podman

1
//go:build !remote
2

3
package libpod
4

5
import (
6
	"errors"
7
	"fmt"
8
	"net"
9
	"strings"
10
	"syscall"
11
	"time"
12

13
	"github.com/containers/buildah/pkg/parse"
14
	nettypes "github.com/containers/common/libnetwork/types"
15
	"github.com/containers/common/pkg/config"
16
	"github.com/containers/common/pkg/secrets"
17
	"github.com/containers/image/v5/manifest"
18
	"github.com/containers/image/v5/types"
19
	"github.com/containers/podman/v5/libpod/define"
20
	"github.com/containers/podman/v5/libpod/events"
21
	"github.com/containers/podman/v5/pkg/namespaces"
22
	"github.com/containers/podman/v5/pkg/specgen"
23
	"github.com/containers/podman/v5/pkg/util"
24
	"github.com/containers/storage"
25
	"github.com/containers/storage/pkg/fileutils"
26
	"github.com/containers/storage/pkg/idtools"
27
	"github.com/containers/storage/pkg/regexp"
28
	"github.com/opencontainers/runtime-spec/specs-go"
29
	"github.com/opencontainers/runtime-tools/generate"
30
	"github.com/sirupsen/logrus"
31
)
32

33
var umaskRegex = regexp.Delayed(`^[0-7]{1,4}$`)
34

35
// WithStorageConfig uses the given configuration to set up container storage.
36
// If this is not specified, the system default configuration will be used
37
// instead.
38
func WithStorageConfig(config storage.StoreOptions) RuntimeOption {
39
	return func(rt *Runtime) error {
40
		if rt.valid {
41
			return define.ErrRuntimeFinalized
42
		}
43

44
		setField := false
45

46
		if config.RunRoot != "" {
47
			rt.storageConfig.RunRoot = config.RunRoot
48
			rt.storageSet.RunRootSet = true
49
			setField = true
50
		}
51

52
		if config.GraphRoot != "" {
53
			rt.storageConfig.GraphRoot = config.GraphRoot
54
			rt.storageSet.GraphRootSet = true
55
			setField = true
56
		}
57

58
		graphDriverChanged := false
59
		if config.GraphDriverName != "" {
60
			rt.storageConfig.GraphDriverName = config.GraphDriverName
61
			rt.storageSet.GraphDriverNameSet = true
62
			setField = true
63
			graphDriverChanged = true
64
		}
65

66
		if config.GraphDriverOptions != nil {
67
			if graphDriverChanged {
68
				rt.storageConfig.GraphDriverOptions = make([]string, len(config.GraphDriverOptions))
69
				copy(rt.storageConfig.GraphDriverOptions, config.GraphDriverOptions)
70
			} else {
71
				rt.storageConfig.GraphDriverOptions = config.GraphDriverOptions
72
			}
73
			setField = true
74
		}
75

76
		if config.UIDMap != nil {
77
			rt.storageConfig.UIDMap = make([]idtools.IDMap, len(config.UIDMap))
78
			copy(rt.storageConfig.UIDMap, config.UIDMap)
79
		}
80

81
		if config.GIDMap != nil {
82
			rt.storageConfig.GIDMap = make([]idtools.IDMap, len(config.GIDMap))
83
			copy(rt.storageConfig.GIDMap, config.GIDMap)
84
		}
85

86
		// If any one of runroot, graphroot, graphdrivername,
87
		// or graphdriveroptions are set, then GraphRoot and RunRoot
88
		// must be set
89
		if setField {
90
			storeOpts, err := storage.DefaultStoreOptions()
91
			if err != nil {
92
				return err
93
			}
94
			if rt.storageConfig.GraphRoot == "" {
95
				rt.storageConfig.GraphRoot = storeOpts.GraphRoot
96
			}
97
			if rt.storageConfig.RunRoot == "" {
98
				rt.storageConfig.RunRoot = storeOpts.RunRoot
99
			}
100
		}
101

102
		return nil
103
	}
104
}
105

106
func WithTransientStore(transientStore bool) RuntimeOption {
107
	return func(rt *Runtime) error {
108
		if rt.valid {
109
			return define.ErrRuntimeFinalized
110
		}
111

112
		rt.storageConfig.TransientStore = transientStore
113

114
		return nil
115
	}
116
}
117

118
func WithImageStore(imageStore string) RuntimeOption {
119
	return func(rt *Runtime) error {
120
		if rt.valid {
121
			return define.ErrRuntimeFinalized
122
		}
123

124
		rt.storageConfig.ImageStore = imageStore
125

126
		return nil
127
	}
128
}
129

130
// WithSignaturePolicy specifies the path of a file which decides how trust is
131
// managed for images we've pulled.
132
// If this is not specified, the system default configuration will be used
133
// instead.
134
func WithSignaturePolicy(path string) RuntimeOption {
135
	return func(rt *Runtime) error {
136
		if rt.valid {
137
			return define.ErrRuntimeFinalized
138
		}
139

140
		rt.config.Engine.SignaturePolicyPath = path
141

142
		return nil
143
	}
144
}
145

146
// WithOCIRuntime specifies an OCI runtime to use for running containers.
147
func WithOCIRuntime(runtime string) RuntimeOption {
148
	return func(rt *Runtime) error {
149
		if rt.valid {
150
			return define.ErrRuntimeFinalized
151
		}
152

153
		if runtime == "" {
154
			return fmt.Errorf("must provide a valid path: %w", define.ErrInvalidArg)
155
		}
156

157
		rt.config.Engine.OCIRuntime = runtime
158

159
		return nil
160
	}
161
}
162

163
// WithCtrOCIRuntime specifies an OCI runtime in container's config.
164
func WithCtrOCIRuntime(runtime string) CtrCreateOption {
165
	return func(ctr *Container) error {
166
		if ctr.valid {
167
			return define.ErrCtrFinalized
168
		}
169
		ctr.config.OCIRuntime = runtime
170
		return nil
171
	}
172
}
173

174
// WithConmonPath specifies the path to the conmon binary which manages the
175
// runtime.
176
func WithConmonPath(path string) RuntimeOption {
177
	return func(rt *Runtime) error {
178
		if rt.valid {
179
			return define.ErrRuntimeFinalized
180
		}
181

182
		if path == "" {
183
			return fmt.Errorf("must provide a valid path: %w", define.ErrInvalidArg)
184
		}
185

186
		rt.config.Engine.ConmonPath.Set([]string{path})
187

188
		return nil
189
	}
190
}
191

192
// WithConmonEnv specifies the environment variable list for the conmon process.
193
func WithConmonEnv(environment []string) RuntimeOption {
194
	return func(rt *Runtime) error {
195
		if rt.valid {
196
			return define.ErrRuntimeFinalized
197
		}
198

199
		rt.config.Engine.ConmonEnvVars.Set(environment)
200

201
		return nil
202
	}
203
}
204

205
// WithNetworkCmdPath specifies the path to the slirp4netns binary which manages the
206
// runtime.
207
func WithNetworkCmdPath(path string) RuntimeOption {
208
	return func(rt *Runtime) error {
209
		if rt.valid {
210
			return define.ErrRuntimeFinalized
211
		}
212

213
		rt.config.Engine.NetworkCmdPath = path
214

215
		return nil
216
	}
217
}
218

219
// WithNetworkBackend specifies the name of the network backend.
220
func WithNetworkBackend(name string) RuntimeOption {
221
	return func(rt *Runtime) error {
222
		if rt.valid {
223
			return define.ErrRuntimeFinalized
224
		}
225

226
		rt.config.Network.NetworkBackend = name
227

228
		return nil
229
	}
230
}
231

232
// WithCgroupManager specifies the manager implementation name which is used to
233
// handle cgroups for containers.
234
// Current valid values are "cgroupfs" and "systemd".
235
func WithCgroupManager(manager string) RuntimeOption {
236
	return func(rt *Runtime) error {
237
		if rt.valid {
238
			return define.ErrRuntimeFinalized
239
		}
240

241
		if manager != config.CgroupfsCgroupsManager && manager != config.SystemdCgroupsManager {
242
			return fmt.Errorf("cgroup manager must be one of %s and %s: %w",
243
				config.CgroupfsCgroupsManager, config.SystemdCgroupsManager, define.ErrInvalidArg)
244
		}
245

246
		rt.config.Engine.CgroupManager = manager
247

248
		return nil
249
	}
250
}
251

252
// WithStaticDir sets the directory that static runtime files which persist
253
// across reboots will be stored.
254
func WithStaticDir(dir string) RuntimeOption {
255
	return func(rt *Runtime) error {
256
		if rt.valid {
257
			return define.ErrRuntimeFinalized
258
		}
259

260
		rt.config.Engine.StaticDir = dir
261

262
		return nil
263
	}
264
}
265

266
// WithRegistriesConf configures the runtime to always use specified
267
// registries.conf for image processing.
268
func WithRegistriesConf(path string) RuntimeOption {
269
	logrus.Debugf("Setting custom registries.conf: %q", path)
270
	return func(rt *Runtime) error {
271
		if err := fileutils.Exists(path); err != nil {
272
			return fmt.Errorf("locating specified registries.conf: %w", err)
273
		}
274
		if rt.imageContext == nil {
275
			rt.imageContext = &types.SystemContext{
276
				BigFilesTemporaryDir: parse.GetTempDir(),
277
			}
278
		}
279

280
		rt.imageContext.SystemRegistriesConfPath = path
281
		return nil
282
	}
283
}
284

285
// WithDatabaseBackend configures the runtime's database backend.
286
func WithDatabaseBackend(value string) RuntimeOption {
287
	logrus.Debugf("Setting custom database backend: %q", value)
288
	return func(rt *Runtime) error {
289
		// The value will be parsed later on.
290
		rt.config.Engine.DBBackend = value
291
		return nil
292
	}
293
}
294

