@lakutata/docker 3.0.0-beta.0

package/dist/types/docker/options/image/ImageExportOptions.d.ts

@@ -0,0 +1,33 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How `DockerImage.export()` saves an image as a tar archive (`docker save`), which {@link Docker.importImage} or
+ * `docker load` loads back. `destination` is required.
+ * @example
+ * ```typescript
+ * import {Docker} from 'lakutata/com/docker'
+ *
+ * declare const docker: Docker
+ *
+ * const image = await docker.getImage('api:1.4.0')
+ * //Loaded back as api:stable
+ * await image.export({destination: '/backup/api.tar', repoTag: 'api:stable'})
+ * ```
+ */
+export declare class ImageExportOptions extends DTO {
+    /**
+     * Where the archive is written: the path of a file, created or replaced, or a writable stream, ended once the
+     * archive is written. Required.
+     */
+    destination: string | NodeJS.WritableStream;
+    /**
+     * The `repo:tag` the archive names the image with, which the image gets back when loaded (`api:1.4.0`). Without it,
+     * the image is saved by its ID: it is loaded back without a name.
+     */
+    repoTag?: string;
+    /**
+     * Tag the image with `repoTag` first when it does not have it; `false` fails the export with
+     * `DockerImageRepoTagNotFoundException` instead.
+     * @default true
+     */
+    createRepoTagIfNotExists?: boolean;
+}

package/dist/types/docker/options/image/ImageImportOptions.d.ts

@@ -0,0 +1,28 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How {@link Docker.importImage} loads an image from a tar archive made by `DockerImage.export()` or `docker save`
+ * (`docker load`), the loaded image returned. `source` is required.
+ * @example
+ * ```typescript
+ * import {createReadStream} from 'node:fs'
+ * import {Docker} from 'lakutata/com/docker'
+ *
+ * declare const docker: Docker
+ *
+ * const image = await docker.importImage({source: '/backup/api.tar'})
+ * //Or from a stream: an upload, a download
+ * const copy = await docker.importImage({source: createReadStream('/backup/api.tar')})
+ * console.log(image.repoTags, copy.id)
+ * ```
+ */
+export declare class ImageImportOptions extends DTO {
+    /**
+     * The archive: the path of a file, or a readable stream of it. Required.
+     */
+    source: string | NodeJS.ReadableStream;
+    /**
+     * Have Docker report no progress while it loads the archive (`docker load --quiet`).
+     * @default false
+     */
+    quiet?: boolean;
+}

package/dist/types/docker/options/image/ImagePullOptions.d.ts

@@ -0,0 +1,49 @@
+import { DTO } from '@lakutata/core';
+import { DockerAuthOptions } from '../auth/DockerAuthOptions.js';
+import type { DockerOutputCallback } from '../../types/DockerOutputCallback.js';
+/**
+ * Which image {@link Docker.pullImage} pulls from its registry (`docker pull`), the pulled image returned. `repo` is
+ * required.
+ * @example
+ * ```typescript
+ * import {Docker} from 'lakutata/com/docker'
+ *
+ * declare const docker: Docker
+ *
+ * const nginx = await docker.pullImage({repo: 'nginx', tag: '1.27-alpine'})
+ * const app = await docker.pullImage({
+ *     repo: 'registry.example.com:5000/team/app',
+ *     tag: '2.1.0',
+ *     platform: 'linux/arm64',
+ *     auth: {serverAddress: 'registry.example.com:5000', username: 'ci', password: process.env.REGISTRY_PASSWORD ?? ''},
+ *     outputCallback: (output: Record<string, any>): void => console.log(output.status, output.id ?? '')
+ * })
+ * console.log(nginx.id, app.id)
+ * ```
+ */
+export declare class ImagePullOptions extends DTO {
+    /**
+     * The repository, with its registry when it is not Docker Hub (`nginx`, `bitnami/redis`,
+     * `registry.example.com:5000/team/app`), without the tag. Required.
+     */
+    repo: string;
+    /**
+     * The tag pulled (`1.27-alpine`).
+     * @default 'latest'
+     */
+    tag?: string;
+    /**
+     * The platform pulled from a multi-platform image, `os[/arch[/variant]]` (`linux/arm64`); the Docker host's
+     * platform when absent.
+     */
+    platform?: string;
+    /**
+     * The credentials of a private registry; all of them are sent, the tokens included.
+     */
+    auth?: DockerAuthOptions;
+    /**
+     * Receive the pull progress as Docker sends it (`{status: 'Downloading', id: '<layer>', progressDetail: {current,
+     * total}}`).
+     */
+    outputCallback?: DockerOutputCallback;
+}

