// kvm_manager.c - Advanced KVM virtual machine management
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <linux/kvm.h>
#include <errno.h>
#include <stdint.h>
#include <pthread.h>
#include <signal.h>
#include <sys/eventfd.h>
#include <sys/timerfd.h>
#include <poll.h>

#define MAX_VMS 64
#define MAX_VCPUS 32
#define GUEST_MEMORY_SIZE (1024 * 1024 * 1024) // 1GB
#define PAGE_SIZE 4096

// VM configuration structure
struct vm_config {
    int vm_id;
    int num_vcpus;
    size_t memory_size;
    char disk_image[256];
    char network_config[256];
    bool enable_kvm_clock;
    bool enable_apic;
    bool enable_x2apic;
};

// VCPU context
struct vcpu_context {
    int vcpu_fd;
    int vcpu_id;
    struct kvm_run *run;
    size_t mmap_size;
    pthread_t thread;
    bool running;
    struct vm_instance *vm;
    
    // Performance counters
    uint64_t exits;
    uint64_t instructions_retired;
    uint64_t cycles;
    
    // Interrupt handling
    int irq_fd;
    uint32_t pending_irqs;
};

// VM instance structure
struct vm_instance {
    int kvm_fd;
    int vm_fd;
    struct vm_config config;
    
    // Memory management
    void *guest_memory;
    size_t memory_size;
    struct kvm_userspace_memory_region memory_region;
    
    // VCPU management
    struct vcpu_context vcpus[MAX_VCPUS];
    int num_vcpus;
    
    // Device emulation
    int eventfd;
    int timerfd;
    
    // VM state
    bool running;
    bool paused;
    pthread_mutex_t state_mutex;
    
    // Statistics
    uint64_t total_exits;
    uint64_t uptime_ns;
    struct timespec start_time;
};

// Global VM manager
struct vm_manager {
    struct vm_instance vms[MAX_VMS];
    int num_vms;
    pthread_mutex_t manager_mutex;
    bool initialized;
} vm_manager = {0};

// Initialize KVM and check capabilities
static int init_kvm(void) {
    int kvm_fd;
    int ret;
    
    kvm_fd = open("/dev/kvm", O_RDWR | O_CLOEXEC);
    if (kvm_fd < 0) {
        perror("Failed to open /dev/kvm");
        return -1;
    }
    
    // Check KVM API version
    ret = ioctl(kvm_fd, KVM_GET_API_VERSION, NULL);
    if (ret == -1) {
        perror("KVM_GET_API_VERSION");
        close(kvm_fd);
        return -1;
    }
    
    if (ret != 12) {
        fprintf(stderr, "KVM API version %d, expected 12\n", ret);
        close(kvm_fd);
        return -1;
    }
    
    // Check required extensions
    ret = ioctl(kvm_fd, KVM_CHECK_EXTENSION, KVM_CAP_USER_MEMORY);
    if (!ret) {
        fprintf(stderr, "Required extension KVM_CAP_USER_MEMORY not available\n");
        close(kvm_fd);
        return -1;
    }
    
    ret = ioctl(kvm_fd, KVM_CHECK_EXTENSION, KVM_CAP_SET_TSS_ADDR);
    if (!ret) {
        fprintf(stderr, "Required extension KVM_CAP_SET_TSS_ADDR not available\n");
        close(kvm_fd);
        return -1;
    }
    
    printf("KVM initialized successfully\n");
    return kvm_fd;
}

// Create and configure VM
static int create_vm(struct vm_instance *vm, const struct vm_config *config) {
    int ret;
    
    memcpy(&vm->config, config, sizeof(*config));
    
    // Create VM
    vm->vm_fd = ioctl(vm->kvm_fd, KVM_CREATE_VM, (unsigned long)0);
    if (vm->vm_fd < 0) {
        perror("KVM_CREATE_VM");
        return -1;
    }
    
    // Allocate guest memory
    vm->memory_size = config->memory_size;
    vm->guest_memory = mmap(NULL, vm->memory_size, 
                           PROT_READ | PROT_WRITE, 
                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
    if (vm->guest_memory == MAP_FAILED) {
        perror("mmap guest memory");
        close(vm->vm_fd);
        return -1;
    }
    
