotFoundException} The image no longer exists.
+     * @throws {ContainerdImageExportException} The archive cannot be written.
+     */
+    export(options: ImageExportOptions): Promise<void>;
+    /**
+     * Remove the image's name. Its content and snapshots are collected by containerd once no other image and no
+     * container uses them; the containers of the image keep working.
+     * @throws {ContainerdImageNotFoundException} The image no longer exists.
+     */
+    remove(): Promise<void>;
+}

package/dist/types/containerd/options/ContainerdPruneOptions.d.ts

@@ -0,0 +1,44 @@
+import { DTO } from '@lakutata/core';
+/**
+ * What {@link Containerd.prune} removes; every field is optional. A resource whose removal fails is skipped. Unlike the
+ * Docker component's options, the volumes are kept by default, and `allImages` removes the tagged images too.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * //The stopped containers and the dangling images (the defaults), and the unused volumes with their data
+ * const removed = await containerd.prune({volumes: true})
+ * console.log(removed.containers, removed.images, removed.volumes)
+ * ```
+ */
+export declare class ContainerdPruneOptions extends DTO {
+    /**
+     * Remove the containers which do not run (their status `'created'` or `'exited'`), with their snapshots and their
+     * logs.
+     * @default true
+     */
+    containers?: boolean;
+    /**
+     * Remove the dangling images (named by a digest, without a tag) no container uses.
+     * @default true
+     */
+    images?: boolean;
+    /**
+     * Remove all the images no container uses, the tagged ones too (whatever `images` is).
+     * @default false
+     */
+    allImages?: boolean;
+    /**
+     * Remove the networks no container uses, among the ones created by nerdctl or the component; never `host`, `none`
+     * nor the default `bridge` network.
+     * @default false
+     */
+    networks?: boolean;
+    /**
+     * Remove the volumes no container uses, with their data.
+     * @default false
+     */
+    volumes?: boolean;
+}

package/dist/types/containerd/options/ContainerdRegistryAuthOptions.d.ts

@@ -0,0 +1,32 @@
+import { DTO } from '@lakutata/core';
+/**
+ * The credentials of a container registry, given to a pull, a push or a build (their `auth` option) for the registry
+ * of the reference they name. They replace, for that operation, the ones the component's `registryAuths` option gives
+ * that registry. Every field is optional; without `username` nor `identityToken`, the registry is accessed anonymously.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * await containerd.pullImage({
+ *     image: 'registry.example.com:5000/team/app:1.0',
+ *     auth: {username: 'ci', password: process.env.REGISTRY_TOKEN ?? ''}
+ * })
+ * ```
+ */
+export declare class ContainerdRegistryAuthOptions extends DTO {
+    /**
+     * The user name, sent with `password` (HTTP basic authentication, or the registry's token service).
+     */
+    username?: string;
+    /**
+     * The password of `username`, or an access token the registry accepts as one; ignored without `username`.
+     */
+    password?: string;
+    /**
+     * An identity token (the OAuth2 refresh token the registry issued, as `docker login` stores it), exchanged with the
+     * registry's token service for an access token instead of `username` and `password`.
+     */
+    identityToken?: string;
+}