package/dist/types/docker/options/image/ImagePushOptions.d.ts

@@ -0,0 +1,41 @@
+import { DTO } from '@lakutata/core';
+import { DockerAuthOptions } from '../auth/DockerAuthOptions.js';
+import { type DockerOutputCallback } from '../../types/DockerOutputCallback.js';
+/**
+ * Where `DockerImage.push()` pushes an image (`docker push`): the image is tagged `repo:tag` first, then pushed to the
+ * registry of `repo`. `repo` is required.
+ * @example
+ * ```typescript
+ * import {Docker} from 'lakutata/com/docker'
+ *
+ * declare const docker: Docker
+ *
+ * const image = await docker.getImage('api:1.4.0')
+ * await image.push({
+ *     repo: 'registry.example.com:5000/team/api',
+ *     tag: '1.4.0',
+ *     auth: {serverAddress: 'registry.example.com:5000', username: 'ci', password: process.env.REGISTRY_PASSWORD ?? ''}
+ * })
+ * ```
+ */
+export declare class ImagePushOptions extends DTO {
+    /**
+     * The repository pushed to, with its registry when it is not Docker Hub (`registry.example.com:5000/team/api`,
+     * `myuser/api`), without the tag. Required.
+     */
+    repo: string;
+    /**
+     * The tag pushed (`1.4.0`).
+     * @default 'latest'
+     */
+    tag?: string;
+    /**
+     * The credentials of the registry; all of them are sent, the tokens included.
+     */
+    auth?: DockerAuthOptions;
+    /**
+     * Receive the push progress as Docker sends it (`{status: 'Pushing', id: '<layer>', progressDetail: {current,
+     * total}}`).
+     */
+    outputCallback?: DockerOutputCallback;
+}

package/dist/types/docker/options/image/ImageRemoveOptions.d.ts

@@ -0,0 +1,26 @@
+import { DTO } from '@lakutata/core';
+/**
+ * How `DockerImage.remove()` removes an image by its ID (`docker rmi`).
+ * @example
+ * ```typescript
+ * import {Docker} from 'lakutata/com/docker'
+ *
+ * declare const docker: Docker
+ *
+ * const image = await docker.getImage('api:1.3.0')
+ * //Fails when a container uses the image
+ * await image.remove({force: false})
+ * ```
+ */
+export declare class ImageRemoveOptions extends DTO {
+    /**
+     * Remove the image even when it has several tags or stopped containers use it (`docker rmi --force`); `false`
+     * fails the removal in these cases. A running container's image is not removed.
+     * @default true
+     */
+    force?: boolean;
+    /**
+     * Keep the untagged parent images (`docker rmi --no-prune`); they are removed with the image when absent.
+     */
+    noprune?: boolean;
+}