295
// WithHooksDir sets the directories to look for OCI runtime hook configuration.
296
func WithHooksDir(hooksDirs ...string) RuntimeOption {
297
	return func(rt *Runtime) error {
298
		if rt.valid {
299
			return define.ErrRuntimeFinalized
300
		}
301

302
		for _, hooksDir := range hooksDirs {
303
			if hooksDir == "" {
304
				return fmt.Errorf("empty-string hook directories are not supported: %w", define.ErrInvalidArg)
305
			}
306
		}
307

308
		rt.config.Engine.HooksDir.Set(hooksDirs)
309
		return nil
310
	}
311
}
312

313
// WithCDI sets the devices to check for CDI configuration.
314
func WithCDI(devices []string) CtrCreateOption {
315
	return func(ctr *Container) error {
316
		if ctr.valid {
317
			return define.ErrCtrFinalized
318
		}
319
		ctr.config.CDIDevices = devices
320
		return nil
321
	}
322
}
323

324
// WithStorageOpts sets the devices to check for CDI configuration.
325
func WithStorageOpts(storageOpts map[string]string) CtrCreateOption {
326
	return func(ctr *Container) error {
327
		if ctr.valid {
328
			return define.ErrCtrFinalized
329
		}
330
		ctr.config.StorageOpts = storageOpts
331
		return nil
332
	}
333
}
334

335
// WithDefaultMountsFile sets the file to look at for default mounts (mainly
336
// secrets).
337
// Note we are not saving this in the database as it is for testing purposes
338
// only.
339
func WithDefaultMountsFile(mountsFile string) RuntimeOption {
340
	return func(rt *Runtime) error {
341
		if rt.valid {
342
			return define.ErrRuntimeFinalized
343
		}
344

345
		if mountsFile == "" {
346
			return define.ErrInvalidArg
347
		}
348
		rt.config.Containers.DefaultMountsFile = mountsFile
349
		return nil
350
	}
351
}
352

353
// WithTmpDir sets the directory that temporary runtime files which are not
354
// expected to survive across reboots will be stored.
355
// This should be located on a tmpfs mount (/tmp or /run for example).
356
func WithTmpDir(dir string) RuntimeOption {
357
	return func(rt *Runtime) error {
358
		if rt.valid {
359
			return define.ErrRuntimeFinalized
360
		}
361
		rt.config.Engine.TmpDir = dir
362

363
		return nil
364
	}
365
}
366

367
// WithNoPivotRoot sets the runtime to use MS_MOVE instead of PIVOT_ROOT when
368
// starting containers.
369
func WithNoPivotRoot() RuntimeOption {
370
	return func(rt *Runtime) error {
371
		if rt.valid {
372
			return define.ErrRuntimeFinalized
373
		}
374

375
		rt.config.Engine.NoPivotRoot = true
376

377
		return nil
378
	}
379
}
380

381
// WithNetworkConfigDir sets the network configuration directory.
382
func WithNetworkConfigDir(dir string) RuntimeOption {
383
	return func(rt *Runtime) error {
384
		if rt.valid {
385
			return define.ErrRuntimeFinalized
386
		}
387

388
		rt.config.Network.NetworkConfigDir = dir
389

390
		return nil
391
	}
392
}
393

394
// WithCNIPluginDir sets the CNI plugins directory.
395
func WithCNIPluginDir(dir string) RuntimeOption {
396
	return func(rt *Runtime) error {
397
		if rt.valid {
398
			return define.ErrRuntimeFinalized
399
		}
400

401
		rt.config.Network.CNIPluginDirs.Set([]string{dir})
402

403
		return nil
404
	}
405
}
406

407
// WithNamespace sets the namespace for libpod.
408
// Namespaces are used to create scopes to separate containers and pods
409
// in the state.
410
// When namespace is set, libpod will only view containers and pods in
411
// the same namespace. All containers and pods created will default to
412
// the namespace set here.
413
// A namespace of "", the empty string, is equivalent to no namespace,
414
// and all containers and pods will be visible.
415
func WithNamespace(ns string) RuntimeOption {
416
	return func(rt *Runtime) error {
417
		if rt.valid {
418
			return define.ErrRuntimeFinalized
419
		}
420

421
		rt.config.Engine.Namespace = ns
422

423
		return nil
424
	}
425
}
426

427
// WithVolumePath sets the path under which all named volumes
428
// should be created.
429
// The path changes based on whether the user is running as root or not.
430
func WithVolumePath(volPath string) RuntimeOption {
431
	return func(rt *Runtime) error {
432
		if rt.valid {
433
			return define.ErrRuntimeFinalized
434
		}
435

436
		rt.config.Engine.VolumePath = volPath
437
		rt.storageSet.VolumePathSet = true
438

439
		return nil
440
	}
441
}
442

443
// WithDefaultInfraCommand sets the command to
444
// run on pause container start up.
445
func WithDefaultInfraCommand(cmd string) RuntimeOption {
446
	return func(rt *Runtime) error {
447
		if rt.valid {
448
			return define.ErrRuntimeFinalized
449
		}
450

451
		rt.config.Engine.InfraCommand = cmd
452

453
		return nil
454
	}
455
}
456

457
// WithReset tells Libpod that the runtime will be used to perform a system
458
// reset. A number of checks at initialization are relaxed as the runtime is
459
// going to be used to remove all containers, pods, volumes, images, and
460
// networks.
461
func WithReset() RuntimeOption {
462
	return func(rt *Runtime) error {
463
		if rt.valid {
464
			return define.ErrRuntimeFinalized
465
		}
466

467
		rt.doReset = true
468

469
		return nil
470
	}
471
}
472

473
// WithRenumber tells Libpod that the runtime will be used to perform a system
474
// renumber. A number of checks on initialization related to locks are relaxed.
475
func WithRenumber() RuntimeOption {
476
	return func(rt *Runtime) error {
477
		if rt.valid {
478
			return define.ErrRuntimeFinalized
479
		}
480

481
		rt.doRenumber = true
482

483
		return nil
484
	}
485
}
486

487
// WithEventsLogger sets the events backend to use.
488
// Currently supported values are "file" for file backend and "journald" for
489
// journald backend.
490
func WithEventsLogger(logger string) RuntimeOption {
491
	return func(rt *Runtime) error {
492
		if rt.valid {
493
			return define.ErrRuntimeFinalized
494
		}
495

496
		if !events.IsValidEventer(logger) {
497
			return fmt.Errorf("%q is not a valid events backend: %w", logger, define.ErrInvalidArg)
498
		}
499

500
		rt.config.Engine.EventsLogger = logger
501
		return nil
502
	}
503
}
504

505
// WithEnableSDNotify sets a runtime option so we know whether to disable socket/FD
506
// listening
507
func WithEnableSDNotify() RuntimeOption {
508
	return func(rt *Runtime) error {
509
		rt.config.Engine.SDNotify = true
510
		return nil
511
	}
512
}
513

514
// WithSyslog sets a runtime option so we know that we have to log to the syslog as well
515
func WithSyslog() RuntimeOption {
516
	return func(rt *Runtime) error {
517
		rt.syslog = true
518
		return nil
519
	}
520
}
521

522
// WithRuntimeFlags adds the global runtime flags to the container config
523
func WithRuntimeFlags(runtimeFlags []string) RuntimeOption {
524
	return func(rt *Runtime) error {
525
		if rt.valid {
526
			return define.ErrRuntimeFinalized
527
		}
528
		rt.runtimeFlags = runtimeFlags
529
		return nil
530
	}
531
}
532

533
// Container Creation Options
534

535
// WithMaxLogSize sets the maximum size of container logs.
536
// Positive sizes are limits in bytes, -1 is unlimited.
537
func WithMaxLogSize(limit int64) CtrCreateOption {
538
	return func(ctr *Container) error {
539
		if ctr.valid {
540
			return define.ErrRuntimeFinalized
541
		}
542
		ctr.config.LogSize = limit
543

544
		return nil
545
	}
546
}
547

548
// WithShmDir sets the directory that should be mounted on /dev/shm.
549
func WithShmDir(dir string) CtrCreateOption {
550
	return func(ctr *Container) error {
551
		if ctr.valid {
552
			return define.ErrCtrFinalized
553
		}
554

555
		ctr.config.ShmDir = dir
556
		return nil
557
	}
558
}
559

560
// WithNOShmMount tells libpod whether to mount /dev/shm
561
func WithNoShm(mount bool) CtrCreateOption {
562
	return func(ctr *Container) error {
563
		if ctr.valid {
564
			return define.ErrCtrFinalized
565
		}
566

567
		ctr.config.NoShm = mount
568
		return nil
569
	}
570
}
571

572
// WithNoShmShare tells libpod whether to share containers /dev/shm with other containers
573
func WithNoShmShare(share bool) CtrCreateOption {
574
	return func(ctr *Container) error {
575
		if ctr.valid {
576
			return define.ErrCtrFinalized
577
		}
578

579
		ctr.config.NoShmShare = share
580
		return nil
581
	}
582
}
583

584
// WithSystemd turns on systemd mode in the container
585
func WithSystemd() CtrCreateOption {
586
	return func(ctr *Container) error {
587
		if ctr.valid {
588
			return define.ErrCtrFinalized
589
		}
590

591
		t := true
592
		ctr.config.Systemd = &t
593
		return nil
594
	}
595
}
596

597
// WithSdNotifySocket sets the sd-notify of the container
598
func WithSdNotifySocket(socketPath string) CtrCreateOption {
599
	return func(ctr *Container) error {
600
		if ctr.valid {
601
			return define.ErrCtrFinalized
602
		}
603
		ctr.config.SdNotifySocket = socketPath
604
		return nil
605
	}
606
}
607

608
// WithSdNotifyMode sets the sd-notify method
609
func WithSdNotifyMode(mode string) CtrCreateOption {
610
	return func(ctr *Container) error {
611
		if ctr.valid {
612
			return define.ErrCtrFinalized
613
		}
614

