// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.

// Code generated by hack/docgen tool. DO NOT EDIT.

package container

import (
	"github.com/siderolabs/go-pointer"

	"github.com/siderolabs/talos/pkg/machinery/config/encoder"
)

func (ContainerConfigV1Alpha1) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerConfig",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerConfig is a container configuration document." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerConfig is a container configuration document.\nContainerConfig declares a container to be run by Talos directly, without Kubernetes.\n\nThe container is started as soon as the configuration is applied, with no image rebuild\nand no reboot. It runs against the CRI containerd instance in the dedicated\n`taloscontainers` namespace, and is restarted automatically 5 seconds after it stops.\n\nContainers are not Talos services: they do not appear in `talosctl services`, and\n`talosctl service` does not apply to them. Status is reported via `ContainerStatus`.\n",
		Fields: []encoder.Doc{
			{
				Type:   "Meta",
				Inline: true,
			},
			{
				Name:        "name",
				Type:        "string",
				Note:        "",
				Description: "Name of the container.\n\nMust be between 1 and 63 characters long, and can only contain lowercase ASCII\nletters, digits and hyphens. It is used as the containerd container ID and as the\ncontainer's log identifier, so it may not collide with a Talos service name.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Name of the container." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "image",
				Type:        "string",
				Note:        "",
				Description: "OCI image reference supplying the container's root filesystem.\n\nA digest-pinned reference (`repo@sha256:...`) is recommended: it is the only form\nthat guarantees the same bytes on every pull. Short references are accepted and\nnormalized, so `nginx` becomes `index.docker.io/library/nginx:latest`.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "OCI image reference supplying the container's root filesystem." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "entrypoint",
				Type:        "[]string",
				Note:        "",
				Description: "Overrides the image's ENTRYPOINT.\n\nUnset means the image's own entrypoint is used.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Overrides the image's ENTRYPOINT." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "args",
				Type:        "[]string",
				Note:        "",
				Description: "Overrides the image's CMD.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Overrides the image's CMD." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "workingDir",
				Type:        "string",
				Note:        "",
				Description: "Overrides the image's WORKDIR.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Overrides the image's WORKDIR." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "runAs",
				Type:        "ContainerRunAs",
				Note:        "",
				Description: "Overrides the image's USER uid and/or gid.\n\nThere are no user namespaces, so a container running as uid 0 is root on the host.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Overrides the image's USER uid and/or gid." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "environment",
				Type:        "[]string",
				Note:        "",
				Description: "Environment variables, in `KEY=value` form, merged over the image's own ENV.\n\nValues are stored in the machine configuration verbatim, so treat anything put here\nas being as sensitive as the machine configuration itself.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Environment variables, in `KEY=value` form, merged over the image's own ENV." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "mounts",
				Type:        "[]ContainerMount",
				Note:        "",
				Description: "Filesystems to mount into the container.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Filesystems to mount into the container." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "security",
				Type:        "ContainerSecurity",
				Note:        "",
				Description: "Security settings for the container.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Security settings for the container." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "network",
				Type:        "ContainerNetwork",
				Note:        "",
				Description: "Network settings for the container.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Network settings for the container." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "resources",
				Type:        "ContainerResources",
				Note:        "",
				Description: "Resource limits, applied as cgroup v2 settings.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Resource limits, applied as cgroup v2 settings." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "dependsOn",
				Type:        "ContainerDependsOn",
				Note:        "",
				Description: "Conditions which must be satisfied before the container is started.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Conditions which must be satisfied before the container is started." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	doc.AddExample("", exampleContainerConfigV1Alpha1())

	doc.Fields[2].AddExample("", "docker.io/library/nginx:1.27")

	return doc
}

func (ContainerMount) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerMount",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerMount describes a single filesystem to mount into the container." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerMount describes a single filesystem to mount into the container.\n\nExactly one source must be set. Raw OCI mounts are deliberately not exposed; every source is\ntyped so that Talos can reason about what a container is allowed to reach.\n",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerConfigV1Alpha1",
				FieldName: "mounts",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "userVolume",
				Type:        "UserVolumeMount",
				Note:        "",
				Description: "Mount a user volume, referenced by the name of its `UserVolumeConfig` document.\n\nThe volume is mounted from `/var/mnt/<name>` on the host. Declaring this mount also\nmakes the container wait for the volume to be mounted before it starts.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Mount a user volume, referenced by the name of its `UserVolumeConfig` document." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "tmpfs",
				Type:        "TmpfsMount",
				Note:        "",
				Description: "Mount a tmpfs for scratch space.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Mount a tmpfs for scratch space." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "hostPath",
				Type:        "HostPathMount",
				Note:        "",
				Description: "Bind-mount a path from the host.\n\nThe source must already exist; Talos will not create it. This is the widest of the\nthree sources and the only one that can reach arbitrary host state.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Bind-mount a path from the host." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	return doc
}