package/dist/types/docker/options/image/ImageTagOptions.d.ts

@@ -0,0 +1,25 @@
+import { DTO } from '@lakutata/core';
+/**
+ * The name `DockerImage.tag()` gives an image (`docker tag`), in addition to its other ones. `repo` is required.
+ * @example
+ * ```typescript
+ * import {Docker} from 'lakutata/com/docker'
+ *
+ * declare const docker: Docker
+ *
+ * const image = await docker.getImage('api:1.4.0')
+ * await image.tag({repo: 'registry.example.com:5000/team/api', tag: 'stable'})
+ * console.log(image.repoTags)
+ * ```
+ */
+export declare class ImageTagOptions extends DTO {
+    /**
+     * The repository, with its registry when it is not Docker Hub (`someuser/someimage`,
+     * `registry.example.com:5000/team/api`). Required.
+     */
+    repo: string;
+    /**
+     * The tag (`stable`); Docker uses `latest` when absent.
+     */
+    tag?: string;
+}

package/dist/types/docker/options/network/NetworkCreateOptions.d.ts

@@ -0,0 +1,54 @@
+import { DTO } from '@lakutata/core';
+import { NetworkIPAMConfig } from '../../types/NetworkInfo.js';
+/**
+ * The network {@link Docker.createNetwork} creates (`docker network create`), the created network returned. Only `name`
+ * is required.
+ * @example
+ * ```typescript
+ * import {Docker} from 'lakutata/com/docker'
+ *
+ * declare const docker: Docker
+ *
+ * const network = await docker.createNetwork({
+ *     name: 'back',
+ *     internal: true,
+ *     NetworkIPAMConfigs: [{subnet: '172.28.0.0/16', range: '172.28.5.0/24', gateway: '172.28.0.1'}]
+ * })
+ * //Its containers get their addresses from 172.28.5.0/24, or the static ones given to their settings
+ * console.log(network.id)
+ * ```
+ */
+export declare class NetworkCreateOptions extends DTO {
+    /**
+     * The network name, unique on the Docker host. Required.
+     */
+    name: string;
+    /**
+     * The driver's options, by name (`{'com.docker.network.bridge.name': 'br-back'}` for `bridge`,
+     * `{parent: 'eth0'}` for `macvlan` and `ipvlan`).
+     * @default {}
+     */
+    options?: Record<string, string>;
+    /**
+     * The network driver: `'bridge'`, `'ipvlan'` or `'macvlan'`; another value fails the validation.
+     * @default 'bridge'
+     */
+    driver?: 'bridge' | 'ipvlan' | 'macvlan';
+    /**
+     * The network's address ranges, each one required to have its `subnet` (in CIDR notation) and its `gateway` (an
+     * address without a prefix length), its `range` optional (in CIDR notation); a value in another notation fails the
+     * validation. Empty or absent for a subnet Docker chooses. Its name is in PascalCase, unlike the other options.
+     * @default []
+     */
+    NetworkIPAMConfigs?: NetworkIPAMConfig[];
+    /**
+     * Isolate the network from the outside (`docker network create --internal`): its containers reach each other, not
+     * the host's networks nor the Internet.
+     */
+    internal?: boolean;
+    /**
+     * Enable IPv6 on the network (`docker network create --ipv6`); give it an IPv6 subnet in `NetworkIPAMConfigs`, or
+     * Docker allocates one from its default pools when configured.
+     */
+    enableIPv6?: boolean;
+}

package/dist/types/docker/types/ContainerBind.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A bind mount of a container: a host file or directory mounted into the container. Read from the container's bind
+ * mounts (`DockerContainer.binds`, the named and anonymous volumes excluded), and given to
+ * {@link ContainerSettingOptions.binds}, sent to Docker as `"hostPath:containerPath:rw"` or `"hostPath:containerPath:ro"`.
+ */
+export type ContainerBind = {
+    /**
+     * The absolute path of the file or directory on the host (`/srv/app/data`).
+     */
+    hostPath: string;
+    /**
+     * The absolute path where it is mounted in the container (`/data`).
+     */
+    containerPath: string;
+    /**
+     * `true` when the container can write to it, `false` when it is mounted read-only.
+     */
+    rw: boolean;
+};