615
		if err := define.ValidateSdNotifyMode(mode); err != nil {
616
			return err
617
		}
618

619
		ctr.config.SdNotifyMode = mode
620
		return nil
621
	}
622
}
623

624
// WithShmSize sets the size of /dev/shm tmpfs mount.
625
func WithShmSize(size int64) CtrCreateOption {
626
	return func(ctr *Container) error {
627
		if ctr.valid {
628
			return define.ErrCtrFinalized
629
		}
630

631
		ctr.config.ShmSize = size
632
		return nil
633
	}
634
}
635

636
// WithShmSizeSystemd sets the size of systemd-specific mounts:
637
//
638
//	/run
639
//	/run/lock
640
//	/var/log/journal
641
//	/tmp
642
func WithShmSizeSystemd(size int64) CtrCreateOption {
643
	return func(ctr *Container) error {
644
		if ctr.valid {
645
			return define.ErrCtrFinalized
646
		}
647

648
		ctr.config.ShmSizeSystemd = size
649
		return nil
650
	}
651
}
652

653
// WithPrivileged sets the privileged flag in the container runtime.
654
func WithPrivileged(privileged bool) CtrCreateOption {
655
	return func(ctr *Container) error {
656
		if ctr.valid {
657
			return define.ErrCtrFinalized
658
		}
659

660
		ctr.config.Privileged = privileged
661
		return nil
662
	}
663
}
664

665
// WithReadWriteTmpfs sets up read-write tmpfs flag in the container runtime.
666
// Only Used if containers are run in ReadOnly mode.
667
func WithReadWriteTmpfs(readWriteTmpfs bool) CtrCreateOption {
668
	return func(ctr *Container) error {
669
		if ctr.valid {
670
			return define.ErrCtrFinalized
671
		}
672

673
		ctr.config.ReadWriteTmpfs = readWriteTmpfs
674
		return nil
675
	}
676
}
677

678
// WithSecLabels sets the labels for SELinux.
679
func WithSecLabels(labelOpts []string) CtrCreateOption {
680
	return func(ctr *Container) error {
681
		if ctr.valid {
682
			return define.ErrCtrFinalized
683
		}
684
		ctr.config.LabelOpts = labelOpts
685
		return nil
686
	}
687
}
688

689
// WithUser sets the user identity field in configuration.
690
// Valid uses [user | user:group | uid | uid:gid | user:gid | uid:group ].
691
func WithUser(user string) CtrCreateOption {
692
	return func(ctr *Container) error {
693
		if ctr.valid {
694
			return define.ErrCtrFinalized
695
		}
696

697
		ctr.config.User = user
698
		return nil
699
	}
700
}
701

702
// WithRootFSFromImage sets up a fresh root filesystem using the given image.
703
// If useImageConfig is specified, image volumes, environment variables, and
704
// other configuration from the image will be added to the config.
705
// TODO: Replace image name and ID with a libpod.Image struct when that is
706
// finished.
707
func WithRootFSFromImage(imageID, imageName, rawImageName string) CtrCreateOption {
708
	return func(ctr *Container) error {
709
		if ctr.valid {
710
			return define.ErrCtrFinalized
711
		}
712

713
		ctr.config.RootfsImageID = imageID
714
		ctr.config.RootfsImageName = imageName
715
		ctr.config.RawImageName = rawImageName
716
		return nil
717
	}
718
}
719

720
// WithStdin keeps stdin on the container open to allow interaction.
721
func WithStdin() CtrCreateOption {
722
	return func(ctr *Container) error {
723
		if ctr.valid {
724
			return define.ErrCtrFinalized
725
		}
726

727
		ctr.config.Stdin = true
728

729
		return nil
730
	}
731
}
732

733
// WithPod adds the container to a pod.
734
// Containers which join a pod can only join the Linux namespaces of other
735
// containers in the same pod.
736
// Containers can only join pods in the same libpod namespace.
737
func (r *Runtime) WithPod(pod *Pod) CtrCreateOption {
738
	return func(ctr *Container) error {
739
		if ctr.valid {
740
			return define.ErrCtrFinalized
741
		}
742

743
		if pod == nil {
744
			return define.ErrInvalidArg
745
		}
746
		ctr.config.Pod = pod.ID()
747

748
		return nil
749
	}
750
}
751

752
// WithLabels adds labels to the container.
753
func WithLabels(labels map[string]string) CtrCreateOption {
754
	return func(ctr *Container) error {
755
		if ctr.valid {
756
			return define.ErrCtrFinalized
757
		}
758

759
		ctr.config.Labels = make(map[string]string)
760
		for key, value := range labels {
761
			ctr.config.Labels[key] = value
762
		}
763

764
		return nil
765
	}
766
}
767

768
// WithName sets the container's name.
769
func WithName(name string) CtrCreateOption {
770
	return func(ctr *Container) error {
771
		if ctr.valid {
772
			return define.ErrCtrFinalized
773
		}
774

775
		name = strings.TrimPrefix(name, "/")
776
		// Check the name against a regex
777
		if !define.NameRegex.MatchString(name) {
778
			return define.RegexError
779
		}
780

781
		ctr.config.Name = name
782

783
		return nil
784
	}
785
}
786

787
// WithStopSignal sets the signal that will be sent to stop the container.
788
func WithStopSignal(signal syscall.Signal) CtrCreateOption {
789
	return func(ctr *Container) error {
790
		if ctr.valid {
791
			return define.ErrCtrFinalized
792
		}
793

794
		if signal == 0 {
795
			return fmt.Errorf("stop signal cannot be 0: %w", define.ErrInvalidArg)
796
		} else if signal > 64 {
797
			return fmt.Errorf("stop signal cannot be greater than 64 (SIGRTMAX): %w", define.ErrInvalidArg)
798
		}
799

800
		ctr.config.StopSignal = uint(signal)
801

802
		return nil
803
	}
804
}
805

806
// WithStopTimeout sets the time to after initial stop signal is sent to the
807
// container, before sending the kill signal.
808
func WithStopTimeout(timeout uint) CtrCreateOption {
809
	return func(ctr *Container) error {
810
		if ctr.valid {
811
			return define.ErrCtrFinalized
812
		}
813

814
		ctr.config.StopTimeout = timeout
815

816
		return nil
817
	}
818
}
819

820
// WithTimeout sets the maximum time a container is allowed to run"
821
func WithTimeout(timeout uint) CtrCreateOption {
822
	return func(ctr *Container) error {
823
		if ctr.valid {
824
			return define.ErrCtrFinalized
825
		}
826
		ctr.config.Timeout = timeout
827

828
		return nil
829
	}
830
}
831

832
// WithIDMappings sets the idmappings for the container
833
func WithIDMappings(idmappings storage.IDMappingOptions) CtrCreateOption {
834
	return func(ctr *Container) error {
835
		if ctr.valid {
836
			return define.ErrCtrFinalized
837
		}
838

839
		ctr.config.IDMappings = idmappings
840
		return nil
841
	}
842
}
843

844
// WithUTSNSFromPod indicates that the container should join the UTS namespace of
845
// its pod
846
func WithUTSNSFromPod(p *Pod) CtrCreateOption {
847
	return func(ctr *Container) error {
848
		if ctr.valid {
849
			return define.ErrCtrFinalized
850
		}
851

852
		if err := validPodNSOption(p, ctr.config.Pod); err != nil {
853
			return err
854
		}
855

856
		infraContainer, err := p.InfraContainerID()
857
		if err != nil {
858
			return err
859
		}
860
		ctr.config.UTSNsCtr = infraContainer
861

862
		return nil
863
	}
864
}
865

866
// WithIPCNSFrom indicates that the container should join the IPC namespace of
867
// the given container.
868
// If the container has joined a pod, it can only join the namespaces of
869
// containers in the same pod.
870
func WithIPCNSFrom(nsCtr *Container) CtrCreateOption {
871
	return func(ctr *Container) error {
872
		if ctr.valid {
873
			return define.ErrCtrFinalized
874
		}
875

876
		if err := checkDependencyContainer(nsCtr, ctr); err != nil {
877
			return err
878
		}
879

880
		ctr.config.IPCNsCtr = nsCtr.ID()
881

882
		return nil
883
	}
884
}
885

886
// WithMountNSFrom indicates that the container should join the mount namespace
887
// of the given container.
888
// If the container has joined a pod, it can only join the namespaces of
889
// containers in the same pod.
890
func WithMountNSFrom(nsCtr *Container) CtrCreateOption {
891
	return func(ctr *Container) error {
892
		if ctr.valid {
893
			return define.ErrCtrFinalized
894
		}
895

896
		if err := checkDependencyContainer(nsCtr, ctr); err != nil {
897
			return err
898
		}
899
		ctr.config.MountNsCtr = nsCtr.ID()
900

901
		return nil
902
	}
903
}
904

905
// WithNetNSFrom indicates that the container should join the network namespace
906
// of the given container.
907
// If the container has joined a pod, it can only join the namespaces of
908
// containers in the same pod.
909
func WithNetNSFrom(nsCtr *Container) CtrCreateOption {
910
	return func(ctr *Container) error {
911
		if ctr.valid {
912
			return define.ErrCtrFinalized
913
		}
914

915
		if err := checkDependencyContainer(nsCtr, ctr); err != nil {
916
			return err
917
		}
918

919
		ctr.config.NetNsCtr = nsCtr.ID()
920

921
		return nil
922
	}
923
}
924

925
// WithPIDNSFrom indicates that the container should join the PID namespace of
926
// the given container.
927
// If the container has joined a pod, it can only join the namespaces of
928
// containers in the same pod.
929
func WithPIDNSFrom(nsCtr *Container) CtrCreateOption {
930
	return func(ctr *Container) error {
931
		if ctr.valid {
932
			return define.ErrCtrFinalized
933
		}
934