    // Set up memory region
    vm->memory_region.slot = 0;
    vm->memory_region.guest_phys_addr = 0;
    vm->memory_region.memory_size = vm->memory_size;
    vm->memory_region.userspace_addr = (uintptr_t)vm->guest_memory;
    
    ret = ioctl(vm->vm_fd, KVM_SET_USER_MEMORY_REGION, &vm->memory_region);
    if (ret < 0) {
        perror("KVM_SET_USER_MEMORY_REGION");
        munmap(vm->guest_memory, vm->memory_size);
        close(vm->vm_fd);
        return -1;
    }
    
    // Set TSS address
    ret = ioctl(vm->vm_fd, KVM_SET_TSS_ADDR, 0xffffd000);
    if (ret < 0) {
        perror("KVM_SET_TSS_ADDR");
        munmap(vm->guest_memory, vm->memory_size);
        close(vm->vm_fd);
        return -1;
    }
    
    // Create identity map address
    ret = ioctl(vm->vm_fd, KVM_SET_IDENTITY_MAP_ADDR, 0xffffc000);
    if (ret < 0) {
        perror("KVM_SET_IDENTITY_MAP_ADDR");
        munmap(vm->guest_memory, vm->memory_size);
        close(vm->vm_fd);
        return -1;
    }
    
    // Initialize synchronization
    pthread_mutex_init(&vm->state_mutex, NULL);
    
    // Create event and timer fds for device emulation
    vm->eventfd = eventfd(0, EFD_CLOEXEC);
    vm->timerfd = timerfd_create(CLOCK_MONOTONIC, TFD_CLOEXEC);
    
    printf("VM %d created successfully\n", config->vm_id);
    return 0;
}

// Setup VCPU with advanced configuration
static int setup_vcpu(struct vm_instance *vm, int vcpu_id) {
    struct vcpu_context *vcpu = &vm->vcpus[vcpu_id];
    struct kvm_sregs sregs;
    struct kvm_regs regs;
    struct kvm_fpu fpu;
    struct kvm_cpuid2 *cpuid;
    int ret;
    
    vcpu->vcpu_id = vcpu_id;
    vcpu->vm = vm;
    
    // Create VCPU
    vcpu->vcpu_fd = ioctl(vm->vm_fd, KVM_CREATE_VCPU, (unsigned long)vcpu_id);
    if (vcpu->vcpu_fd < 0) {
        perror("KVM_CREATE_VCPU");
        return -1;
    }
    
    // Get VCPU mmap size
    ret = ioctl(vm->kvm_fd, KVM_GET_VCPU_MMAP_SIZE, NULL);
    if (ret < 0) {
        perror("KVM_GET_VCPU_MMAP_SIZE");
        close(vcpu->vcpu_fd);
        return -1;
    }
    vcpu->mmap_size = ret;
    
    // Map VCPU run structure
    vcpu->run = mmap(NULL, vcpu->mmap_size, PROT_READ | PROT_WRITE, 
                    MAP_SHARED, vcpu->vcpu_fd, 0);
    if (vcpu->run == MAP_FAILED) {
        perror("mmap vcpu run");
        close(vcpu->vcpu_fd);
        return -1;
    }
    
    // Set up CPUID
    cpuid = calloc(1, sizeof(*cpuid) + 100 * sizeof(cpuid->entries[0]));
    cpuid->nent = 100;
    
    ret = ioctl(vm->kvm_fd, KVM_GET_SUPPORTED_CPUID, cpuid);
    if (ret < 0) {
        perror("KVM_GET_SUPPORTED_CPUID");
        free(cpuid);
        munmap(vcpu->run, vcpu->mmap_size);
        close(vcpu->vcpu_fd);
        return -1;
    }
    