package/dist/types/docker/types/ContainerCapability.d.ts

@@ -0,0 +1,286 @@
+/**
+ * The Linux capabilities a container's processes can be given, by their names without the `CAP_` prefix (see
+ * capabilities(7)), for {@link ContainerSettingOptions.capabilities} (`docker run --cap-add`). Docker grants a default
+ * set already (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`,
+ * `NET_RAW`, `SYS_CHROOT`, `MKNOD`, `AUDIT_WRITE`, `SETFCAP`); a privileged container has them all.
+ */
+export declare enum ContainerCapability {
+    /**
+     * Enable and disable kernel auditing; change auditing filter rules; retrieve auditing status and filtering rules.
+     * (since Linux 2.6.11)
+     */
+    AUDIT_CONTROL = "AUDIT_CONTROL",
+    /**
+     * Allow reading the audit log via a multicast netlink socket.
+     * (since Linux 3.16)
+     */
+    AUDIT_READ = "AUDIT_READ",
+    /**
+     * Write records to kernel auditing log.
+     * (since Linux 2.6.11)
+     */
+    AUDIT_WRITE = "AUDIT_WRITE",
+    /**
+     * Employ features that can block system suspend (epoll(7) EPOLLWAKEUP, /proc/sys/wake_lock).
+     * (since Linux 3.5)
+     */
+    BLOCK_SUSPEND = "BLOCK_SUSPEND",
+    /**
+     * Employ privileged BPF operations; see bpf(2) and bpf-helpers(7).
+     * This capability was added in Linux 5.8 to separate out BPF functionality from the overloaded CAP_SYS_ADMIN capability.
+     * (since Linux 5.8)
+     */
+    BPF = "BPF",
+    /**
+     * •  Update /proc/sys/kernel/ns_last_pid (see pid_namespaces(7));
+     * •  employ the set_tid feature of clone3(2);
+     * •  read the contents of the symbolic links in /proc/pid/map_files for other processes.
+     * This capability was added in Linux 5.9 to separate out checkpoint/restore functionality from the overloaded CAP_SYS_ADMIN capability.
+     * (since Linux 5.9)
+     */
+    CHECKPOINT_RESTORE = "CHECKPOINT_RESTORE",
+    /**
+     * Make arbitrary changes to file UIDs and GIDs (see chown(2)).
+     */
+    CHOWN = "CHOWN",
+    /**
+     * Bypass file read, write, and execute permission checks. (DAC is an abbreviation of "discretionary access control".)
+     */
+    DAC_OVERRIDE = "DAC_OVERRIDE",
+    /**
+     * •  Bypass file read permission checks and directory read and execute permission checks;
+     * •  invoke open_by_handle_at(2);
+     * •  use the linkat(2) AT_EMPTY_PATH flag to create a link to a file referred to by a file descriptor.
+     */
+    DAC_READ_SEARCH = "DAC_READ_SEARCH",
+    /**
+     * •  Bypass permission checks on operations that normally require the filesystem UID of the process to match the UID of the file (e.g., chmod(2), utime(2)), excluding those operations covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH;
+     * •  set inode flags (see ioctl_iflags(2)) on arbitrary files;
+     * •  set Access Control Lists (ACLs) on arbitrary files;
+     * •  ignore directory sticky bit on file deletion;
+     * •  modify user extended attributes on sticky directory owned by any user;
+     * •  specify O_NOATIME for arbitrary files in open(2) and fcntl(2).
+     */
+    FOWNER = "FOWNER",
+    /**
+     * •  Don't clear set-user-ID and set-group-ID mode bits when a file is modified;
+     * •  set the set-group-ID bit for a file whose GID does not match the filesystem or any of the supplementary GIDs of the calling process.
+     */
+    FSETID = "FSETID",
+    /**
+     * •  Lock memory (mlock(2), mlockall(2), mmap(2), shmctl(2));
+     * •  Allocate memory using huge pages (memfd_create(2), mmap(2), shmctl(2)).
+     */
+    IPC_LOCK = "IPC_LOCK",
+    /**
+     * Bypass permission checks for operations on System V IPC objects.
+     */
+    IPC_OWNER = "IPC_OWNER",
+    /**
+     * Bypass permission checks for sending signals (see kill(2)).  This includes use of the ioctl(2) KDSIGACCEPT operation.