package/dist/types/containerd/options/container/ContainerCommitOptions.d.ts

@@ -0,0 +1,57 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link ContainerdContainer.commit} saves a container's file system changes as a new image: one layer on its
+ * image, for the container's platform, with the image configuration changed as asked; the image is unpacked so it can
+ * run at once. Every field is optional. Unlike the Docker component's options, the image configuration can be changed
+ * and the commit commented, and an image committed without `repoTag` is still named.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('builder')
+ * const image = await container.commit({
+ *     repoTag: 'registry.example.com/app:1.1',
+ *     changes: {cmd: ['node', 'server.js'], env: {NODE_ENV: 'production'}, exposedPorts: ['3000/tcp']},
+ *     comment: 'Dependencies installed',
+ *     author: 'CI <ci@example.com>'
+ * })
+ * console.log(image.name, image.digest)
+ * ```
+ */
+export declare class ContainerCommitOptions extends DTO {
+    /**
+     * The name of the new image (`'app:1.1'`, normalized to `'docker.io/library/app:1.1'`). By default, the
+     * container's image repository with the tag `commit-<milliseconds since the epoch>`.
+     */
+    repoTag?: string;
+    /**
+     * Pause a running container while its changes are read, so that they are consistent; it is resumed after, even on
+     * a failure.
+     * @default true
+     */
+    pauseBeforeCommitting?: boolean;
+    /**
+     * The changes of the new image's configuration, every field optional: `cmd` and `entrypoint` replace the image's
+     * ones; `env` adds variables (replacing them by name); `workingDir` and `user` replace the image's ones; `labels`
+     * are added; `exposedPorts` adds ports as `"8080"` (TCP) or `"8080/udp"` (`tcp`, `udp` or `sctp`).
+     */
+    changes?: {
+        cmd?: string[];
+        entrypoint?: string[];
+        env?: Record<string, string>;
+        workingDir?: string;
+        user?: string;
+        labels?: Record<string, string>;
+        exposedPorts?: string[];
+    };
+    /**
+     * The comment of the commit, written to the image history.
+     */
+    comment?: string;
+    /**
+     * The author of the commit (`'Name <email>'`), written to the image configuration and its history.
+     */
+    author?: string;
+}