    // Modify CPUID entries for features
    for (int i = 0; i < cpuid->nent; i++) {
        struct kvm_cpuid_entry2 *entry = &cpuid->entries[i];
        
        switch (entry->function) {
            case 1:
                // Enable additional CPU features
                entry->ecx |= (1 << 31); // Hypervisor bit
                if (vm->config.enable_x2apic) {
                    entry->ecx |= (1 << 21); // x2APIC
                }
                break;
            case 0x40000000:
                // KVM signature
                entry->eax = 0x40000001;
                entry->ebx = 0x4b4d564b; // "KVMK"
                entry->ecx = 0x564b4d56; // "VMKV"
                entry->edx = 0x4d;       // "M"
                break;
        }
    }
    
    ret = ioctl(vcpu->vcpu_fd, KVM_SET_CPUID2, cpuid);
    free(cpuid);
    if (ret < 0) {
        perror("KVM_SET_CPUID2");
        munmap(vcpu->run, vcpu->mmap_size);
        close(vcpu->vcpu_fd);
        return -1;
    }
    
    // Initialize registers
    memset(&sregs, 0, sizeof(sregs));
    ret = ioctl(vcpu->vcpu_fd, KVM_GET_SREGS, &sregs);
    if (ret < 0) {
        perror("KVM_GET_SREGS");
        munmap(vcpu->run, vcpu->mmap_size);
        close(vcpu->vcpu_fd);
        return -1;
    }
    
    // Set up protected mode
    sregs.cs.base = 0;
    sregs.cs.limit = ~0u;
    sregs.cs.g = 1;
    sregs.cs.db = 1;
    sregs.cs.l = 0;
    sregs.cs.s = 1;
    sregs.cs.type = 0xb;
    sregs.cs.present = 1;
    sregs.cs.dpl = 0;
    sregs.cs.selector = 1 << 3;
    
    sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = sregs.cs;
    sregs.ds.type = sregs.es.type = sregs.fs.type = 
        sregs.gs.type = sregs.ss.type = 0x3;
    sregs.ds.selector = sregs.es.selector = sregs.fs.selector = 
        sregs.gs.selector = sregs.ss.selector = 2 << 3;
    
    sregs.cr0 |= 1; // Protected mode
    
    ret = ioctl(vcpu->vcpu_fd, KVM_SET_SREGS, &sregs);
    if (ret < 0) {
        perror("KVM_SET_SREGS");
        munmap(vcpu->run, vcpu->mmap_size);
        close(vcpu->vcpu_fd);
        return -1;
    }
    
    // Set up general purpose registers
    memset(&regs, 0, sizeof(regs));
    regs.rflags = 0x2;
    regs.rip = 0x100000; // Entry point
    regs.rsp = 0x200000; // Stack pointer
    
    ret = ioctl(vcpu->vcpu_fd, KVM_SET_REGS, &regs);
    if (ret < 0) {
        perror("KVM_SET_REGS");
        munmap(vcpu->run, vcpu->mmap_size);
        close(vcpu->vcpu_fd);
        return -1;
    }
    
    // Initialize FPU
    memset(&fpu, 0, sizeof(fpu));
    fpu.fcw = 0x37f;
    
    ret = ioctl(vcpu->vcpu_fd, KVM_SET_FPU, &fpu);
    if (ret < 0) {
        perror("KVM_SET_FPU");
        munmap(vcpu->run, vcpu->mmap_size);
        close(vcpu->vcpu_fd);
        return -1;
    }
    
    // Create IRQ eventfd for this VCPU
    vcpu->irq_fd = eventfd(0, EFD_CLOEXEC);
    
    printf("VCPU %d setup completed\n", vcpu_id);
    return 0;
}

// VCPU execution thread
static void *vcpu_thread(void *arg) {
    struct vcpu_context *vcpu = (struct vcpu_context *)arg;
    struct vm_instance *vm = vcpu->vm;
    int ret;
    
    printf("VCPU %d thread started\n", vcpu->vcpu_id);
    
    vcpu->running = true;
    
    while (vcpu->running && vm->running) {
        ret = ioctl(vcpu->vcpu_fd, KVM_RUN, NULL);
        
        if (ret < 0) {
            if (errno == EINTR) {
                continue;
            }
            perror("KVM_RUN");
            break;
        }
        
        vcpu->exits++;
        vm->total_exits++;
        
