trustedlabels

Documentation

Index

• Variables
• type Retriever
  • func NewDocker(trustServer string, trustBaseDir string) (Retriever, error)
  • func NewMock(labels map[string]struct{}) Retriever

Variables

var (

	// ErrUnknownContainer is the error used when a Docker container could not be
	// identified.
	ErrUnknownContainer = errors.New("unknown docker container")
)

Types

type Retriever

type Retriever interface {
	LabelsForPID(pid int) (map[string]struct{}, error)
}

A Retriever is a type capable of looking up the docker image labels for a given PID. In other words, if a docker image, I, is used to launch a container, C, and that container contains a process with PID P, then calling LabelsForPID(P) will return all of the labels associated with I.

func NewDocker

func NewDocker(trustServer string, trustBaseDir string) (Retriever, error)

NewDocker returns a new Retriever that uses the provided notary server and trust store base directory to look up labels in the Docker daemon and then validate the associated images' cryptographic signatures.

func NewMock

func NewMock(labels map[string]struct{}) Retriever

NewMock returns a mocked Retriever which always responds with the given set of labels to any request.