+     */
+    KILL = "KILL",
+    /**
+     * Establish leases on arbitrary files (see fcntl(2)).
+     * (since Linux 2.4)
+     */
+    LEASE = "LEASE",
+    /**
+     * Set the FS_APPEND_FL and FS_IMMUTABLE_FL inode flags (see ioctl_iflags(2)).
+     */
+    LINUX_IMMUTABLE = "LINUX_IMMUTABLE",
+    /**
+     * Allow MAC configuration or state changes.  Implemented for the Smack Linux Security Module (LSM).
+     * (since Linux 2.6.25)
+     */
+    MAC_ADMIN = "MAC_ADMIN",
+    /**
+     * Override Mandatory Access Control (MAC).  Implemented for the Smack LSM.
+     * (since Linux 2.6.25)
+     */
+    MAC_OVERRIDE = "MAC_OVERRIDE",
+    /**
+     * Create special files using mknod(2).
+     * (since Linux 2.4)
+     */
+    MKNOD = "MKNOD",
+    /**
+     * Perform various network-related operations:
+     * •  interface configuration;
+     * •  administration of IP firewall, masquerading, and accounting;
+     * •  modify routing tables;
+     * •  bind to any address for transparent proxying;
+     * •  set type-of-service (TOS);
+     * •  clear driver statistics;
+     * •  set promiscuous mode;
+     * •  enabling multicasting;
+     * •  use setsockopt(2) to set the following socket options: SO_DEBUG, SO_MARK, SO_PRIORITY (for a priority outside the range 0 to 6), SO_RCVBUFFORCE, and SO_SNDBUFFORCE.
+     */
+    NET_ADMIN = "NET_ADMIN",
+    /**
+     * Bind a socket to Internet domain privileged ports (port numbers less than 1024).
+     */
+    NET_BIND_SERVICE = "NET_BIND_SERVICE",
+    /**
+     * (Unused)  Make socket broadcasts, and listen to multicasts.
+     */
+    NET_BROADCAST = "NET_BROADCAST",
+    /**
+     * •  Use RAW and PACKET sockets;
+     * •  bind to any address for transparent proxying.
+     */
+    NET_RAW = "NET_RAW",
+    /**
+     * Employ various performance-monitoring mechanisms, including:
+     * •  call perf_event_open(2);
+     * •  employ various BPF operations that have performance implications.
+     * This capability was added in Linux 5.8 to separate out performance monitoring functionality from the overloaded CAP_SYS_ADMIN capability.  See also the kernel source file Documentation/admin-guide/perf-security.rst.
+     * (since Linux 5.8)
+     */
+    PERFMON = "PERFMON",
+    /**
+     * •  Make arbitrary manipulations of process GIDs and supplementary GID list;
+     * •  forge GID when passing socket credentials via UNIX domain sockets;
+     * •  write a group ID mapping in a user namespace (see user_namespaces(7)).
+     */
+    SETGID = "SETGID",
+    /**
+     * Set arbitrary capabilities on a file.
+     * Since Linux 5.12, this capability is also needed to map user ID 0 in a new user namespace; see user_namespaces(7) for details.
+     * (since Linux 2.6.24)
+     */
+    SETFCAP = "SETFCAP",
+    /**
+     * If file capabilities are supported (i.e., since Linux 2.6.24): add any capability from the calling thread's bounding set to its inheritable set; drop capabilities from the bounding set (via prctl(2) PR_CAPBSET_DROP); make changes to the securebits flags.
+     * If file capabilities are not supported (i.e., before Linux 2.6.24): grant or remove any capability in the caller's permitted capability set to or from any other process. (This property of CAP_SETPCAP is not available when the kernel is configured to support file capabilities, since CAP_SETPCAP has entirely different semantics for such kernels.)
+     */
+    SETPCAP = "SETPCAP",
+    /**
+     * •  Make arbitrary manipulations of process UIDs (setuid(2), setreuid(2), setresuid(2), setfsuid(2));
+     * •  forge UID when passing socket credentials via UNIX domain sockets;
+     * •  write a user ID mapping in a user namespace (see user_namespaces(7)).
+     */
+    SETUID = "SETUID",
+    /**
+     * Note: this capability is overloaded; see Notes to kernel developers below.