package/dist/types/containerd/options/container/ContainerCreateOptions.d.ts

@@ -0,0 +1,273 @@
+import { DTO } from '@lakutata/core';
+import type { ContainerdRestartPolicy } from '../../types/ContainerdRestartPolicy.js';
+import type { ContainerdBind } from '../../types/ContainerdBind.js';
+import type { ContainerdDevice } from '../../types/ContainerdDevice.js';
+import type { ContainerdTmpfs } from '../../types/ContainerdTmpfs.js';
+import type { ContainerdVolume } from '../../types/ContainerdVolume.js';
+/**
+ * The settings of a container created by {@link Containerd.createContainer}: its image, its process, its mounts, its
+ * networks, its resources and its security. Only `image` is required; the container is created stopped (`start()` it)
+ * as a nerdctl container (`nerdctl ps` lists it), with an OCI runtime specification built as nerdctl builds it. The
+ * component keeps these settings: {@link ContainerdContainer.update} creates the container again with the ones it
+ * changes.
+ *
+ * As with the Docker component, the container joins the default network `bridge` unless `network` or `networks` is
+ * given (here a CNI network, the CNI plugins needed); its ports are published only on a CNI network, and its named volumes are directories the component keeps (not Docker's nor
+ * nerdctl's volumes).
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * await containerd.pullImage({image: 'nginx:1.27'})
+ * const container = await containerd.createContainer({
+ *     image: 'nginx:1.27',
+ *     name: 'web',
+ *     env: {NGINX_PORT: '80'},
+ *     binds: [{hostPath: '/srv/www', containerPath: '/usr/share/nginx/html', rw: false}],
+ *     volumes: [{volumeName: 'web-cache', containerPath: '/var/cache/nginx'}],
+ *     //The default nerdctl network, its port 80 published on the host port 8080
+ *     networks: [{networkName: 'bridge'}],
+ *     ports: [{port: 80, hostPorts: [8080]}],
+ *     memoryLimit: 256 * 1024 * 1024,
+ *     cpus: 0.5,
+ *     restartPolicy: 'unless-stopped'
+ * })
+ * await container.start()
+ * ```
+ */
+export declare class ContainerCreateOptions extends DTO {
+    /**
+     * The image of the container: its name or a reference (`'alpine:3.20'`, `'docker.io/library/alpine:3.20'`,
+     * `'registry.example.com/app@sha256:…'`). Required. The image must be in containerd already (pull, import or build
+     * it first): a missing one throws {@link ContainerdImageNotFoundException}.
+     */
+    image: string;
+    /**
+     * The platform of the image run (`'linux/amd64'`, `'linux/arm/v7'`, or `'arm64'` for `linux/arm64`), pulled
+     * beforehand; another architecture than the machine's needs a QEMU emulator registered in binfmt_misc
+     * ({@link Containerd.supportedPlatforms}). The machine's platform by default; an image without it throws
+     * {@link ContainerdPlatformException}.
+     */
+    platform?: string;
+    /**
+     * The name of the container, matching `[a-zA-Z0-9][a-zA-Z0-9_.-]*` and unique in the namespace (a name in use
+     * throws {@link ContainerdContainerNameConflictException}). By default, the last part of the image name and the
+     * first 5 hexadecimal digits of the container ID (`'nginx-3fa2c'`).
+     */
+    name?: string;
+    /**
+     * The host name of the container, written to its `/etc/hostname` and its `HOSTNAME` variable. By default, the
+     * host's name on the host network, the first 12 digits of the container ID otherwise.
+     */
+    hostname?: string;
+    /**
+     * The command of the container, its arguments (`['nginx', '-g', 'daemon off;']`), run after the entry point. The
+     * image's command by default; dropped when `entrypoint` is given without it (as Docker does).
+     */
+    cmd?: string[];
+    /**
+     * The entry point of the container, its arguments, replacing the image's; `['']` removes the image's entry point.
+     * The image's entry point by default. A container left with neither an entry point nor a command fails to be
+     * created.
+     */
+    entrypoint?: string[];
+    /**
+     * The environment variables of the container, added to the image's ones (and replacing them by name). The
+     * container also gets `HOSTNAME`, and `PATH` and `HOME` (the user's home directory) when the image has none.
+     */
+    env?: Record<string, string>;
+    /**
+     * The working directory of the container's process; the image's one by default, `/` without it.
+     */
+    workingDir?: string;
+    /**
+     * The user of the container's process: `'user'`, `'user:group'`, `'uid'` or `'uid:gid'`, the names resolved by
+     * the image's `/etc/passwd` and `/etc/group`. The image's user by default, root without it.
+     */