        // Handle different exit reasons
        switch (vcpu->run->exit_reason) {
            case KVM_EXIT_HLT:
                printf("VCPU %d: HLT instruction\n", vcpu->vcpu_id);
                vcpu->running = false;
                break;
                
            case KVM_EXIT_IO:
                printf("VCPU %d: I/O port access - port: 0x%x, direction: %s, size: %d\n",
                       vcpu->vcpu_id,
                       vcpu->run->io.port,
                       vcpu->run->io.direction == KVM_EXIT_IO_OUT ? "OUT" : "IN",
                       vcpu->run->io.size);
                
                // Handle specific I/O ports
                if (vcpu->run->io.port == 0x3f8 && vcpu->run->io.direction == KVM_EXIT_IO_OUT) {
                    // Serial port output
                    uint8_t *data = (uint8_t *)vcpu->run + vcpu->run->io.data_offset;
                    for (int i = 0; i < vcpu->run->io.count; i++) {
                        putchar(data[i]);
                    }
                    fflush(stdout);
                }
                break;
                
            case KVM_EXIT_MMIO:
                printf("VCPU %d: MMIO access - addr: 0x%llx, len: %d, is_write: %d\n",
                       vcpu->vcpu_id,
                       vcpu->run->mmio.phys_addr,
                       vcpu->run->mmio.len,
                       vcpu->run->mmio.is_write);
                break;
                
            case KVM_EXIT_INTR:
                // Interrupted by signal
                continue;
                
            case KVM_EXIT_SHUTDOWN:
                printf("VCPU %d: VM shutdown\n", vcpu->vcpu_id);
                vcpu->running = false;
                vm->running = false;
                break;
                
            case KVM_EXIT_FAIL_ENTRY:
                printf("VCPU %d: Failed to enter guest\n", vcpu->vcpu_id);
                printf("Hardware exit reason: 0x%llx\n", 
                       vcpu->run->fail_entry.hardware_entry_failure_reason);
                vcpu->running = false;
                break;
                
            case KVM_EXIT_INTERNAL_ERROR:
                printf("VCPU %d: Internal error - suberror: 0x%x\n",
                       vcpu->vcpu_id, vcpu->run->internal.suberror);
                vcpu->running = false;
                break;
                
            default:
                printf("VCPU %d: Unhandled exit reason: %d\n", 
                       vcpu->vcpu_id, vcpu->run->exit_reason);
                break;
        }
    }
    
    printf("VCPU %d thread exiting\n", vcpu->vcpu_id);
    return NULL;
}

// Start VM execution
static int start_vm(struct vm_instance *vm) {
    pthread_mutex_lock(&vm->state_mutex);
    
    if (vm->running) {
        pthread_mutex_unlock(&vm->state_mutex);
        return -1; // Already running
    }
    
    vm->running = true;
    clock_gettime(CLOCK_MONOTONIC, &vm->start_time);
    
    // Start VCPU threads
    for (int i = 0; i < vm->num_vcpus; i++) {
        int ret = pthread_create(&vm->vcpus[i].thread, NULL, 
                                vcpu_thread, &vm->vcpus[i]);
        if (ret != 0) {
            fprintf(stderr, "Failed to create VCPU %d thread: %s\n", 
                    i, strerror(ret));
            vm->running = false;
            pthread_mutex_unlock(&vm->state_mutex);
            return -1;
        }
    }
    
    pthread_mutex_unlock(&vm->state_mutex);
    
    printf("VM %d started with %d VCPUs\n", vm->config.vm_id, vm->num_vcpus);
    return 0;
}

// Stop VM execution
static int stop_vm(struct vm_instance *vm) {
    pthread_mutex_lock(&vm->state_mutex);
    
    if (!vm->running) {
        pthread_mutex_unlock(&vm->state_mutex);
        return -1; // Not running
    }
    
    vm->running = false;
    
    // Stop all VCPUs
    for (int i = 0; i < vm->num_vcpus; i++) {
        vm->vcpus[i].running = false;
        pthread_kill(vm->vcpus[i].thread, SIGUSR1);
    }
    
    pthread_mutex_unlock(&vm->state_mutex);
    