+     * •  Perform a range of system administration operations including: quotactl(2), mount(2), umount(2), pivot_root(2), swapon(2), swapoff(2), sethostname(2), and setdomainname(2);
+     * •  perform privileged syslog(2) operations (since Linux 2.6.37, CAP_SYSLOG should be used to permit such operations);
+     * •  perform VM86_REQUEST_IRQ vm86(2) command;
+     * •  access the same checkpoint/restore functionality that is governed by CAP_CHECKPOINT_RESTORE (but the latter, weaker capability is preferred for accessing that functionality).
+     * •  perform the same BPF operations as are governed by CAP_BPF (but the latter, weaker capability is preferred for accessing that functionality).
+     * •  employ the same performance monitoring mechanisms as are governed by CAP_PERFMON (but the latter, weaker capability is preferred for accessing that functionality).
+     * •  perform IPC_SET and IPC_RMID operations on arbitrary System V IPC objects;
+     * •  override RLIMIT_NPROC resource limit;
+     * •  perform operations on trusted and security extended attributes (see xattr(7));
+     * •  use lookup_dcookie(2);
+     * •  use ioprio_set(2) to assign IOPRIO_CLASS_RT and (before Linux 2.6.25) IOPRIO_CLASS_IDLE I/O scheduling classes;
+     * •  forge PID when passing socket credentials via UNIX domain sockets;
+     * •  exceed /proc/sys/fs/file-max, the system-wide limit on the number of open files, in system calls that open files (e.g., accept(2), execve(2), open(2), pipe(2));
+     * •  employ CLONE_* flags that create new namespaces with clone(2) and unshare(2) (but, since Linux 3.8, creating user namespaces does not require any capability);
+     * •  access privileged perf event information;
+     * •  call setns(2) (requires CAP_SYS_ADMIN in the target namespace);
+     * •  call fanotify_init(2);
+     * •  perform privileged KEYCTL_CHOWN and KEYCTL_SETPERM keyctl(2) operations;
+     * •  perform madvise(2) MADV_HWPOISON operation;
+     * •  employ the TIOCSTI ioctl(2) to insert characters into the input queue of a terminal other than the caller's controlling terminal;
+     * •  employ the obsolete nfsservctl(2) system call;
+     * •  employ the obsolete bdflush(2) system call;
+     * •  perform various privileged block-device ioctl(2) operations;
+     * •  perform various privileged filesystem ioctl(2) operations;
+     * •  perform privileged ioctl(2) operations on the /dev/random device (see random(4));
+     * •  install a seccomp(2) filter without first having to set the no_new_privs thread attribute;
+     * •  modify allow/deny rules for device control groups;
+     * •  employ the ptrace(2) PTRACE_SECCOMP_GET_FILTER operation to dump tracee's seccomp filters;
+     * •  employ the ptrace(2) PTRACE_SETOPTIONS operation to suspend the tracee's seccomp protections (i.e., the PTRACE_O_SUSPEND_SECCOMP flag);
+     * •  perform administrative operations on many device drivers;
+     * •  modify autogroup nice values by writing to /proc/pid/autogroup (see sched(7)).
+     */
+    SYS_ADMIN = "SYS_ADMIN",
+    /**
+     * Use reboot(2) and kexec_load(2).
+     */
+    SYS_BOOT = "SYS_BOOT",
+    /**
+     * •  Use chroot(2);
+     * •  change mount namespaces using setns(2).
+     */
+    SYS_CHROOT = "SYS_CHROOT",
+    /**
+     * •  Load and unload kernel modules (see init_module(2) and delete_module(2));
+     * •  before Linux 2.6.25: drop capabilities from the system-wide capability bounding set.
+     */
+    SYS_MODULE = "SYS_MODULE",
+    /**
+     * •  Lower the process nice value (nice(2), setpriority(2)) and change the nice value for arbitrary processes;
+     * •  set real-time scheduling policies for calling process, and set scheduling policies and priorities for arbitrary processes (sched_setscheduler(2), sched_setparam(2), sched_setattr(2));
