DefaultCreateCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces defined on the container's configuration and use the current binary as the init with the args provided console: the /dev/console to setup inside the container init: the progam executed inside the namespaces root: the path to the container json file and information pipe: sync pipe to syncronize the parent and child processes args: the arguemnts to pass to the container to run as the user's program.

DeletePid removes the pid and started file from disk when the container's process dies and the container is cleanly removed.

Exec performes setup outside of a namespace so that a container can be executed.

ExecIn uses an existing pid and joins the pid's namespaces with the new command.

FinalizeNamespace drops the caps, sets the correct user and working dir, and closes any leaky file descriptors before execing the command inside the namespace.

GetNamespaceFlags parses the container's Namespaces options to set the correct flags on clone, unshare, and setns.

Init is the init process that first runs inside a new namespace to setup mounts, users, networking, and other options required for the new container.

InitializeNetworking creates the container's network stack outside of the namespace and moves interfaces into the container's net namespaces if necessary.

NsEnter is run after entering the namespace.

RestoreParentDeathSignal sets the parent death signal to old.

SetupCgroups applies the cgroup restrictions to the process running in the contaienr based on the container's configuration.

SetupUser changes the groups, gid, and uid for the user inside the container.

WritePid writes the namespaced processes pid to pid and it's start time to the path specified.

SyncPipe allows communication to and from the child processes to it's parent and allows the two independent processes to syncronize their state.