    // Wait for VCPU threads to finish
    for (int i = 0; i < vm->num_vcpus; i++) {
        pthread_join(vm->vcpus[i].thread, NULL);
    }
    
    printf("VM %d stopped\n", vm->config.vm_id);
    return 0;
}

// Load guest image into memory
static int load_guest_image(struct vm_instance *vm, const char *image_path) {
    FILE *file;
    size_t bytes_read;
    
    file = fopen(image_path, "rb");
    if (!file) {
        perror("Failed to open guest image");
        return -1;
    }
    
    // Load image at offset 0x100000 (1MB)
    bytes_read = fread((char *)vm->guest_memory + 0x100000, 1, 
                      vm->memory_size - 0x100000, file);
    
    fclose(file);
    
    if (bytes_read == 0) {
        fprintf(stderr, "Failed to read guest image\n");
        return -1;
    }
    
    printf("Loaded %zu bytes from %s\n", bytes_read, image_path);
    return 0;
}

// VM manager operations
static int vm_manager_init(void) {
    int kvm_fd;
    
    if (vm_manager.initialized) {
        return 0;
    }
    
    kvm_fd = init_kvm();
    if (kvm_fd < 0) {
        return -1;
    }
    
    memset(&vm_manager, 0, sizeof(vm_manager));
    pthread_mutex_init(&vm_manager.manager_mutex, NULL);
    
    // Set KVM fd for all potential VMs
    for (int i = 0; i < MAX_VMS; i++) {
        vm_manager.vms[i].kvm_fd = kvm_fd;
    }
    
    vm_manager.initialized = true;
    printf("VM manager initialized\n");
    
    return 0;
}

// Create new VM instance
static int vm_manager_create_vm(const struct vm_config *config) {
    pthread_mutex_lock(&vm_manager.manager_mutex);
    
    if (vm_manager.num_vms >= MAX_VMS) {
        pthread_mutex_unlock(&vm_manager.manager_mutex);
        return -1;
    }
    
    struct vm_instance *vm = &vm_manager.vms[vm_manager.num_vms];
    
    if (create_vm(vm, config) < 0) {
        pthread_mutex_unlock(&vm_manager.manager_mutex);
        return -1;
    }
    
    // Set up VCPUs
    vm->num_vcpus = config->num_vcpus;
    for (int i = 0; i < vm->num_vcpus; i++) {
        if (setup_vcpu(vm, i) < 0) {
            pthread_mutex_unlock(&vm_manager.manager_mutex);
            return -1;
        }
    }
    
    vm_manager.num_vms++;
    pthread_mutex_unlock(&vm_manager.manager_mutex);
    
    return config->vm_id;
}

// Get VM statistics
static void get_vm_stats(int vm_id) {
    struct vm_instance *vm = NULL;
    
    // Find VM
    for (int i = 0; i < vm_manager.num_vms; i++) {
        if (vm_manager.vms[i].config.vm_id == vm_id) {
            vm = &vm_manager.vms[i];
            break;
        }
    }
    
    if (!vm) {
        printf("VM %d not found\n", vm_id);
        return;
    }
    
    printf("=== VM %d Statistics ===\n", vm_id);
    printf("Status: %s\n", vm->running ? "Running" : "Stopped");
    printf("VCPUs: %d\n", vm->num_vcpus);
    printf("Memory: %zu MB\n", vm->memory_size / (1024 * 1024));
    printf("Total exits: %lu\n", vm->total_exits);
    
    for (int i = 0; i < vm->num_vcpus; i++) {
        printf("VCPU %d exits: %lu\n", i, vm->vcpus[i].exits);
    }
    
    if (vm->running) {
        struct timespec current_time;
        clock_gettime(CLOCK_MONOTONIC, &current_time);
        
        uint64_t uptime_ns = (current_time.tv_sec - vm->start_time.tv_sec) * 1000000000ULL +
                            (current_time.tv_nsec - vm->start_time.tv_nsec);
        
        printf("Uptime: %lu.%03lu seconds\n", 
               uptime_ns / 1000000000ULL, 
               (uptime_ns % 1000000000ULL) / 1000000ULL);
    }
}