+     * •  set CPU affinity for arbitrary processes (sched_setaffinity(2));
+     * •  set I/O scheduling class and priority for arbitrary processes (ioprio_set(2));
+     * •  apply migrate_pages(2) to arbitrary processes and allow processes to be migrated to arbitrary nodes;
+     * •  apply move_pages(2) to arbitrary processes;
+     * •  use the MPOL_MF_MOVE_ALL flag with mbind(2) and move_pages(2).
+     */
+    SYS_NICE = "SYS_NICE",
+    /**
+     * Use acct(2).
+     */
+    SYS_PACCT = "SYS_PACCT",
+    /**
+     * •  Trace arbitrary processes using ptrace(2);
+     * •  apply get_robust_list(2) to arbitrary processes;
+     * •  transfer data to or from the memory of arbitrary processes using process_vm_readv(2) and process_vm_writev(2);
+     * •  inspect processes using kcmp(2).
+     */
+    SYS_PTRACE = "SYS_PTRACE",
+    /**
+     * •  Perform I/O port operations (iopl(2) and ioperm(2));
+     * •  access /proc/kcore;
+     * •  employ the FIBMAP ioctl(2) operation;
+     * •  open devices for accessing x86 model-specific registers (MSRs, see msr(4));
+     * •  update /proc/sys/vm/mmap_min_addr;
+     * •  create memory mappings at addresses below the value specified by /proc/sys/vm/mmap_min_addr;
+     * •  map files in /proc/bus/pci;
+     * •  open /dev/mem and /dev/kmem;
+     * •  perform various SCSI device commands;
+     * •  perform certain operations on hpsa(4) and cciss(4) devices;
+     * •  perform a range of device-specific operations on other devices.
+     */
+    SYS_RAWIO = "SYS_RAWIO",
+    /**
+     * •  Use reserved space on ext2 filesystems;
+     * •  make ioctl(2) calls controlling ext3 journaling;
+     * •  override disk quota limits;
+     * •  increase resource limits (see setrlimit(2));
+     * •  override RLIMIT_NPROC resource limit;
+     * •  override maximum number of consoles on console allocation;
+     * •  override maximum number of keymaps;
+     * •  allow more than 64hz interrupts from the real-time clock;
+     * •  raise msg_qbytes limit for a System V message queue above the limit in /proc/sys/kernel/msgmnb (see msgop(2) and msgctl(2));
+     * •  allow the RLIMIT_NOFILE resource limit on the number of "in-flight" file descriptors to be bypassed when passing file descriptors to another process via a UNIX domain socket (see unix(7));
+     * •  override the /proc/sys/fs/pipe-size-max limit when setting the capacity of a pipe using the F_SETPIPE_SZ fcntl(2) command;
+     * •  use F_SETPIPE_SZ to increase the capacity of a pipe above the limit specified by /proc/sys/fs/pipe-max-size;
+     * •  override /proc/sys/fs/mqueue/queues_max, /proc/sys/fs/mqueue/msg_max, and /proc/sys/fs/mqueue/msgsize_max limits when creating POSIX message queues (see mq_overview(7));
+     * •  employ the prctl(2) PR_SET_MM operation;
+     * •  set /proc/pid/oom_score_adj to a value lower than the value last set by a process with CAP_SYS_RESOURCE.
+     */
+    SYS_RESOURCE = "SYS_RESOURCE",
+    /**
+     * Set system clock (settimeofday(2), stime(2), adjtimex(2));
+     * set real-time (hardware) clock.
+     */
+    SYS_TIME = "SYS_TIME",
+    /**
+     *  Use vhangup(2); employ various privileged ioctl(2) operations on virtual terminals.
+     */
+    SYS_TTY_CONFIG = "SYS_TTY_CONFIG",
+    /**
+     * •  Perform privileged syslog(2) operations.  See syslog(2) for information on which operations require privilege.
+     * •  View kernel addresses exposed via /proc and other interfaces when /proc/sys/kernel/kptr_restrict has the value 1.  (See the discussion of the kptr_restrict in proc(5).)
+     * (since Linux 2.6.37)
+     */
+    SYSLOG = "SYSLOG",
+    /**
+     * Trigger something that will wake up the system (set CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM timers).
+     * (since Linux 3.0)
+     */
+    WAKE_ALARM = "WAKE_ALARM"
+}