935
		if err := checkDependencyContainer(nsCtr, ctr); err != nil {
936
			return err
937
		}
938

939
		ctr.config.PIDNsCtr = nsCtr.ID()
940

941
		return nil
942
	}
943
}
944

945
// WithAddCurrentUserPasswdEntry indicates that container should add current
946
// user entry to /etc/passwd, since the UID will be mapped into the container,
947
// via user namespace
948
func WithAddCurrentUserPasswdEntry() CtrCreateOption {
949
	return func(ctr *Container) error {
950
		if ctr.valid {
951
			return define.ErrCtrFinalized
952
		}
953

954
		ctr.config.AddCurrentUserPasswdEntry = true
955
		return nil
956
	}
957
}
958

959
// WithUserNSFrom indicates that the container should join the user namespace of
960
// the given container.
961
// If the container has joined a pod, it can only join the namespaces of
962
// containers in the same pod.
963
func WithUserNSFrom(nsCtr *Container) CtrCreateOption {
964
	return func(ctr *Container) error {
965
		if ctr.valid {
966
			return define.ErrCtrFinalized
967
		}
968

969
		if err := checkDependencyContainer(nsCtr, ctr); err != nil {
970
			return err
971
		}
972

973
		ctr.config.UserNsCtr = nsCtr.ID()
974
		if err := JSONDeepCopy(nsCtr.IDMappings(), &ctr.config.IDMappings); err != nil {
975
			return err
976
		}
977
		// NewFromSpec() is deprecated according to its comment
978
		// however the recommended replace just causes a nil map panic
979
		g := generate.NewFromSpec(ctr.config.Spec)
980

981
		g.ClearLinuxUIDMappings()
982
		for _, uidmap := range nsCtr.config.IDMappings.UIDMap {
983
			g.AddLinuxUIDMapping(uint32(uidmap.HostID), uint32(uidmap.ContainerID), uint32(uidmap.Size))
984
		}
985
		g.ClearLinuxGIDMappings()
986
		for _, gidmap := range nsCtr.config.IDMappings.GIDMap {
987
			g.AddLinuxGIDMapping(uint32(gidmap.HostID), uint32(gidmap.ContainerID), uint32(gidmap.Size))
988
		}
989
		return nil
990
	}
991
}
992

993
// WithUTSNSFrom indicates that the container should join the UTS namespace of
994
// the given container.
995
// If the container has joined a pod, it can only join the namespaces of
996
// containers in the same pod.
997
func WithUTSNSFrom(nsCtr *Container) CtrCreateOption {
998
	return func(ctr *Container) error {
999
		if ctr.valid {
1000
			return define.ErrCtrFinalized
1001
		}
1002

1003
		if err := checkDependencyContainer(nsCtr, ctr); err != nil {
1004
			return err
1005
		}
1006

1007
		ctr.config.UTSNsCtr = nsCtr.ID()
1008

1009
		return nil
1010
	}
1011
}
1012

1013
// WithCgroupNSFrom indicates that the container should join the Cgroup namespace
1014
// of the given container.
1015
// If the container has joined a pod, it can only join the namespaces of
1016
// containers in the same pod.
1017
func WithCgroupNSFrom(nsCtr *Container) CtrCreateOption {
1018
	return func(ctr *Container) error {
1019
		if ctr.valid {
1020
			return define.ErrCtrFinalized
1021
		}
1022

1023
		if err := checkDependencyContainer(nsCtr, ctr); err != nil {
1024
			return err
1025
		}
1026

1027
		ctr.config.CgroupNsCtr = nsCtr.ID()
1028

1029
		return nil
1030
	}
1031
}
1032

1033
// WithDependencyCtrs sets dependency containers of the given container.
1034
// Dependency containers must be running before this container is started.
1035
func WithDependencyCtrs(ctrs []*Container) CtrCreateOption {
1036
	return func(ctr *Container) error {
1037
		if ctr.valid {
1038
			return define.ErrCtrFinalized
1039
		}
1040

1041
		deps := make([]string, 0, len(ctrs))
1042

1043
		for _, dep := range ctrs {
1044
			if err := checkDependencyContainer(dep, ctr); err != nil {
1045
				return err
1046
			}
1047

1048
			deps = append(deps, dep.ID())
1049
		}
1050

1051
		ctr.config.Dependencies = deps
1052

1053
		return nil
1054
	}
1055
}
1056

1057
// WithNetNS indicates that the container should be given a new network
1058
// namespace with a minimal configuration.
1059
// An optional array of port mappings can be provided.
1060
// Conflicts with WithNetNSFrom().
1061
func WithNetNS(portMappings []nettypes.PortMapping, exposedPorts map[uint16][]string, postConfigureNetNS bool, netmode string, networks map[string]nettypes.PerNetworkOptions) CtrCreateOption {
1062
	return func(ctr *Container) error {
1063
		if ctr.valid {
1064
			return define.ErrCtrFinalized
1065
		}
1066

1067
		ctr.config.PostConfigureNetNS = postConfigureNetNS
1068
		ctr.config.NetMode = namespaces.NetworkMode(netmode)
1069
		ctr.config.CreateNetNS = true
1070
		ctr.config.PortMappings = portMappings
1071
		ctr.config.ExposedPorts = exposedPorts
1072

1073
		if !ctr.config.NetMode.IsBridge() && len(networks) > 0 {
1074
			return errors.New("cannot use networks when network mode is not bridge")
1075
		}
1076
		ctr.config.Networks = networks
1077

1078
		return nil
1079
	}
1080
}
1081

1082
// WithNetworkOptions sets additional options for the networks.
1083
func WithNetworkOptions(options map[string][]string) CtrCreateOption {
1084
	return func(ctr *Container) error {
1085
		if ctr.valid {
1086
			return define.ErrCtrFinalized
1087
		}
1088

1089
		ctr.config.NetworkOptions = options
1090

1091
		return nil
1092
	}
1093
}
1094

1095
// WithLogDriver sets the log driver for the container
1096
func WithLogDriver(driver string) CtrCreateOption {
1097
	return func(ctr *Container) error {
1098
		if ctr.valid {
1099
			return define.ErrCtrFinalized
1100
		}
1101
		switch driver {
1102
		case "":
1103
			return fmt.Errorf("log driver must be set: %w", define.ErrInvalidArg)
1104
		case define.JournaldLogging, define.KubernetesLogging, define.JSONLogging, define.NoLogging, define.PassthroughLogging, define.PassthroughTTYLogging:
1105
			break
1106
		default:
1107
			return fmt.Errorf("invalid log driver: %w", define.ErrInvalidArg)
1108
		}
1109

1110
		ctr.config.LogDriver = driver
1111

1112
		return nil
1113
	}
1114
}
1115

1116
// WithLogPath sets the path to the log file.
1117
func WithLogPath(path string) CtrCreateOption {
1118
	return func(ctr *Container) error {
1119
		if ctr.valid {
1120
			return define.ErrCtrFinalized
1121
		}
1122
		if path == "" {
1123
			return fmt.Errorf("log path must be set: %w", define.ErrInvalidArg)
1124
		}
1125

1126
		ctr.config.LogPath = path
1127

1128
		return nil
1129
	}
1130
}
1131

1132
// WithLogTag sets the tag to the log file.
1133
func WithLogTag(tag string) CtrCreateOption {
1134
	return func(ctr *Container) error {
1135
		if ctr.valid {
1136
			return define.ErrCtrFinalized
1137
		}
1138
		if tag == "" {
1139
			return fmt.Errorf("log tag must be set: %w", define.ErrInvalidArg)
1140
		}
1141

1142
		ctr.config.LogTag = tag
1143

1144
		return nil
1145
	}
1146
}
1147

1148
// WithCgroupsMode disables the creation of Cgroups for the conmon process.
1149
func WithCgroupsMode(mode string) CtrCreateOption {
1150
	return func(ctr *Container) error {
1151
		if ctr.valid {
1152
			return define.ErrCtrFinalized
1153
		}
1154

1155
		switch mode {
1156
		case "disabled":
1157
			ctr.config.NoCgroups = true
1158
			ctr.config.CgroupsMode = mode
1159
		case "enabled", "no-conmon", cgroupSplit:
1160
			ctr.config.CgroupsMode = mode
1161
		default:
1162
			return fmt.Errorf("invalid cgroup mode %q: %w", mode, define.ErrInvalidArg)
1163
		}
1164

1165
		return nil
1166
	}
1167
}
1168

1169
// WithCgroupParent sets the Cgroup Parent of the new container.
1170
func WithCgroupParent(parent string) CtrCreateOption {
1171
	return func(ctr *Container) error {
1172
		if ctr.valid {
1173
			return define.ErrCtrFinalized
1174
		}
1175

1176
		if parent == "" {
1177
			return fmt.Errorf("cgroup parent cannot be empty: %w", define.ErrInvalidArg)
1178
		}
1179

1180
		ctr.config.CgroupParent = parent
1181

1182
		return nil
1183
	}
1184
}
1185

1186
// WithDNSSearch sets the additional search domains of a container.
1187
func WithDNSSearch(searchDomains []string) CtrCreateOption {
1188
	return func(ctr *Container) error {
1189
		if ctr.valid {
1190
			return define.ErrCtrFinalized
1191
		}
1192
		ctr.config.DNSSearch = searchDomains
1193
		return nil
1194
	}
1195
}
1196

1197
// WithDNS sets additional name servers for the container.
1198
func WithDNS(dnsServers []string) CtrCreateOption {
1199
	return func(ctr *Container) error {
1200
		if ctr.valid {
1201
			return define.ErrCtrFinalized
1202
		}
1203
		var dns []net.IP
1204
		for _, i := range dnsServers {
1205
			result := net.ParseIP(i)
1206
			if result == nil {
1207
				return fmt.Errorf("invalid IP address %s: %w", i, define.ErrInvalidArg)
1208
			}
1209
			dns = append(dns, result)
1210
		}
1211
		ctr.config.DNSServer = append(ctr.config.DNSServer, dns...)
1212