// Signal handler for clean shutdown
static void signal_handler(int sig) {
    printf("Received signal %d, shutting down VMs...\n", sig);
    
    for (int i = 0; i < vm_manager.num_vms; i++) {
        if (vm_manager.vms[i].running) {
            stop_vm(&vm_manager.vms[i]);
        }
    }
    
    exit(0);
}

// Main function for testing
int main(int argc, char *argv[]) {
    struct vm_config config = {
        .vm_id = 1,
        .num_vcpus = 2,
        .memory_size = GUEST_MEMORY_SIZE,
        .enable_kvm_clock = true,
        .enable_apic = true,
        .enable_x2apic = false
    };
    
    // Install signal handlers
    signal(SIGINT, signal_handler);
    signal(SIGTERM, signal_handler);
    
    printf("Advanced KVM Manager starting...\n");
    
    // Initialize VM manager
    if (vm_manager_init() < 0) {
        fprintf(stderr, "Failed to initialize VM manager\n");
        return 1;
    }
    
    // Create VM
    int vm_id = vm_manager_create_vm(&config);
    if (vm_id < 0) {
        fprintf(stderr, "Failed to create VM\n");
        return 1;
    }
    
    // Load guest image if provided
    if (argc > 1) {
        if (load_guest_image(&vm_manager.vms[0], argv[1]) < 0) {
            fprintf(stderr, "Failed to load guest image\n");
            return 1;
        }
    }
    
    // Start VM
    if (start_vm(&vm_manager.vms[0]) < 0) {
        fprintf(stderr, "Failed to start VM\n");
        return 1;
    }
    
    // Monitor VM
    printf("VM started. Press Ctrl+C to stop.\n");
    
    while (vm_manager.vms[0].running) {
        sleep(5);
        get_vm_stats(vm_id);
    }
    
    // Cleanup
    stop_vm(&vm_manager.vms[0]);
    
    return 0;
}

// container_runtime.c - Custom container runtime implementation
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/capability.h>
#include <fcntl.h>
#include <errno.h>
#include <sched.h>
#include <signal.h>
#include <grp.h>
#include <pwd.h>
#include <linux/limits.h>
#include <linux/capability.h>
#include <seccomp.h>
#include <json-c/json.h>

#define MAX_CONTAINERS 256
#define MAX_MOUNTS 64
#define MAX_ENV_VARS 128
#define CONTAINER_ROOT "/var/lib/containers"
#define RUNTIME_DIR "/run/containers"

// Container specification structures
struct mount_spec {
    char source[PATH_MAX];
    char destination[PATH_MAX];
    char fstype[64];
    unsigned long flags;
    char options[256];
    bool bind_mount;
    bool readonly;
};

struct env_var {
    char name[256];
    char value[1024];
};

struct resource_limits {
    uint64_t memory_limit;      // bytes
    uint64_t cpu_shares;        // relative weight
    uint64_t cpu_quota;         // microseconds per period
    uint64_t cpu_period;        // microseconds
    uint32_t pids_limit;        // maximum processes
    uint64_t blkio_weight;      // block I/O weight
};

struct security_config {
    bool no_new_privs;
    uint64_t capability_mask;
    uid_t uid;
    gid_t gid;
    char seccomp_profile[PATH_MAX];
    char apparmor_profile[256];
    bool privileged;
};

struct container_config {
    char id[64];
    char name[256];
    char image[PATH_MAX];
    char rootfs[PATH_MAX];
    char workdir[PATH_MAX];
    
    // Command and arguments
    char **argv;
    int argc;
    
    // Environment
    struct env_var env_vars[MAX_ENV_VARS];
    int env_count;
    
    // Mounts
    struct mount_spec mounts[MAX_MOUNTS];
    int mount_count;
    
    // Resource limits
    struct resource_limits limits;
    
    // Security configuration
    struct security_config security;
    
    // Networking
    bool host_network;
    char network_namespace[64];
    
    // Process management
    bool init_process;
    bool remove_on_exit;
    
    // Logging
    char log_path[PATH_MAX];
    int log_level;
};

struct container_state {
    char id[64];
    pid_t pid;
    pid_t init_pid;
    int status;
    bool running;
    time_t created;
    time_t started;
    char bundle_path[PATH_MAX];
    