+    user?: string;
+    /**
+     * The labels of the container, added to the image's ones; the ones the component sets (`nerdctl/…`,
+     * `containerd.io/restart.…`) cannot be overridden. {@link Containerd.listContainers} filters by them.
+     */
+    labels?: Record<string, string>;
+    /**
+     * Give the container all the capabilities, access to every device by its cgroup, the host's devices in its `/dev`
+     * (the character and block devices of the host's `/dev` when the container is created, as nerdctl gives them; a
+     * device plugged later needs a bind of `/dev`), `/sys` and `/sys/fs/cgroup` writable, no masked paths, no seccomp
+     * filter and no `no_new_privs`.
+     * @default false
+     */
+    privileged?: boolean;
+    /**
+     * Mount the container's root file system read only (its mounts, tmpfs and volumes stay writable).
+     * @default false
+     */
+    readonlyRootfs?: boolean;
+    /**
+     * The Linux capabilities added to the default ones (the 14 Docker gives: `CHOWN`, `DAC_OVERRIDE`, `FSETID`,
+     * `FOWNER`, `MKNOD`, `NET_RAW`, `SETGID`, `SETUID`, `SETFCAP`, `SETPCAP`, `NET_BIND_SERVICE`, `SYS_CHROOT`, `KILL`,
+     * `AUDIT_WRITE`), with or without the `CAP_` prefix, in any case (`'NET_ADMIN'`, `'cap_sys_time'`); `'ALL'` adds
+     * them all. Added after `capabilitiesDrop` is applied. Unlike the Docker component, the names are not checked
+     * against a list.
+     */
+    capabilities?: string[];
+    /**
+     * The Linux capabilities removed from the default ones, with or without the `CAP_` prefix (`'NET_RAW'`); `'ALL'`
+     * removes them all, before `capabilities` adds its ones.
+     */
+    capabilitiesDrop?: string[];
+    /**
+     * The seccomp profile filtering the system calls of the container: `'default'`, the default profile of containerd
+     * and nerdctl (the system calls allowed by the container's capabilities), applied when the kernel supports seccomp;
+     * `'unconfined'`, no filter; or the path of a JSON file holding an OCI seccomp profile (the `linux.seccomp` object
+     * of a runtime specification), read when the container is created. Privileged containers have no filter.
+     * @default 'default'
+     */
+    seccompProfile?: 'default' | 'unconfined' | string;
+    /**
+     * The host directories and files mounted into the container. Each needs `hostPath` and `containerPath`; `rw`
+     * defaults to `true`, `propagation` to `'rprivate'`.
+     */
+    binds?: ContainerdBind[];
+    /**
+     * The named volumes mounted into the container, created empty when they do not exist ({@link ContainerdVolume}).
+     * Each needs `volumeName` (`[a-zA-Z0-9][a-zA-Z0-9_.-]*`) and `containerPath`.
+     */
+    volumes?: ContainerdVolume[];
+    /**
+     * The tmpfs mounted into the container ({@link ContainerdTmpfs}). Each needs `containerPath`; `size` is a positive
+     * integer of bytes, `mode` three or four octal digits.
+     */
+    tmpfs?: ContainerdTmpfs[];
+    /**
+     * The host devices given to the container ({@link ContainerdDevice}): a device node, or a directory of them. Each
+     * needs `hostPath`; `cgroupPermissions` is one to three of `r`, `w` and `m`, each at most once, in any order
+     * (`'rw'`, `'mr'`), `'rwm'` by default.
+     */
+    devices?: ContainerdDevice[];
+    /**
+     * The devices the container's cgroup allows besides the ones given, as Docker's `--device-cgroup-rule` writes them:
+     * a type (`c` character, `b` block, `a` all), the major and minor numbers or `*`, the access (one to three of `r`,
+     * `w`, `m`, each at most once): `"c 188:* rwm"` for the USB serial ports. They let the container use the devices
+     * plugged after its start, with a bind of `/dev` (or of `/dev/serial`, `/dev/bus/usb`).
+     */
+    deviceCgroupRules?: string[];
+    /**
+     * The network of a container without `networks`: `'host'`, the host's network stack, or `'none'`, a network
+     * namespace with only its loopback. Ignored when `networks` is given. Without both, the container joins the default
+     * CNI network `bridge`, as with Docker and nerdctl (its ports published there; the CNI plugins needed).
+     * @default the network `bridge`
+     */
+    network?: 'host' | 'none';
+    /**
+     * The CNI networks the container joins, in order (its interfaces `eth0`, `eth1`…): `'bridge'`, the default nerdctl
+     * network (`10.4.0.0/24`, created when first used), or one created by {@link Containerd.createNetwork}. Each needs
+     * `networkName`, of an existing network other than `host` and `none` (a missing one throws
+     * {@link ContainerdNetworkNotFoundException}), given once; `ip` and `ipv6` set its address on the network (`''` or