1213
		return nil
1214
	}
1215
}
1216

1217
// WithDNSOption sets additional dns options for the container.
1218
func WithDNSOption(dnsOptions []string) CtrCreateOption {
1219
	return func(ctr *Container) error {
1220
		if ctr.valid {
1221
			return define.ErrCtrFinalized
1222
		}
1223
		if ctr.config.UseImageResolvConf {
1224
			return fmt.Errorf("cannot add DNS options if container will not create /etc/resolv.conf: %w", define.ErrInvalidArg)
1225
		}
1226
		ctr.config.DNSOption = append(ctr.config.DNSOption, dnsOptions...)
1227
		return nil
1228
	}
1229
}
1230

1231
// WithHosts sets additional host:IP for the hosts file.
1232
func WithHosts(hosts []string) CtrCreateOption {
1233
	return func(ctr *Container) error {
1234
		if ctr.valid {
1235
			return define.ErrCtrFinalized
1236
		}
1237

1238
		ctr.config.HostAdd = hosts
1239
		return nil
1240
	}
1241
}
1242

1243
// WithConmonPidFile specifies the path to the file that receives the pid of
1244
// conmon.
1245
func WithConmonPidFile(path string) CtrCreateOption {
1246
	return func(ctr *Container) error {
1247
		if ctr.valid {
1248
			return define.ErrCtrFinalized
1249
		}
1250
		ctr.config.ConmonPidFile = path
1251
		return nil
1252
	}
1253
}
1254

1255
// WithGroups sets additional groups for the container, which are defined by
1256
// the user.
1257
func WithGroups(groups []string) CtrCreateOption {
1258
	return func(ctr *Container) error {
1259
		if ctr.valid {
1260
			return define.ErrCtrFinalized
1261
		}
1262
		ctr.config.Groups = groups
1263
		return nil
1264
	}
1265
}
1266

1267
// WithUserVolumes sets the user-added volumes of the container.
1268
// These are not added to the container's spec, but will instead be used during
1269
// commit to populate the volumes of the new image, and to trigger some OCI
1270
// hooks that are only added if volume mounts are present.
1271
// Furthermore, they are used in the output of inspect, to filter volumes -
1272
// only volumes included in this list will be included in the output.
1273
// Unless explicitly set, committed images will have no volumes.
1274
// The given volumes slice must not be nil.
1275
func WithUserVolumes(volumes []string) CtrCreateOption {
1276
	return func(ctr *Container) error {
1277
		if ctr.valid {
1278
			return define.ErrCtrFinalized
1279
		}
1280

1281
		if volumes == nil {
1282
			return define.ErrInvalidArg
1283
		}
1284

1285
		ctr.config.UserVolumes = make([]string, 0, len(volumes))
1286
		ctr.config.UserVolumes = append(ctr.config.UserVolumes, volumes...)
1287
		return nil
1288
	}
1289
}
1290

1291
// WithEntrypoint sets the entrypoint of the container.
1292
// This is not used to change the container's spec, but will instead be used
1293
// during commit to populate the entrypoint of the new image.
1294
// If not explicitly set it will default to the image's entrypoint.
1295
// A nil entrypoint is allowed, and will clear entrypoint on the created image.
1296
func WithEntrypoint(entrypoint []string) CtrCreateOption {
1297
	return func(ctr *Container) error {
1298
		if ctr.valid {
1299
			return define.ErrCtrFinalized
1300
		}
1301

1302
		ctr.config.Entrypoint = make([]string, 0, len(entrypoint))
1303
		ctr.config.Entrypoint = append(ctr.config.Entrypoint, entrypoint...)
1304
		return nil
1305
	}
1306
}
1307

1308
// WithCommand sets the command of the container.
1309
// This is not used to change the container's spec, but will instead be used
1310
// during commit to populate the command of the new image.
1311
// If not explicitly set it will default to the image's command.
1312
// A nil command is allowed, and will clear command on the created image.
1313
func WithCommand(command []string) CtrCreateOption {
1314
	return func(ctr *Container) error {
1315
		if ctr.valid {
1316
			return define.ErrCtrFinalized
1317
		}
1318

1319
		ctr.config.Command = make([]string, 0, len(command))
1320
		ctr.config.Command = append(ctr.config.Command, command...)
1321
		return nil
1322
	}
1323
}
1324

1325
// WithRootFS sets the rootfs for the container.
1326
// This creates a container from a directory on disk and not an image.
1327
func WithRootFS(rootfs string, overlay bool, mapping *string) CtrCreateOption {
1328
	return func(ctr *Container) error {
1329
		if ctr.valid {
1330
			return define.ErrCtrFinalized
1331
		}
1332
		if err := fileutils.Exists(rootfs); err != nil {
1333
			return err
1334
		}
1335
		ctr.config.Rootfs = rootfs
1336
		ctr.config.RootfsOverlay = overlay
1337
		ctr.config.RootfsMapping = mapping
1338
		return nil
1339
	}
1340
}
1341

1342
// WithCtrNamespace sets the namespace the container will be created in.
1343
// Namespaces are used to create separate views of Podman's state - runtimes can
1344
// join a specific namespace and see only containers and pods in that namespace.
1345
// Empty string namespaces are allowed, and correspond to a lack of namespace.
1346
func WithCtrNamespace(ns string) CtrCreateOption {
1347
	return func(ctr *Container) error {
1348
		if ctr.valid {
1349
			return define.ErrCtrFinalized
1350
		}
1351

1352
		ctr.config.Namespace = ns
1353

1354
		return nil
1355
	}
1356
}
1357

1358
// WithUseImageResolvConf tells the container not to bind-mount resolv.conf in.
1359
// This conflicts with other DNS-related options.
1360
func WithUseImageResolvConf() CtrCreateOption {
1361
	return func(ctr *Container) error {
1362
		if ctr.valid {
1363
			return define.ErrCtrFinalized
1364
		}
1365

1366
		ctr.config.UseImageResolvConf = true
1367

1368
		return nil
1369
	}
1370
}
1371

1372
// WithUseImageHosts tells the container not to bind-mount /etc/hosts in.
1373
// This conflicts with WithHosts().
1374
func WithUseImageHosts() CtrCreateOption {
1375
	return func(ctr *Container) error {
1376
		if ctr.valid {
1377
			return define.ErrCtrFinalized
1378
		}
1379

1380
		ctr.config.UseImageHosts = true
1381

1382
		return nil
1383
	}
1384
}
1385

1386
// WithRestartPolicy sets the container's restart policy. Valid values are
1387
// "no", "on-failure", and "always". The empty string is allowed, and will be
1388
// equivalent to "no".
1389
func WithRestartPolicy(policy string) CtrCreateOption {
1390
	return func(ctr *Container) error {
1391
		if ctr.valid {
1392
			return define.ErrCtrFinalized
1393
		}
1394

1395
		if err := define.ValidateRestartPolicy(policy); err != nil {
1396
			return err
1397
		}
1398

1399
		ctr.config.RestartPolicy = policy
1400

1401
		return nil
1402
	}
1403
}
1404

1405
// WithRestartRetries sets the number of retries to use when restarting a
1406
// container with the "on-failure" restart policy.
1407
// 0 is an allowed value, and indicates infinite retries.
1408
func WithRestartRetries(tries uint) CtrCreateOption {
1409
	return func(ctr *Container) error {
1410
		if ctr.valid {
1411
			return define.ErrCtrFinalized
1412
		}
1413

1414
		ctr.config.RestartRetries = tries
1415

1416
		return nil
1417
	}
1418
}
1419

1420
// WithNamedVolumes adds the given named volumes to the container.
1421
func WithNamedVolumes(volumes []*ContainerNamedVolume) CtrCreateOption {
1422
	return func(ctr *Container) error {
1423
		if ctr.valid {
1424
			return define.ErrCtrFinalized
1425
		}
1426

1427
		for _, vol := range volumes {
1428
			mountOpts, err := util.ProcessOptions(vol.Options, false, "")
1429
			if err != nil {
1430
				return fmt.Errorf("processing options for named volume %q mounted at %q: %w", vol.Name, vol.Dest, err)
1431
			}
1432

1433
			ctr.config.NamedVolumes = append(ctr.config.NamedVolumes, &ContainerNamedVolume{
1434
				Name:        vol.Name,
1435
				Dest:        vol.Dest,
1436
				Options:     mountOpts,
1437
				IsAnonymous: vol.IsAnonymous,
1438
				SubPath:     vol.SubPath,
1439
			})
1440
		}
1441

1442
		return nil
1443
	}
1444
}
1445

1446
// WithOverlayVolumes adds the given overlay volumes to the container.
1447
func WithOverlayVolumes(volumes []*ContainerOverlayVolume) CtrCreateOption {
1448
	return func(ctr *Container) error {
1449
		if ctr.valid {
1450
			return define.ErrCtrFinalized
1451
		}
1452

1453
		for _, vol := range volumes {
1454
			ctr.config.OverlayVolumes = append(ctr.config.OverlayVolumes, &ContainerOverlayVolume{
1455
				Dest:    vol.Dest,
1456
				Source:  vol.Source,
1457
				Options: vol.Options,
1458
			})
1459
		}
1460

1461
		return nil
1462
	}
1463
}
1464

1465
// WithImageVolumes adds the given image volumes to the container.
1466
func WithImageVolumes(volumes []*ContainerImageVolume) CtrCreateOption {
1467
	return func(ctr *Container) error {
1468
		if ctr.valid {
1469
			return define.ErrCtrFinalized
1470
		}
1471

1472
		for _, vol := range volumes {
1473
			ctr.config.ImageVolumes = append(ctr.config.ImageVolumes, &ContainerImageVolume{
1474
				Dest:      vol.Dest,
1475
				Source:    vol.Source,
1476
				ReadWrite: vol.ReadWrite,
1477
			})
1478
		}
1479