    // Namespace file descriptors
    int user_ns_fd;
    int mount_ns_fd;
    int net_ns_fd;
    int pid_ns_fd;
    int uts_ns_fd;
    int ipc_ns_fd;
    
    // Control groups
    char cgroup_path[PATH_MAX];
    
    // Process monitoring
    int exit_code;
    bool exited;
    struct timespec exit_time;
};

// Global container registry
struct container_registry {
    struct container_state containers[MAX_CONTAINERS];
    int count;
    pthread_mutex_t lock;
} registry = {0};

// Utility functions
static int setup_namespaces(struct container_config *config) {
    int flags = 0;
    
    // Determine which namespaces to create
    flags |= CLONE_NEWPID;   // PID namespace
    flags |= CLONE_NEWNS;    // Mount namespace
    flags |= CLONE_NEWUTS;   // UTS namespace
    flags |= CLONE_NEWIPC;   // IPC namespace
    
    if (!config->host_network) {
        flags |= CLONE_NEWNET;   // Network namespace
    }
    
    if (!config->security.privileged) {
        flags |= CLONE_NEWUSER;  // User namespace
    }
    
    return flags;
}

// Create and setup user namespace
static int setup_user_namespace(struct container_config *config) {
    char path[PATH_MAX];
    char *content;
    int fd;
    ssize_t written;
    
    // Set up UID mapping
    snprintf(path, sizeof(path), "/proc/%d/uid_map", getpid());
    fd = open(path, O_WRONLY);
    if (fd < 0) {
        perror("open uid_map");
        return -1;
    }
    
    asprintf(&content, "%u %u 1\n", config->security.uid, getuid());
    written = write(fd, content, strlen(content));
    close(fd);
    free(content);
    
    if (written < 0) {
        perror("write uid_map");
        return -1;
    }
    
    // Deny setgroups
    snprintf(path, sizeof(path), "/proc/%d/setgroups", getpid());
    fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, "deny", 4);
        close(fd);
    }
    
    // Set up GID mapping
    snprintf(path, sizeof(path), "/proc/%d/gid_map", getpid());
    fd = open(path, O_WRONLY);
    if (fd < 0) {
        perror("open gid_map");
        return -1;
    }
    
    asprintf(&content, "%u %u 1\n", config->security.gid, getgid());
    written = write(fd, content, strlen(content));
    close(fd);
    free(content);
    
    if (written < 0) {
        perror("write gid_map");
        return -1;
    }
    
    return 0;
}

// Setup mount namespace and bind mounts
static int setup_mounts(struct container_config *config) {
    char target[PATH_MAX];
    
    // Change to new root
    if (chroot(config->rootfs) < 0) {
        perror("chroot");
        return -1;
    }
    
    if (chdir("/") < 0) {
        perror("chdir");
        return -1;
    }
    
    // Create essential directories
    mkdir("/proc", 0755);
    mkdir("/sys", 0755);
    mkdir("/dev", 0755);
    mkdir("/tmp", 0755);
    
    // Mount essential filesystems
    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL) < 0) {
        perror("mount /proc");
        return -1;
    }
    
    if (mount("sysfs", "/sys", "sysfs", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL) < 0) {
        perror("mount /sys");
        return -1;
    }
    
    if (mount("tmpfs", "/dev", "tmpfs", MS_NOSUID | MS_STRICTATIME, "mode=755,size=65536k") < 0) {
        perror("mount /dev");
        return -1;
    }
    
    if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV, "mode=1777,size=1g") < 0) {
        perror("mount /tmp");
        return -1;
    }
    
    // Create essential device nodes
    mknod("/dev/null", S_IFCHR | 0666, makedev(1, 3));
    mknod("/dev/zero", S_IFCHR | 0666, makedev(1, 5));
    mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8));
    mknod("/dev/urandom", S_IFCHR | 0666, makedev(1, 9));
    
    // Setup custom mounts
    for (int i = 0; i < config->mount_count; i++) {
        struct mount_spec *mount = &config->mounts[i];
        