+     * absent: one given by the network's IPAM). Requires the CNI plugins in the component's `cniPath`.
+     */
+    networks?: {
+        networkName: string;
+        ip?: string;
+        ipv6?: string;
+    }[];
+    /**
+     * The container ports published on the host, by the CNI `portmap` plugin on its first network: it needs `networks`
+     * (ports on the host or `none` network fail the creation). Each needs `port`, the container port, and `hostPorts`,
+     * one or more host ports forwarding to it; `type` is `'tcp'` (the default), `'udp'` or `'sctp'`; `hostIP` limits
+     * them to one host address (all of them by default). Unlike the Docker component, `hostPorts` is required and
+     * `type` is optional.
+     */
+    ports?: {
+        port: number;
+        type?: 'tcp' | 'udp' | 'sctp';
+        hostPorts: number[];
+        hostIP?: string;
+    }[];
+    /**
+     * `'host'` shares the host's PID namespace (the container sees the host processes); a namespace of its own when
+     * not given.
+     */
+    pidMode?: 'host';
+    /**
+     * `'host'` shares the host's IPC namespace (its shared memory and message queues); a namespace of its own when not
+     * given.
+     */
+    ipcMode?: 'host';
+    /**
+     * The cgroup namespace: `'private'`, one of its own (its cgroup seen as the root of its `/sys/fs/cgroup`), applied
+     * on cgroup v2 hosts only; `'host'`, the host's one.
+     * @default 'private'
+     */
+    cgroupns?: 'private' | 'host';
+    /**
+     * The memory limit in bytes, a non-negative integer; `0` or absent for no limit. With it, the swap is limited too
+     * (see `memorySwap`).
+     */
+    memoryLimit?: number;
+    /**
+     * The limit of the memory and the swap together in bytes, as Docker's and nerdctl's `--memory-swap`: at least
+     * `memoryLimit` (equal to it, no swap), or `-1` for unlimited swap. `0` or absent with `memoryLimit`: twice
+     * `memoryLimit` (as much swap as memory). A positive value needs `memoryLimit`: without it, the options are
+     * refused. Discarded when the kernel does not limit the swap of the cgroups (as Docker discards it).
+     */
+    memorySwap?: number;
+    /**
+     * The CPUs the container uses at most, a positive number (`1.5`): a CFS quota of `cpus × 100000` µs per period of
+     * 100000 µs. No limit by default.
+     */
+    cpus?: number;
+    /**
+     * The relative CPU weight of the container against the others when the CPUs are busy, in cgroup v1 CPU shares
+     * (`1024` is the kernel's default; runc converts them to a `cpu.weight` on cgroup v2). A positive integer; the
+     * kernel's default when not given.
+     */
+    cpuShares?: number;
+    /**
+     * The CPUs the container may run on, by their numbers (`[0, 1]`); all of them by default.
+     */
+    cpuSet?: number[];
+    /**
+     * The processes (and threads) the container may have at most, a positive integer; no limit by default.
+     */
+    pidsLimit?: number;
+    /**
+     * Disable the kernel's OOM killer for the container: its processes wait for memory instead of being killed at its
+     * memory limit. Supported on cgroup v1 only.
+     * @default false
+     */
+    OOMKillDisable?: boolean;
+    /**
+     * The kernel parameters set in the container's namespaces (`{'net.ipv4.ip_forward': '1'}`); runc accepts only the
+     * namespaced ones (`net.*` outside the host network, `kernel.shm*`, `kernel.msg*`, `fs.mqueue.*`…).
+     */
+    sysctls?: Record<string, string>;
+    /**
+     * The size of the container's `/dev/shm` in bytes, a positive integer.
+     * @default 67108864
+     */
+    shmSize?: number;
+    /**
+     * The restart policy, applied by containerd's restart monitor ({@link ContainerdRestartPolicy}): `''` or `'no'`,
+     * `'always'`, `'unless-stopped'`, `'on-failure'`, `'on-failure:N'`. Never restarted by default.
+     */
+    restartPolicy?: ContainerdRestartPolicy;
+    /**
+     * The signal `stop()` sends first (`'SIGTERM'`, `'SIGQUIT'`, `'TERM'`, `'15'`); the image's stop signal by default,
+     * `SIGTERM` without it.
+     */
+    stopSignal?: string;
+    /**
+     * The host names added to the container's `/etc/hosts`, each mapped to an IP address
+     * (`{'db.local': '10.4.1.5'}`).
+     */
+    extraHosts?: Record<string, string>;
+    /**
+     * The IP addresses of the name servers of the container's `/etc/resolv.conf`, replacing the host's. By default,
+     * the host's `/etc/resolv.conf`, without its loopback name servers outside the host network (and with `8.8.8.8`
+     * and `8.8.4.4` when none is left, as Docker does).
+     */
+    dns?: string[];
+}