func (UserVolumeMount) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "UserVolumeMount",
		Comments:    [3]string{"" /* encoder.HeadComment */, "UserVolumeMount mounts a user volume by name." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "UserVolumeMount mounts a user volume by name.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerMount",
				FieldName: "userVolume",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "name",
				Type:        "string",
				Note:        "",
				Description: "Name of the `UserVolumeConfig` document to mount.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Name of the `UserVolumeConfig` document to mount." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "destination",
				Type:        "string",
				Note:        "",
				Description: "Absolute path inside the container's mount namespace.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Absolute path inside the container's mount namespace." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "options",
				Type:        "[]string",
				Note:        "",
				Description: "Mount options. User volume mounts are writable by default (`rw`).",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Mount options. User volume mounts are writable by default (`rw`)." /* encoder.LineComment */, "" /* encoder.FootComment */},
				Values: []string{
					"ro",
					"rw",
					"noexec",
					"nosuid",
					"nodev",
					"noatime",
					"rbind",
					"rshared",
				},
			},
		},
	}

	return doc
}

func (TmpfsMount) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "TmpfsMount",
		Comments:    [3]string{"" /* encoder.HeadComment */, "TmpfsMount mounts a tmpfs." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "TmpfsMount mounts a tmpfs.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerMount",
				FieldName: "tmpfs",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "destination",
				Type:        "string",
				Note:        "",
				Description: "Absolute path inside the container's mount namespace.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Absolute path inside the container's mount namespace." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "size",
				Type:        "string",
				Note:        "",
				Description: "Size of the tmpfs, e.g. `64MiB`. Empty means the kernel default.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Size of the tmpfs, e.g. `64MiB`. Empty means the kernel default." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "options",
				Type:        "[]string",
				Note:        "",
				Description: "Mount options. Tmpfs mounts are writable by default (`rw`).",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Mount options. Tmpfs mounts are writable by default (`rw`)." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	doc.Fields[1].AddExample("", "64MiB")

	return doc
}

func (HostPathMount) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "HostPathMount",
		Comments:    [3]string{"" /* encoder.HeadComment */, "HostPathMount bind-mounts a host path." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "HostPathMount bind-mounts a host path.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerMount",
				FieldName: "hostPath",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "source",
				Type:        "string",
				Note:        "",
				Description: "Absolute path on the host. Must already exist.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Absolute path on the host. Must already exist." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "destination",
				Type:        "string",
				Note:        "",
				Description: "Absolute path inside the container's mount namespace.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Absolute path inside the container's mount namespace." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "options",
				Type:        "[]string",
				Note:        "",
				Description: "Mount options. Host path mounts are writable by default (`rw`).",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Mount options. Host path mounts are writable by default (`rw`)." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	return doc
}

func (ContainerRunAs) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerRunAs",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerRunAs overrides the image's user and group." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerRunAs overrides the image's user and group.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerConfigV1Alpha1",
				FieldName: "runAs",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "uid",
				Type:        "int32",
				Note:        "",
				Description: "UID to run the container's entrypoint as.\n\nUnset means use the image's own USER. There are no user namespaces, so uid 0 is host\nroot.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "UID to run the container's entrypoint as." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "gid",
				Type:        "int32",
				Note:        "",
				Description: "GID to run the container's entrypoint as.\n\nUnset means use the image's own USER.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "GID to run the container's entrypoint as." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	doc.Fields[0].AddExample("", pointer.To[int32](65534))
	doc.Fields[1].AddExample("", pointer.To[int32](65534))

	return doc
}

func (ContainerNetwork) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerNetwork",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerNetwork configures the container's network namespace." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerNetwork configures the container's network namespace.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerConfigV1Alpha1",
				FieldName: "network",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "mode",
				Type:        "ContainerNetworkMode",
				Note:        "",
				Description: "Network mode.\n\n`none` gives the container its own empty network namespace with no host access.\n`host` shares the host network namespace, so the container sees every interface and\ncan bind any port.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Network mode." /* encoder.LineComment */, "" /* encoder.FootComment */},
				Values: []string{
					"none",
					"host",
				},
			},
		},
	}

	return doc
}

func (ContainerResources) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerResources",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerResources configures cgroup v2 resource limits." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerResources configures cgroup v2 resource limits.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerConfigV1Alpha1",
				FieldName: "resources",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "limits",
				Type:        "ContainerResourceLimits",
				Note:        "",
				Description: "Hard ceilings the container cannot exceed.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Hard ceilings the container cannot exceed." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	return doc
}

func (ContainerResourceLimits) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerResourceLimits",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerResourceLimits are hard ceilings." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerResourceLimits are hard ceilings.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerResources",
				FieldName: "limits",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "cpu",
				Type:        "string",
				Note:        "",
				Description: "CPU ceiling in millicores, mapped onto cgroup v2 `cpu.max`.\n\n`1000m` is one core.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "CPU ceiling in millicores, mapped onto cgroup v2 `cpu.max`." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "memory",
				Type:        "string",
				Note:        "",
				Description: "Memory ceiling, mapped onto cgroup v2 `memory.max`.\n\nExceeding it OOM-kills the container.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Memory ceiling, mapped onto cgroup v2 `memory.max`." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	doc.Fields[0].AddExample("", "1500m")
	doc.Fields[1].AddExample("", "512MiB")

