Truncate Container File
Truncates or extends a file in a running workload's container to size bytes. The target must be a RUNNING sandbox or job (FailedPrecondition otherwise); errno is mapped to a status (ENOENT NotFound, EEXIST AlreadyExists, EACCES/EPERM PermissionDenied, EROFS FailedPrecondition, ENOSPC ResourceExhausted). /.cp is hidden. Unavailable when the in-container handler is not running; Unimplemented without cluster access.
Access: namespace OPERATOR or above (write) on the target's namespace. Workspace-scoped credentials (a workload's own agent key) are refused.
Authorization
BearerAuth A namespace-scoped API key (cpk_…) for machines, or a Xeonr Auth OIDC
token for humans. The key's namespace and role are pinned server-side.
In: header
Header Parameters
Define the version of the Connect protocol
Define the timeout, in ms
Request Body
application/json
length <= 4096Applied as a signed 64-bit size.
int64value <= 9223372036854776000Response Body
application/json
application/json
curl -X POST "https://containers.xeonr.io/containers.api.v1.FilesystemService/Truncate" \ -H "Connect-Protocol-Version: 1" \ -H "Connect-Timeout-Ms: 1000" \ -H "Content-Type: application/json" \ -d '{ "target": {} }'{
"info": {
"path": "string",
"size": "string",
"mode": 0,
"isDir": true,
"sha256": "string",
"mtimeUnix": "string",
"symlinkTarget": "string"
}
}{
"code": "not_found",
"message": "string",
"details": [
{
"type": "string",
"value": "string",
"debug": {}
}
]
}Stat Container File POST
Returns metadata for one path in a running workload's own container filesystem (sha256 is never populated). Empty path means /. The target must be a RUNNING sandbox or job (FailedPrecondition otherwise); errno is mapped to a status (ENOENT NotFound, EEXIST AlreadyExists, EACCES/EPERM PermissionDenied, EROFS FailedPrecondition, ENOSPC ResourceExhausted). /.cp is hidden. Unavailable when the in-container handler is not running; Unimplemented without cluster access. **Access:** namespace VIEWER or above (read) on the target's namespace. Workspace-scoped credentials (a workload's own agent key) are refused.
Write Container File POST
Client-streaming write into a running workload's container: the first message must be the header (InvalidArgument otherwise), later messages are data. Overwrites by default (mode 0 means 0644); APPEND and PATCH_AT_OFFSET are also supported. The whole write is capped at 64 MiB. The rootfs is read-only unless the environment sets writable_rootfs, so writes usually land only in mounted volumes. The target must be a RUNNING sandbox or job (FailedPrecondition otherwise); errno is mapped to a status (ENOENT NotFound, EEXIST AlreadyExists, EACCES/EPERM PermissionDenied, EROFS FailedPrecondition, ENOSPC ResourceExhausted). /.cp is hidden. Unavailable when the in-container handler is not running; Unimplemented without cluster access. **Access:** namespace OPERATOR or above (write) on the target's namespace. Workspace-scoped credentials (a workload's own agent key) are refused.