package/dist/types/docker/types/ContainerConfig.d.ts

@@ -0,0 +1,67 @@
+/**
+ * A container's resource settings, in the Docker Engine's terms. No method of the component returns or accepts it:
+ * {@link DockerContainer} exposes these settings as its own properties (`memoryLimit`, `cpuSet`, `devices`,
+ * `OOMKillDisable`, `restartPolicy`), and {@link ContainerSettingOptions} sets them.
+ */
+export type ContainerConfig = {
+    /**
+     * The memory limit, in bytes; `0` for no limit.
+     */
+    memory: number;
+    /**
+     * The indexes of the host CPUs the container may run on (`[0, 1]`).
+     */
+    cpus: number[];
+    /**
+     * The host devices made available in the container.
+     */
+    devices: {
+        /**
+         * The path of the device on the host (`/dev/ttyUSB0`).
+         */
+        hostPath: string;
+        /**
+         * The path of the device in the container.
+         */
+        containerPath: string;
+        /**
+         * What the container's cgroup allows on the device: a combination of `r`, `w` and `m` (`"rwm"`).
+         */
+        cgroupPermissions: string;
+    }[];
+    /**
+     * `true` when the kernel's OOM killer does not kill the container's processes when it runs out of memory.
+     */
+    OOMKillDisable: boolean;
+    /**
+     * The resource limits (ulimits) of the container's processes.
+     */
+    ulimits: {
+        /**
+         * The limit name (`nofile`, `nproc`).
+         */
+        name: string;
+        /**
+         * The soft limit, which a process can raise up to the hard limit.
+         */
+        soft: number;
+        /**
+         * The hard limit.
+         */
+        hard: number;
+    }[];
+    /**
+     * When Docker restarts the container after it exits.
+     */
+    restartPolicy: {
+        /**
+         * The policy: `''` or `'no'`, never; `'always'`, always; `'unless-stopped'`, always except after the container
+         * was stopped by hand; `'on-failure'`, only when it exits with a non-zero code.
+         */
+        name: '' | 'no' | 'always' | 'unless-stopped' | 'on-failure';
+        /**
+         * With `'on-failure'`, the number of restarts before Docker gives up; `0` for no limit.
+         */
+        maximumRetryCount: number;
+    };
+};

package/dist/types/docker/types/ContainerDevice.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A host device made available in a container (`docker run --device`). Read from the container's settings
+ * (`DockerContainer.devices`) and given to {@link ContainerSettingOptions.devices}.
+ */
+export type ContainerDevice = {
+    /**
+     * The path of the device on the host (`/dev/ttyUSB0`).
+     */
+    hostPath: string;
+    /**
+     * The path of the device in the container (`/dev/ttyUSB0`).
+     */
+    containerPath: string;
+    /**
+     * What the container's cgroup allows on the device: a combination of `r` (read), `w` (write) and `m` (create
+     * device nodes with mknod), `"rwm"` for all of them.
+     */
+    cgroupPermissions: string;
+};