GetIPCNamespace returns the ipc namespace of a process.

GetNetworkNamespace returns the network namespace of a process.

GetPIDNamespace returns the pid namespace of a process.

GetUTSNamespace returns the uts namespace of a process.

IsCgroup2UnifiedMode returns whether we are running in cgroup v2 unified mode.

WithAdditionalGIDs adds any additional groups listed for a particular user in the /etc/groups file of the image's root filesystem to the OCI spec's additionalGids array.

WithAnnotation sets the provided annotation.

WithCapabilities sets the provided capabilties from the security context.

WithContainerdShimCgroup returns function that sets the containerd shim cgroup path.

WithDefaultSandboxShares sets the default sandbox CPU shares.

WithDevices sets the provided devices onto the container spec.

WithDisabledCgroups clears the Cgroups Path from the spec.

WithMounts sorts and adds runtime and CRI mounts to the spec.

WithNewSnapshot wraps `containerd.WithNewSnapshot` so that if creating the snapshot fails we make sure the image is actually unpacked and and retry.

WithOOMScoreAdj sets the oom score.

WithoutAmbientCaps removes the ambient caps from the spec.

WithoutDefaultSecuritySettings removes the default security settings generated on a spec.

WithoutNamespace removes the provided namespace.

WithoutRoot sets the root to nil for the container.

WithoutRunMount removes the `/run` inside the spec.

WithPodNamespaces sets the pod namespaces for the container.

WithPodOOMScoreAdj sets the oom score for the pod sandbox.

WithProcessArgs sets the process args on the spec based on the image and runtime config.

WithRelativeRoot sets the root for the container.

WithResources sets the provided resource restrictions.

WithSelinuxLabels sets the mount and process labels.

WithSupplementalGroups sets the supplemental groups for the process.

WithSysctls sets the provided sysctls onto the spec.

WithVolumes copies ownership of volume in rootfs to its corresponding host path.

DefaultSandboxCPUshares is default cpu shares for sandbox container.