internal/

Package certs embeds a bundle of CA root certificates for peel's own use, and can install it into the rootfs for the entrypoint's use too.

Package config loads peel's runtime configuration from disk.

Package entrypoint resolves the OCI image's runtime configuration (plus any peel configuration overrides) into a concrete command that can be executed: an absolute path, argv, environment, working directory and credential.

Package lo lets several LXD containers share their loopback listeners, as if they were containers/pods in the same network namespace.

Package network brings up the container's network interfaces before peel tries to reach a registry.

Package pull fetches an OCI image (manifest, config and layers) from a registry using the configuration produced by package config.

Package rootfs unpacks OCI/Docker image layers directly onto the container's root filesystem, and resets it in preparation for a different image.

Package state persists what peel has already unpacked onto the rootfs, so that restarts of a container whose configured image hasn't changed don't need to talk to a registry at all.

Package supervisor implements the minimal init behaviour peel needs to act as a well-behaved PID 1 for an LXD container: