#pragma once
#include <string>
#include <vector>

#include "container.hpp"
#include "util.hpp"

namespace doos {

class Cgroup;

// Runs a command inside a container: starts the namespaces if the container is
// stopped, joins them if it is already running. Returns the command's exit code.
class Sandbox {
public:
    Sandbox(Container container, std::vector<std::string> command)
        : container_(std::move(container)), command_(std::move(command)) {}

    int run();

    // AppArmor profile (text) that lets this very binary use user namespaces on Ubuntu 24.04+.
    static std::string apparmorProfile();
    // Shell command that installs it; shown when a start fails because of AppArmor.
    static std::string apparmorInstallHint();

private:
    int start(FileLock& lock);
    int watch(pid_t child, Cgroup* cgroup);
    int join(pid_t initPid, FileLock& lock);

    Container container_;
    std::vector<std::string> command_;
};

}  // namespace doos