Xeonr Developer Docs
API SpecificationContainer Files

Set Container File Attributes

POST
/containers.api.v1.FilesystemService/SetAttr

Changes a path's mode, mtime and/or symlink target in a running workload's container; zero or empty fields are left unchanged. Only an existing symlink can be retargeted. Can fail with EPERM on files the workload's user does not own. The target must be a RUNNING sandbox or job (FailedPrecondition otherwise); errno is mapped to a status (ENOENT NotFound, EEXIST AlreadyExists, EACCES/EPERM PermissionDenied, EROFS FailedPrecondition, ENOSPC ResourceExhausted). /.cp is hidden. Unavailable when the in-container handler is not running; Unimplemented without cluster access.

Access: namespace OPERATOR or above (write) on the target's namespace. Workspace-scoped credentials (a workload's own agent key) are refused.

Authorization

BearerAuth
AuthorizationBearer <token>

A namespace-scoped API key (cpk_…) for machines, or a Xeonr Auth OIDC token for humans. The key's namespace and role are pinned server-side.

In: header

Header Parameters

Connect-Protocol-Version?number

Define the version of the Connect protocol

Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

target*&
path?string
Lengthlength <= 4096
mode?integer

validate:skip passed to chmod as-is; 0 = leave unchanged

mtimeUnix?string

validate:skip any unix time is valid; 0 = leave unchanged

Formatint64
symlinkTarget?string

empty = leave unchanged

Lengthlength <= 4096
[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://containers.xeonr.io/containers.api.v1.FilesystemService/SetAttr" \  -H "Connect-Protocol-Version: 1" \  -H "Connect-Timeout-Ms: 1000" \  -H "Content-Type: application/json" \  -d '{    "target": {}  }'
{
  "info": {
    "path": "string",
    "size": "string",
    "mode": 0,
    "isDir": true,
    "sha256": "string",
    "mtimeUnix": "string",
    "symlinkTarget": "string"
  }
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Remove Container File POST

Removes a file or, with recursive, a directory tree in a running workload's container. The target must be a RUNNING sandbox or job (FailedPrecondition otherwise); errno is mapped to a status (ENOENT NotFound, EEXIST AlreadyExists, EACCES/EPERM PermissionDenied, EROFS FailedPrecondition, ENOSPC ResourceExhausted). /.cp is hidden. Unavailable when the in-container handler is not running; Unimplemented without cluster access. **Access:** namespace OPERATOR or above (write) on the target's namespace. Workspace-scoped credentials (a workload's own agent key) are refused.

Stat Container File POST

Returns metadata for one path in a running workload's own container filesystem (sha256 is never populated). Empty path means /. The target must be a RUNNING sandbox or job (FailedPrecondition otherwise); errno is mapped to a status (ENOENT NotFound, EEXIST AlreadyExists, EACCES/EPERM PermissionDenied, EROFS FailedPrecondition, ENOSPC ResourceExhausted). /.cp is hidden. Unavailable when the in-container handler is not running; Unimplemented without cluster access. **Access:** namespace VIEWER or above (read) on the target's namespace. Workspace-scoped credentials (a workload's own agent key) are refused.