1480
		return nil
1481
	}
1482
}
1483

1484
// WithHealthCheck adds the healthcheck to the container config
1485
func WithHealthCheck(healthCheck *manifest.Schema2HealthConfig) CtrCreateOption {
1486
	return func(ctr *Container) error {
1487
		if ctr.valid {
1488
			return define.ErrCtrFinalized
1489
		}
1490
		ctr.config.HealthCheckConfig = healthCheck
1491
		return nil
1492
	}
1493
}
1494

1495
// WithHealthCheckOnFailureAction adds an on-failure action to health-check config
1496
func WithHealthCheckOnFailureAction(action define.HealthCheckOnFailureAction) CtrCreateOption {
1497
	return func(ctr *Container) error {
1498
		if ctr.valid {
1499
			return define.ErrCtrFinalized
1500
		}
1501
		ctr.config.HealthCheckOnFailureAction = action
1502
		return nil
1503
	}
1504
}
1505

1506
// WithPreserveFDs forwards from the process running Libpod into the container
1507
// the given number of extra FDs (starting after the standard streams) to the created container
1508
func WithPreserveFDs(fd uint) CtrCreateOption {
1509
	return func(ctr *Container) error {
1510
		if ctr.valid {
1511
			return define.ErrCtrFinalized
1512
		}
1513
		ctr.config.PreserveFDs = fd
1514
		return nil
1515
	}
1516
}
1517

1518
// WithPreserveFD forwards from the process running Libpod into the container
1519
// the given list of extra FDs to the created container
1520
func WithPreserveFD(fds []uint) CtrCreateOption {
1521
	return func(ctr *Container) error {
1522
		if ctr.valid {
1523
			return define.ErrCtrFinalized
1524
		}
1525
		ctr.config.PreserveFD = fds
1526
		return nil
1527
	}
1528
}
1529

1530
// WithCreateCommand adds the full command plus arguments of the current
1531
// process to the container config.
1532
func WithCreateCommand(cmd []string) CtrCreateOption {
1533
	return func(ctr *Container) error {
1534
		if ctr.valid {
1535
			return define.ErrCtrFinalized
1536
		}
1537
		ctr.config.CreateCommand = cmd
1538
		return nil
1539
	}
1540
}
1541

1542
// withIsInfra allows us to differentiate between infra containers and other containers
1543
// within the container config
1544
func withIsInfra() CtrCreateOption {
1545
	return func(ctr *Container) error {
1546
		if ctr.valid {
1547
			return define.ErrCtrFinalized
1548
		}
1549

1550
		ctr.config.IsInfra = true
1551

1552
		return nil
1553
	}
1554
}
1555

1556
// WithIsService allows us to differentiate between service containers and other container
1557
// within the container config.  It also sets the exit-code propagation of the
1558
// service container.
1559
func WithIsService(ecp define.KubeExitCodePropagation) CtrCreateOption {
1560
	return func(ctr *Container) error {
1561
		if ctr.valid {
1562
			return define.ErrCtrFinalized
1563
		}
1564

1565
		ctr.config.IsService = true
1566
		ctr.config.KubeExitCodePropagation = ecp
1567
		return nil
1568
	}
1569
}
1570

1571
// WithCreateWorkingDir tells Podman to create the container's working directory
1572
// if it does not exist.
1573
func WithCreateWorkingDir() CtrCreateOption {
1574
	return func(ctr *Container) error {
1575
		if ctr.valid {
1576
			return define.ErrCtrFinalized
1577
		}
1578

1579
		ctr.config.CreateWorkingDir = true
1580
		return nil
1581
	}
1582
}
1583

1584
// Volume Creation Options
1585

1586
func WithVolumeIgnoreIfExist() VolumeCreateOption {
1587
	return func(volume *Volume) error {
1588
		if volume.valid {
1589
			return define.ErrVolumeFinalized
1590
		}
1591
		volume.ignoreIfExists = true
1592

1593
		return nil
1594
	}
1595
}
1596

1597
// WithVolumeName sets the name of the volume.
1598
func WithVolumeName(name string) VolumeCreateOption {
1599
	return func(volume *Volume) error {
1600
		if volume.valid {
1601
			return define.ErrVolumeFinalized
1602
		}
1603

1604
		// Check the name against a regex
1605
		if !define.NameRegex.MatchString(name) {
1606
			return define.RegexError
1607
		}
1608
		volume.config.Name = name
1609

1610
		return nil
1611
	}
1612
}
1613

1614
// WithVolumeDriver sets the volume's driver.
1615
// It is presently not implemented, but will be supported in a future Podman
1616
// release.
1617
func WithVolumeDriver(driver string) VolumeCreateOption {
1618
	return func(volume *Volume) error {
1619
		if volume.valid {
1620
			return define.ErrVolumeFinalized
1621
		}
1622

1623
		volume.config.Driver = driver
1624
		return nil
1625
	}
1626
}
1627

1628
// WithVolumeLabels sets the labels of the volume.
1629
func WithVolumeLabels(labels map[string]string) VolumeCreateOption {
1630
	return func(volume *Volume) error {
1631
		if volume.valid {
1632
			return define.ErrVolumeFinalized
1633
		}
1634

1635
		volume.config.Labels = make(map[string]string)
1636
		for key, value := range labels {
1637
			volume.config.Labels[key] = value
1638
		}
1639

1640
		return nil
1641
	}
1642
}
1643

1644
// WithVolumeMountLabel sets the MountLabel of the volume.
1645
func WithVolumeMountLabel(mountLabel string) VolumeCreateOption {
1646
	return func(volume *Volume) error {
1647
		if volume.valid {
1648
			return define.ErrVolumeFinalized
1649
		}
1650

1651
		volume.config.MountLabel = mountLabel
1652
		return nil
1653
	}
1654
}
1655

1656
// WithVolumeOptions sets the options of the volume.
1657
func WithVolumeOptions(options map[string]string) VolumeCreateOption {
1658
	return func(volume *Volume) error {
1659
		if volume.valid {
1660
			return define.ErrVolumeFinalized
1661
		}
1662

1663
		volume.config.Options = make(map[string]string)
1664
		for key, value := range options {
1665
			volume.config.Options[key] = value
1666
		}
1667

1668
		return nil
1669
	}
1670
}
1671

1672
// WithVolumeUID sets the UID that the volume will be created as.
1673
func WithVolumeUID(uid int) VolumeCreateOption {
1674
	return func(volume *Volume) error {
1675
		if volume.valid {
1676
			return define.ErrVolumeFinalized
1677
		}
1678

1679
		volume.config.UID = uid
1680

1681
		return nil
1682
	}
1683
}
1684

1685
// WithVolumeSize sets the maximum size of the volume
1686
func WithVolumeSize(size uint64) VolumeCreateOption {
1687
	return func(volume *Volume) error {
1688
		if volume.valid {
1689
			return define.ErrVolumeFinalized
1690
		}
1691

1692
		volume.config.Size = size
1693

1694
		return nil
1695
	}
1696
}
1697

1698
// WithVolumeInodes sets the maximum inodes of the volume
1699
func WithVolumeInodes(inodes uint64) VolumeCreateOption {
1700
	return func(volume *Volume) error {
1701
		if volume.valid {
1702
			return define.ErrVolumeFinalized
1703
		}
1704

1705
		volume.config.Inodes = inodes
1706

1707
		return nil
1708
	}
1709
}
1710

1711
// WithVolumeGID sets the GID that the volume will be created as.
1712
func WithVolumeGID(gid int) VolumeCreateOption {
1713
	return func(volume *Volume) error {
1714
		if volume.valid {
1715
			return define.ErrVolumeFinalized
1716
		}
1717

1718
		volume.config.GID = gid
1719

1720
		return nil
1721
	}
1722
}
1723

1724
// WithVolumeNoChown prevents the volume from being chowned to the process uid at first use.
1725
func WithVolumeNoChown() VolumeCreateOption {
1726
	return func(volume *Volume) error {
1727
		if volume.valid {
1728
			return define.ErrVolumeFinalized
1729
		}
1730

1731
		volume.state.NeedsChown = false
1732

1733
		return nil
1734
	}
1735
}
1736

1737
// WithVolumeDisableQuota prevents the volume from being assigned a quota.
1738
func WithVolumeDisableQuota() VolumeCreateOption {
1739
	return func(volume *Volume) error {
1740
		if volume.valid {
1741
			return define.ErrVolumeFinalized
1742
		}
1743

1744
		volume.config.DisableQuota = true
1745

1746
		return nil
1747
	}
1748
}
1749

1750
// withSetAnon sets a bool notifying libpod that this volume is anonymous and
1751
// should be removed when containers using it are removed and volumes are
1752
// specified for removal.
1753
func withSetAnon() VolumeCreateOption {
1754
	return func(volume *Volume) error {
1755
		if volume.valid {
1756
			return define.ErrVolumeFinalized
1757
		}
1758

1759
		volume.config.IsAnon = true
1760

1761
		return nil
1762
	}
1763
}
1764

1765
// WithVolumeDriverTimeout sets the volume creation timeout period.
1766
// Only usable if a non-local volume driver is in use.
1767
func WithVolumeDriverTimeout(timeout uint) VolumeCreateOption {
1768
	return func(volume *Volume) error {
1769
		if volume.valid {
1770
			return define.ErrVolumeFinalized
1771
		}
1772

1773
		if volume.config.Driver == "" || volume.config.Driver == define.VolumeDriverLocal {
1774
			return fmt.Errorf("Volume driver timeout can only be used with non-local volume drivers: %w", define.ErrInvalidArg)
1775
		}
1776