package/dist/types/containerd/options/container/ContainerExecOptions.d.ts

@@ -0,0 +1,53 @@
+import { DTO } from '@lakutata/core';
+/**
+ * A command {@link ContainerdContainer.exec} runs in a running container (else it throws
+ * {@link ContainerdContainerStateException}), waiting for its exit and capturing its output in memory. Only `cmd` is
+ * required; the process gets the container's settings (environment, user, capabilities) unless changed here.
+ * Separating its standard error and giving it a standard input use FIFOs (`mkfifo` on the host). Unlike the Docker
+ * component's options, a string `cmd` is run by a shell, the process can get an environment, a user, a standard input
+ * and a timeout, and the result holds the exit code and the two outputs apart.
+ * @example
+ * ```typescript
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('db')
+ * const result = await container.exec({
+ *     cmd: ['psql', '-U', 'postgres', '-f', '-'],
+ *     stdin: 'SELECT 1;',
+ *     timeout: 30000
+ * })
+ * if (result.exitCode !== 0) console.error(result.stderr)
+ * ```
+ */
+export declare class ContainerExecOptions extends DTO {
+    /**
+     * The command: its arguments (`['ls', '-la', '/data']`, at least one), or a command line run by `/bin/sh -c`
+     * (`'ls -la /data | wc -l'`), which needs a shell in the container. Required.
+     */
+    cmd: string | string[];
+    /**
+     * Its environment variables, added to the container's ones (and replacing them by name).
+     */
+    env?: Record<string, string>;
+    /**
+     * Its working directory; the container's one by default.
+     */
+    workingDir?: string;
+    /**
+     * Its user: `'user'`, `'user:group'`, `'uid'` or `'uid:gid'`, the names resolved by the container's `/etc/passwd`
+     * and `/etc/group`; the container's user by default.
+     */
+    user?: string;
+    /**
+     * The data written to its standard input, which is closed after it. Without it, the process has no standard input.
+     * Needs `mkfifo` on the host.
+     */
+    stdin?: string | Buffer;
+    /**
+     * The milliseconds it may run, a positive integer: it is then killed (`SIGKILL`) and the result has its exit code
+     * (`137`) and its output so far. No limit by default.
+     */
+    timeout?: number;
+}

package/dist/types/containerd/options/container/ContainerExportDirectoryOptions.d.ts

@@ -0,0 +1,32 @@
+import { DTO } from '@lakutata/core';
+/**
+ * What {@link ContainerdContainer.exportDirectory} archives (as tar) and where. A running container is read through
+ * its process root (its mounts included), a stopped one from its snapshot (its image layers and its changes, without
+ * its mounts). The directories, regular files and symbolic links are archived with their modes, owners and times; the
+ * devices, sockets and pipes are skipped. Both fields are required.
+ * @example
+ * ```typescript
+ * import {createWriteStream} from 'node:fs'
+ * import {Containerd} from 'lakutata/com/containerd'
+ *
+ * declare const containerd: Containerd
+ *
+ * const container = await containerd.getContainer('web')
+ * //Into a file
+ * await container.exportDirectory({path: '/etc/nginx', destination: '/tmp/nginx-config.tar'})
+ * //Into a stream
+ * await container.exportDirectory({path: '/var/log/nginx', destination: createWriteStream('/tmp/nginx-logs.tar')})
+ * ```
+ */
+export declare class ContainerExportDirectoryOptions extends DTO {
+    /**
+     * The absolute path in the container of the directory or file archived, its symbolic links resolved in the
+     * container; it is the archive's top entry, named by its base name. A missing path fails the export.
+     */
+    path: string;
+    /**
+     * Where the tar archive is written: the path of a host file (created or replaced), or a writable stream, ended
+     * once the archive is written.
+     */
+    destination: string | NodeJS.WritableStream;
+}