/**
 * Network mode options for Docker containers
 */
export type NetworkMode = "bridge" | "host" | "none";

/**
 * Linux capabilities that can be dropped from containers.
 * See https://man7.org/linux/man-pages/man7/capabilities.7.html
 */
export type LinuxCapability =
  | "ALL"
  | "AUDIT_CONTROL"
  | "AUDIT_READ"
  | "AUDIT_WRITE"
  | "BLOCK_SUSPEND"
  | "CHOWN"
  | "DAC_OVERRIDE"
  | "DAC_READ_SEARCH"
  | "FOWNER"
  | "FSETID"
  | "IPC_LOCK"
  | "IPC_OWNER"
  | "KILL"
  | "LEASE"
  | "LINUX_IMMUTABLE"
  | "MAC_ADMIN"
  | "MAC_OVERRIDE"
  | "MKNOD"
  | "NET_ADMIN"
  | "NET_BIND_SERVICE"
  | "NET_BROADCAST"
  | "NET_RAW"
  | "SETFCAP"
  | "SETGID"
  | "SETPCAP"
  | "SETUID"
  | "SYS_ADMIN"
  | "SYS_BOOT"
  | "SYS_CHROOT"
  | "SYS_MODULE"
  | "SYS_NICE"
  | "SYS_PACCT"
  | "SYS_PTRACE"
  | "SYS_RAWIO"
  | "SYS_RESOURCE"
  | "SYS_TIME"
  | "SYS_TTY_CONFIG"
  | "SYSLOG"
  | "WAKE_ALARM";

/**
 * Security hardening options for Docker containers
 */
export interface DockerSecurityOptions {
  /**
   * Linux capabilities to drop from the container.
   * Default: ["ALL"] - drops all capabilities for maximum security.
   * Set to empty array to keep default Docker capabilities.
   */
  capDrop?: LinuxCapability[];

  /**
   * Linux capabilities to add back after dropping.
   * Only effective when capDrop includes "ALL".
   * Default: [] - no capabilities added back.
   */
  capAdd?: LinuxCapability[];

  /**
   * Make the root filesystem read-only.
   * Containers can still write to mounted volumes.
   * Default: true for security (agents write to /workspace mount).
   */
  readonlyRootfs?: boolean;

  /**
   * Maximum number of processes (PIDs) allowed in the container.
   * Prevents fork bomb attacks.
   * Default: 100 - sufficient for most agent workloads.
   * Set to 0 or -1 for unlimited (not recommended).
   */
  pidsLimit?: number;

  /**
   * Disable privilege escalation via setuid/setgid.
   * Default: true - prevents privilege escalation.
   */
  noNewPrivileges?: boolean;
}

/**
 * Options for creating a Docker sandbox container
 */
export interface DockerSandboxOptions {
  /** Memory limit in MB (default: 512) */
  memoryMB?: number;
  /** CPU limit (1.0 = 1 core, default: 1.0) */
  cpuLimit?: number;
  /** Network mode (default: bridge) */
  networkMode?: NetworkMode;
  /** Docker image to use (default: node:20-alpine) */
  image?: string;
  /** Additional environment variables */
  env?: Record<string, string>;
  /** Security hardening options */
  security?: DockerSecurityOptions;
}

/**
 * Result of creating a Docker container
 */
export interface ContainerCreateResult {
  /** Docker container ID */
  containerId: string;
  /** Agent ID associated with this container */
  agentId: string;
  /** Task ID associated with this container */
  taskId: string;
  /** Timestamp when container was created */
  createdAt: Date;
}

/**
 * Container status information
 */
export interface ContainerStatus {
  /** Container ID */
  containerId: string;
  /** Current status (running, stopped, etc.) */
  status: string;
  /** Additional state information */
  state?: Record<string, unknown>;
}