1777
		tm := timeout
1778

1779
		volume.config.Timeout = &tm
1780

1781
		return nil
1782
	}
1783
}
1784

1785
// WithTimezone sets the timezone in the container
1786
func WithTimezone(path string) CtrCreateOption {
1787
	return func(ctr *Container) error {
1788
		if ctr.valid {
1789
			return define.ErrCtrFinalized
1790
		}
1791
		if path != "local" {
1792
			// validate the format of the timezone specified if it's not "local"
1793
			_, err := time.LoadLocation(path)
1794
			if err != nil {
1795
				return fmt.Errorf("finding timezone: %w", err)
1796
			}
1797
		}
1798

1799
		ctr.config.Timezone = path
1800
		return nil
1801
	}
1802
}
1803

1804
// WithUmask sets the umask in the container
1805
func WithUmask(umask string) CtrCreateOption {
1806
	return func(ctr *Container) error {
1807
		if ctr.valid {
1808
			return define.ErrCtrFinalized
1809
		}
1810
		if !umaskRegex.MatchString(umask) {
1811
			return fmt.Errorf("invalid umask string %s: %w", umask, define.ErrInvalidArg)
1812
		}
1813
		ctr.config.Umask = umask
1814
		return nil
1815
	}
1816
}
1817

1818
// WithSecrets adds secrets to the container
1819
func WithSecrets(containerSecrets []*ContainerSecret) CtrCreateOption {
1820
	return func(ctr *Container) error {
1821
		if ctr.valid {
1822
			return define.ErrCtrFinalized
1823
		}
1824
		ctr.config.Secrets = containerSecrets
1825
		return nil
1826
	}
1827
}
1828

1829
// WithEnvSecrets adds environment variable secrets to the container
1830
func WithEnvSecrets(envSecrets map[string]string) CtrCreateOption {
1831
	return func(ctr *Container) error {
1832
		ctr.config.EnvSecrets = make(map[string]*secrets.Secret)
1833
		if ctr.valid {
1834
			return define.ErrCtrFinalized
1835
		}
1836
		manager, err := ctr.runtime.SecretsManager()
1837
		if err != nil {
1838
			return err
1839
		}
1840
		for target, src := range envSecrets {
1841
			secr, err := manager.Lookup(src)
1842
			if err != nil {
1843
				return err
1844
			}
1845
			ctr.config.EnvSecrets[target] = secr
1846
		}
1847
		return nil
1848
	}
1849
}
1850

1851
// WithPidFile adds pidFile to the container
1852
func WithPidFile(pidFile string) CtrCreateOption {
1853
	return func(ctr *Container) error {
1854
		if ctr.valid {
1855
			return define.ErrCtrFinalized
1856
		}
1857
		ctr.config.PidFile = pidFile
1858
		return nil
1859
	}
1860
}
1861

1862
// WithHostUsers indicates host users to add to /etc/passwd
1863
func WithHostUsers(hostUsers []string) CtrCreateOption {
1864
	return func(ctr *Container) error {
1865
		if ctr.valid {
1866
			return define.ErrCtrFinalized
1867
		}
1868
		ctr.config.HostUsers = hostUsers
1869
		return nil
1870
	}
1871
}
1872

1873
// WithInitCtrType indicates the container is an initcontainer
1874
func WithInitCtrType(containerType string) CtrCreateOption {
1875
	return func(ctr *Container) error {
1876
		if ctr.valid {
1877
			return define.ErrCtrFinalized
1878
		}
1879
		// Make sure the type is valid
1880
		if containerType == define.OneShotInitContainer || containerType == define.AlwaysInitContainer {
1881
			ctr.config.InitContainerType = containerType
1882
			return nil
1883
		}
1884
		return fmt.Errorf("%s is invalid init container type", containerType)
1885
	}
1886
}
1887

1888
// WithHostDevice adds the original host src to the config
1889
func WithHostDevice(dev []specs.LinuxDevice) CtrCreateOption {
1890
	return func(ctr *Container) error {
1891
		if ctr.valid {
1892
			return define.ErrCtrFinalized
1893
		}
1894
		ctr.config.DeviceHostSrc = dev
1895
		return nil
1896
	}
1897
}
1898

1899
// WithSelectedPasswordManagement makes it so that the container either does or does not set up /etc/passwd or /etc/group
1900
func WithSelectedPasswordManagement(passwd *bool) CtrCreateOption {
1901
	return func(c *Container) error {
1902
		if c.valid {
1903
			return define.ErrCtrFinalized
1904
		}
1905
		c.config.Passwd = passwd
1906
		return nil
1907
	}
1908
}
1909

1910
// WithInfraConfig allows for inheritance of compatible config entities from the infra container
1911
func WithInfraConfig(compatibleOptions InfraInherit) CtrCreateOption {
1912
	return func(ctr *Container) error {
1913
		if ctr.valid {
1914
			return define.ErrCtrFinalized
1915
		}
1916
		compatMarshal, err := json.Marshal(compatibleOptions)
1917
		if err != nil {
1918
			return errors.New("could not marshal compatible options")
1919
		}
1920

1921
		err = json.Unmarshal(compatMarshal, ctr.config)
1922
		if err != nil {
1923
			return errors.New("could not unmarshal compatible options into container config")
1924
		}
1925
		return nil
1926
	}
1927
}
1928

1929
// WithStartupHealthcheck sets a startup healthcheck for the container.
1930
// Requires that a healthcheck must be set.
1931
func WithStartupHealthcheck(startupHC *define.StartupHealthCheck) CtrCreateOption {
1932
	return func(ctr *Container) error {
1933
		if ctr.valid {
1934
			return define.ErrCtrFinalized
1935
		}
1936
		ctr.config.StartupHealthCheckConfig = new(define.StartupHealthCheck)
1937
		if err := JSONDeepCopy(startupHC, ctr.config.StartupHealthCheckConfig); err != nil {
1938
			return fmt.Errorf("error copying startup healthcheck into container: %w", err)
1939
		}
1940
		return nil
1941
	}
1942
}
1943

1944
// Pod Creation Options
1945

1946
// WithPodCreateCommand adds the full command plus arguments of the current
1947
// process to the pod config.
1948
func WithPodCreateCommand(createCmd []string) PodCreateOption {
1949
	return func(pod *Pod) error {
1950
		if pod.valid {
1951
			return define.ErrPodFinalized
1952
		}
1953
		pod.config.CreateCommand = createCmd
1954
		return nil
1955
	}
1956
}
1957

1958
// WithPodName sets the name of the pod.
1959
func WithPodName(name string) PodCreateOption {
1960
	return func(pod *Pod) error {
1961
		if pod.valid {
1962
			return define.ErrPodFinalized
1963
		}
1964

1965
		// Check the name against a regex
1966
		if !define.NameRegex.MatchString(name) {
1967
			return define.RegexError
1968
		}
1969

1970
		pod.config.Name = name
1971

1972
		return nil
1973
	}
1974
}
1975

1976
// WithPodExitPolicy sets the exit policy of the pod.
1977
func WithPodExitPolicy(policy string) PodCreateOption {
1978
	return func(pod *Pod) error {
1979
		if pod.valid {
1980
			return define.ErrPodFinalized
1981
		}
1982

1983
		parsed, err := config.ParsePodExitPolicy(policy)
1984
		if err != nil {
1985
			return err
1986
		}
1987

1988
		pod.config.ExitPolicy = parsed
1989

1990
		return nil
1991
	}
1992
}
1993

1994
// WithPodRestartPolicy sets the restart policy of the pod.
1995
func WithPodRestartPolicy(policy string) PodCreateOption {
1996
	return func(pod *Pod) error {
1997
		if pod.valid {
1998
			return define.ErrPodFinalized
1999
		}
2000

2001
		switch policy {
2002
		//TODO: v5.0 if no restart policy is set, follow k8s convention and default to Always
2003
		case define.RestartPolicyNone, define.RestartPolicyNo, define.RestartPolicyOnFailure, define.RestartPolicyAlways, define.RestartPolicyUnlessStopped:
2004
			pod.config.RestartPolicy = policy
2005
		default:
2006
			return fmt.Errorf("%q is not a valid restart policy: %w", policy, define.ErrInvalidArg)
2007
		}
2008

2009
		return nil
2010
	}
2011
}
2012

2013
// WithPodRestartRetries sets the number of retries to use when restarting a
2014
// container with the "on-failure" restart policy.
2015
// 0 is an allowed value, and indicates infinite retries.
2016
func WithPodRestartRetries(tries uint) PodCreateOption {
2017
	return func(pod *Pod) error {
2018
		if pod.valid {
2019
			return define.ErrPodFinalized
2020
		}
2021

2022
		pod.config.RestartRetries = &tries
2023

2024
		return nil
2025
	}
2026
}
2027

2028
// WithPodHostname sets the hostname of the pod.
2029
func WithPodHostname(hostname string) PodCreateOption {
2030
	return func(pod *Pod) error {
2031
		if pod.valid {
2032
			return define.ErrPodFinalized
2033
		}
2034

2035
		// Check the hostname against a regex
2036
		if !define.NameRegex.MatchString(hostname) {
2037
			return define.RegexError
2038
		}
2039

2040
		pod.config.Hostname = hostname
2041

2042
		return nil
2043
	}
2044
}
2045

2046
// WithInfraConmonPidFile sets the path to a custom conmon PID file for the
2047
// infra container.
2048
func WithInfraConmonPidFile(path string, infraSpec *specgen.SpecGenerator) PodCreateOption {
2049
	return func(pod *Pod) error {
2050
		if pod.valid {
2051
			return define.ErrPodFinalized
2052
		}
2053
		infraSpec.ConmonPidFile = path
2054
		return nil
2055
	}
2056
}
2057

2058
// WithPodLabels sets the labels of a pod.
2059
func WithPodLabels(labels map[string]string) PodCreateOption {
2060
	return func(pod *Pod) error {
2061
		if pod.valid {
2062
			return define.ErrPodFinalized
2063
		}
2064

