profile

Documentation

Overview

Package profile validates the immutable OCI bootstrap profile before an engine-specific command can be constructed.

Index

• Constants
• type Profile
• type ValidationResult
  • func ValidateBootstrapProfile(document, schema, lockManifest []byte) ValidationResult

Constants

const (
	SchemaName      = "aurum.container-profile"
	ProfileName     = "bootstrap-readonly-v1"
	ProfileVersion  = 1
	ImageLockSchema = "aurum.oci-image-lock"
	ImageLockPath   = ".board/locks/oci/bootstrap-readonly-v1.lock.json"
)

Types

type Profile

type Profile struct {
	Schema           string `json:"schema"`
	Version          int    `json:"version"`
	Profile          string `json:"profile"`
	Lock             string `json:"lock"`
	LockDigest       string `json:"lock_digest"`
	Network          string `json:"network"`
	User             string `json:"user"`
	CapDrop          string `json:"cap_drop"`
	CapAdd           string `json:"cap_add"`
	Mounts           string `json:"mounts"`
	Devices          string `json:"devices"`
	Pull             string `json:"pull"`
	Tmpfs            string `json:"tmpfs"`
	CheckoutReadonly *bool  `json:"checkout_readonly,omitempty"`
	ReadOnlyRootfs   bool   `json:"read_only_rootfs"`
	NoNewPrivileges  bool   `json:"no_new_privileges"`
	Privileged       bool   `json:"privileged"`
	TimeoutSeconds   int    `json:"timeout_seconds"`
	MemoryMB         int    `json:"memory_mb"`
	CPUMillis        int    `json:"cpu_millis"`
	PIDsLimit        int    `json:"pids_limit"`
	TmpfsMB          int    `json:"tmpfs_mb"`
	StdoutLimitBytes int    `json:"stdout_limit_bytes"`
	StderrLimitBytes int    `json:"stderr_limit_bytes"`
	MaxInputFiles    int    `json:"max_input_files"`
	MaxInputBytes    int    `json:"max_input_bytes"`
}

Profile is the strict bootstrap-readonly-v1 wire representation.

type ValidationResult

type ValidationResult struct {
	Status            string `json:"status"`
	Code              string `json:"code"`
	DocumentDigest    string `json:"document_digest"`
	EngineInvocations int    `json:"engine_invocations"`
}

ValidationResult is the complete observation from one validation attempt. EngineInvocations is intentionally part of the result so callers cannot mistake validation for execution.

func ValidateBootstrapProfile

func ValidateBootstrapProfile(document, schema, lockManifest []byte) ValidationResult

ValidateBootstrapProfile validates one profile and one digest-pinned image lock. It does not contact an OCI engine, a registry, or the network.