	return doc
}

func (ContainerDependsOn) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerDependsOn",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerDependsOn gates container startup on external conditions." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerDependsOn gates container startup on external conditions.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerConfigV1Alpha1",
				FieldName: "dependsOn",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "paths",
				Type:        "[]string",
				Note:        "",
				Description: "Host paths which must exist before the container starts.\n\nPolled, so a path that never appears leaves the container waiting indefinitely.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Host paths which must exist before the container starts." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "networks",
				Type:        "[]string",
				Note:        "",
				Description: "Network readiness conditions which must be satisfied.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Network readiness conditions which must be satisfied." /* encoder.LineComment */, "" /* encoder.FootComment */},
				Values: []string{
					"addresses",
					"connectivity",
					"hostname",
					"etcfiles",
				},
			},
			{
				Name:        "time",
				Type:        "bool",
				Note:        "",
				Description: "Whether the clock must be synchronized before the container starts.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Whether the clock must be synchronized before the container starts." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "containers",
				Type:        "[]string",
				Note:        "",
				Description: "Other containers, by document name, which must be running first.\n\nCycles are rejected when the machine configuration is applied.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Other containers, by document name, which must be running first." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	doc.Fields[0].AddExample("", []string{"/var/mnt/web-content"})

	return doc
}

func (ContainerSecurity) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerSecurity",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerSecurity configures the container's security posture." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerSecurity configures the container's security posture.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerConfigV1Alpha1",
				FieldName: "security",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "profile",
				Type:        "ContainerSecurityProfile",
				Note:        "",
				Description: "Security profile.\n\n`restricted` drops all capabilities, allows no device access, and mounts the rootfs\nand sysfs read-only. `privileged` grants all grantable capabilities and all devices,\nwhich is what extension services get implicitly.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Security profile." /* encoder.LineComment */, "" /* encoder.FootComment */},
				Values: []string{
					"restricted",
					"privileged",
				},
			},
			{
				Name:        "capabilities",
				Type:        "ContainerCapabilities",
				Note:        "",
				Description: "Linux capabilities to add or drop on top of the profile.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Linux capabilities to add or drop on top of the profile." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "machinedAccess",
				Type:        "bool",
				Note:        "",
				Description: "Publishes the container's PID so machined's API can recognize it, and bind-mounts the\nmachined API socket into the container.\n\nThis alone does not grant DAC access to the socket, which is owned by the `apid` user:\nreaching it in practice still requires `profile: privileged` or an equivalent capability/\n`runAs` grant. Once connected, the container may request any role, same as extension\nservices; the RPC's own role requirements are what actually gate access.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Publishes the container's PID so machined's API can recognize it, and bind-mounts the" /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	return doc
}

func (ContainerCapabilities) Doc() *encoder.Doc {
	doc := &encoder.Doc{
		Type:        "ContainerCapabilities",
		Comments:    [3]string{"" /* encoder.HeadComment */, "ContainerCapabilities adjusts the container's Linux capabilities." /* encoder.LineComment */, "" /* encoder.FootComment */},
		Description: "ContainerCapabilities adjusts the container's Linux capabilities.",
		AppearsIn: []encoder.Appearance{
			{
				TypeName:  "ContainerSecurity",
				FieldName: "capabilities",
			},
		},
		Fields: []encoder.Doc{
			{
				Name:        "add",
				Type:        "[]string",
				Note:        "",
				Description: "Capabilities to grant, without the `CAP_` prefix.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Capabilities to grant, without the `CAP_` prefix." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
			{
				Name:        "drop",
				Type:        "[]string",
				Note:        "",
				Description: "Capabilities to remove, without the `CAP_` prefix. `ALL` removes every capability.",
				Comments:    [3]string{"" /* encoder.HeadComment */, "Capabilities to remove, without the `CAP_` prefix. `ALL` removes every capability." /* encoder.LineComment */, "" /* encoder.FootComment */},
			},
		},
	}

	doc.Fields[0].AddExample("", []string{"NET_ADMIN"})
	doc.Fields[1].AddExample("", []string{"ALL"})

	return doc
}

// GetFileDoc returns documentation for the file container_doc.go.
func GetFileDoc() *encoder.FileDoc {
	return &encoder.FileDoc{
		Name:        "container",
		Description: "Package container provides container configuration documents.\n",
		Structs: []*encoder.Doc{
			ContainerConfigV1Alpha1{}.Doc(),
			ContainerMount{}.Doc(),
			UserVolumeMount{}.Doc(),
			TmpfsMount{}.Doc(),
			HostPathMount{}.Doc(),
			ContainerRunAs{}.Doc(),
			ContainerNetwork{}.Doc(),
			ContainerResources{}.Doc(),
			ContainerResourceLimits{}.Doc(),
			ContainerDependsOn{}.Doc(),
			ContainerSecurity{}.Doc(),
			ContainerCapabilities{}.Doc(),
		},
	}
}