2065
		pod.config.Labels = make(map[string]string)
2066
		for key, value := range labels {
2067
			pod.config.Labels[key] = value
2068
		}
2069

2070
		return nil
2071
	}
2072
}
2073

2074
// WithPodCgroupParent sets the Cgroup Parent of the pod.
2075
func WithPodCgroupParent(path string) PodCreateOption {
2076
	return func(pod *Pod) error {
2077
		if pod.valid {
2078
			return define.ErrPodFinalized
2079
		}
2080

2081
		pod.config.CgroupParent = path
2082

2083
		return nil
2084
	}
2085
}
2086

2087
// WithPodParent tells containers in this pod to use the cgroup created for
2088
// this pod.
2089
// This can still be overridden at the container level by explicitly specifying
2090
// a Cgroup parent.
2091
func WithPodParent() PodCreateOption {
2092
	return func(pod *Pod) error {
2093
		if pod.valid {
2094
			return define.ErrPodFinalized
2095
		}
2096

2097
		pod.config.UsePodCgroup = true
2098

2099
		return nil
2100
	}
2101
}
2102

2103
// WithPodNamespace sets the namespace for the created pod.
2104
// Namespaces are used to create separate views of Podman's state - runtimes can
2105
// join a specific namespace and see only containers and pods in that namespace.
2106
// Empty string namespaces are allowed, and correspond to a lack of namespace.
2107
// Containers must belong to the same namespace as the pod they join.
2108
func WithPodNamespace(ns string) PodCreateOption {
2109
	return func(pod *Pod) error {
2110
		if pod.valid {
2111
			return define.ErrPodFinalized
2112
		}
2113

2114
		pod.config.Namespace = ns
2115

2116
		return nil
2117
	}
2118
}
2119

2120
// WithPodIPC tells containers in this pod to use the ipc namespace
2121
// created for this pod.
2122
// Containers in a pod will inherit the kernel namespaces from the
2123
// first container added.
2124
func WithPodIPC() PodCreateOption {
2125
	return func(pod *Pod) error {
2126
		if pod.valid {
2127
			return define.ErrPodFinalized
2128
		}
2129

2130
		pod.config.UsePodIPC = true
2131

2132
		return nil
2133
	}
2134
}
2135

2136
// WithPodNet tells containers in this pod to use the network namespace
2137
// created for this pod.
2138
// Containers in a pod will inherit the kernel namespaces from the
2139
// first container added.
2140
func WithPodNet() PodCreateOption {
2141
	return func(pod *Pod) error {
2142
		if pod.valid {
2143
			return define.ErrPodFinalized
2144
		}
2145

2146
		pod.config.UsePodNet = true
2147

2148
		return nil
2149
	}
2150
}
2151

2152
// WithPodMount tells containers in this pod to use the mount namespace
2153
// created for this pod.
2154
// Containers in a pod will inherit the kernel namespaces from the
2155
// first container added.
2156
// TODO implement WithMountNSFrom, so WithMountNsFromPod functions properly
2157
// Then this option can be added on the pod level
2158
func WithPodMount() PodCreateOption {
2159
	return func(pod *Pod) error {
2160
		if pod.valid {
2161
			return define.ErrPodFinalized
2162
		}
2163

2164
		pod.config.UsePodMount = true
2165

2166
		return nil
2167
	}
2168
}
2169

2170
// WithPodUser tells containers in this pod to use the user namespace
2171
// created for this pod.
2172
// Containers in a pod will inherit the kernel namespaces from the
2173
// first container added.
2174
// TODO implement WithUserNSFrom, so WithUserNsFromPod functions properly
2175
// Then this option can be added on the pod level
2176
func WithPodUser() PodCreateOption {
2177
	return func(pod *Pod) error {
2178
		if pod.valid {
2179
			return define.ErrPodFinalized
2180
		}
2181

2182
		pod.config.UsePodUser = true
2183

2184
		return nil
2185
	}
2186
}
2187

2188
// WithPodPID tells containers in this pod to use the pid namespace
2189
// created for this pod.
2190
// Containers in a pod will inherit the kernel namespaces from the
2191
// first container added.
2192
func WithPodPID() PodCreateOption {
2193
	return func(pod *Pod) error {
2194
		if pod.valid {
2195
			return define.ErrPodFinalized
2196
		}
2197

2198
		pod.config.UsePodPID = true
2199

2200
		return nil
2201
	}
2202
}
2203

2204
// WithPodUTS tells containers in this pod to use the uts namespace
2205
// created for this pod.
2206
// Containers in a pod will inherit the kernel namespaces from the
2207
// first container added.
2208
func WithPodUTS() PodCreateOption {
2209
	return func(pod *Pod) error {
2210
		if pod.valid {
2211
			return define.ErrPodFinalized
2212
		}
2213

2214
		pod.config.UsePodUTS = true
2215

2216
		return nil
2217
	}
2218
}
2219

2220
// WithPodCgroup tells containers in this pod to use the cgroup namespace
2221
// created for this pod.
2222
// Containers in a pod will inherit the kernel namespaces from the first
2223
// container added.
2224
func WithPodCgroup() PodCreateOption {
2225
	return func(pod *Pod) error {
2226
		if pod.valid {
2227
			return define.ErrPodFinalized
2228
		}
2229

2230
		pod.config.UsePodCgroupNS = true
2231

2232
		return nil
2233
	}
2234
}
2235

2236
// WithInfraContainer tells the pod to create a pause container
2237
func WithInfraContainer() PodCreateOption {
2238
	return func(pod *Pod) error {
2239
		if pod.valid {
2240
			return define.ErrPodFinalized
2241
		}
2242
		pod.config.HasInfra = true
2243

2244
		return nil
2245
	}
2246
}
2247

2248
// WithServiceContainer associates the specified service container ID with the pod.
2249
func WithServiceContainer(id string) PodCreateOption {
2250
	return func(pod *Pod) error {
2251
		if pod.valid {
2252
			return define.ErrPodFinalized
2253
		}
2254

2255
		ctr, err := pod.runtime.LookupContainer(id)
2256
		if err != nil {
2257
			return fmt.Errorf("looking up service container: %w", err)
2258
		}
2259

2260
		if err := ctr.addServicePodLocked(pod.ID()); err != nil {
2261
			return fmt.Errorf("associating service container %s with pod %s: %w", id, pod.ID(), err)
2262
		}
2263

2264
		pod.config.ServiceContainerID = id
2265
		return nil
2266
	}
2267
}
2268

2269
// WithPodResources sets resource limits to be applied to the pod's cgroup
2270
// these will be inherited by all containers unless overridden.
2271
func WithPodResources(resources specs.LinuxResources) PodCreateOption {
2272
	return func(pod *Pod) error {
2273
		if pod.valid {
2274
			return define.ErrPodFinalized
2275
		}
2276
		pod.config.ResourceLimits = resources
2277
		return nil
2278
	}
2279
}
2280

2281
// WithVolatile sets the volatile flag for the container storage.
2282
// The option can potentially cause data loss when used on a container that must survive a machine reboot.
2283
func WithVolatile() CtrCreateOption {
2284
	return func(ctr *Container) error {
2285
		if ctr.valid {
2286
			return define.ErrCtrFinalized
2287
		}
2288

2289
		ctr.config.Volatile = true
2290

2291
		return nil
2292
	}
2293
}
2294

2295
// WithChrootDirs is an additional set of directories that need to be
2296
// treated as root directories. Standard bind mounts will be mounted
2297
// into paths relative to these directories.
2298
func WithChrootDirs(dirs []string) CtrCreateOption {
2299
	return func(ctr *Container) error {
2300
		if ctr.valid {
2301
			return define.ErrCtrFinalized
2302
		}
2303

2304
		ctr.config.ChrootDirs = dirs
2305

2306
		return nil
2307
	}
2308
}
2309

2310
// WithPasswdEntry sets the entry to write to the /etc/passwd file.
2311
func WithPasswdEntry(passwdEntry string) CtrCreateOption {
2312
	return func(ctr *Container) error {
2313
		if ctr.valid {
2314
			return define.ErrCtrFinalized
2315
		}
2316

2317
		ctr.config.PasswdEntry = passwdEntry
2318

2319
		return nil
2320
	}
2321
}
2322

2323
// WithGroupEntry sets the entry to write to the /etc/group file.
2324
func WithGroupEntry(groupEntry string) CtrCreateOption {
2325
	return func(ctr *Container) error {
2326
		if ctr.valid {
2327
			return define.ErrCtrFinalized
2328
		}
2329

2330
		ctr.config.GroupEntry = groupEntry
2331

2332
		return nil
2333
	}
2334
}
2335

2336
// WithBaseHostsFile sets the option to copy /etc/hosts file.
2337
func WithBaseHostsFile(baseHostsFile string) CtrCreateOption {
2338
	return func(ctr *Container) error {
2339
		if ctr.valid {
2340
			return define.ErrCtrFinalized
2341
		}
2342

2343
		ctr.config.BaseHostsFile = baseHostsFile
2344

2345
		return nil
2346
	}
2347
}
2348

2349
// WithMountAllDevices sets the option to mount all of a privileged container's
2350
// host devices
2351
func WithMountAllDevices() CtrCreateOption {
2352
	return func(ctr *Container) error {
2353
		if ctr.valid {
2354
			return define.ErrCtrFinalized
2355
		}
2356

2357
		ctr.config.MountAllDevices = true
2358

2359
		return nil
2360
	}
2361
}
2362

2363
// WithLabelNested sets the LabelNested flag allowing label separation within container
2364
func WithLabelNested(nested bool) CtrCreateOption {
2365
	return func(ctr *Container) error {
2366
		if ctr.valid {
2367
			return define.ErrCtrFinalized
2368
		}
2369

2370
		ctr.config.LabelNested = nested
2371

2372
		return nil
2373
	}
2374
}
2375