        // Create destination directory
        if (mkdir(mount->destination, 0755) < 0 && errno != EEXIST) {
            perror("mkdir mount destination");
            continue;
        }
        
        if (mount->bind_mount) {
            unsigned long flags = MS_BIND;
            if (mount->readonly) {
                flags |= MS_RDONLY;
            }
            
            if (mount(mount->source, mount->destination, NULL, flags, NULL) < 0) {
                perror("bind mount");
                return -1;
            }
        } else {
            if (mount(mount->source, mount->destination, mount->fstype, 
                     mount->flags, mount->options) < 0) {
                perror("mount");
                return -1;
            }
        }
    }
    
    return 0;
}

// Setup cgroups for resource management
static int setup_cgroups(struct container_state *state, struct container_config *config) {
    char cgroup_path[PATH_MAX];
    char content[256];
    int fd;
    
    // Create cgroup hierarchy
    snprintf(state->cgroup_path, sizeof(state->cgroup_path), 
             "/sys/fs/cgroup/container_%s", config->id);
    
    if (mkdir(state->cgroup_path, 0755) < 0 && errno != EEXIST) {
        perror("mkdir cgroup");
        return -1;
    }
    
    // Set memory limit
    if (config->limits.memory_limit > 0) {
        snprintf(cgroup_path, sizeof(cgroup_path), "%s/memory.limit_in_bytes", 
                state->cgroup_path);
        fd = open(cgroup_path, O_WRONLY);
        if (fd >= 0) {
            snprintf(content, sizeof(content), "%lu\n", config->limits.memory_limit);
            write(fd, content, strlen(content));
            close(fd);
        }
    }
    
    // Set CPU shares
    if (config->limits.cpu_shares > 0) {
        snprintf(cgroup_path, sizeof(cgroup_path), "%s/cpu.shares", 
                state->cgroup_path);
        fd = open(cgroup_path, O_WRONLY);
        if (fd >= 0) {
            snprintf(content, sizeof(content), "%lu\n", config->limits.cpu_shares);
            write(fd, content, strlen(content));
            close(fd);
        }
    }
    
    // Set CPU quota and period
    if (config->limits.cpu_quota > 0 && config->limits.cpu_period > 0) {
        snprintf(cgroup_path, sizeof(cgroup_path), "%s/cpu.cfs_quota_us", 
                state->cgroup_path);
        fd = open(cgroup_path, O_WRONLY);
        if (fd >= 0) {
            snprintf(content, sizeof(content), "%lu\n", config->limits.cpu_quota);
            write(fd, content, strlen(content));
            close(fd);
        }
        
        snprintf(cgroup_path, sizeof(cgroup_path), "%s/cpu.cfs_period_us", 
                state->cgroup_path);
        fd = open(cgroup_path, O_WRONLY);
        if (fd >= 0) {
            snprintf(content, sizeof(content), "%lu\n", config->limits.cpu_period);
            write(fd, content, strlen(content));
            close(fd);
        }
    }
    
    // Set PID limit
    if (config->limits.pids_limit > 0) {
        snprintf(cgroup_path, sizeof(cgroup_path), "%s/pids.max", 
                state->cgroup_path);
        fd = open(cgroup_path, O_WRONLY);
        if (fd >= 0) {
            snprintf(content, sizeof(content), "%u\n", config->limits.pids_limit);
            write(fd, content, strlen(content));
            close(fd);
        }
    }
    
    // Add current process to cgroup
    snprintf(cgroup_path, sizeof(cgroup_path), "%s/cgroup.procs", 
            state->cgroup_path);
    fd = open(cgroup_path, O_WRONLY);
    if (fd >= 0) {
        snprintf(content, sizeof(content), "%d\n", getpid());
        write(fd, content, strlen(content));
        close(fd);
    }
    
    return 0;
}

// Apply security configuration
static int apply_security_config(struct container_config *config) {
    // Set no new privs
    if (config->security.no_new_privs) {
        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
            perror("prctl PR_SET_NO_NEW_PRIVS");
            return -1;
        }
    }
    
    // Drop capabilities
    if (!config->security.privileged) {
        cap_t caps = cap_get_proc();
        if (caps == NULL) {
            perror("cap_get_proc");
            return -1;
        }
        
        // Clear all capabilities
        if (cap_clear(caps) < 0) {
            perror("cap_clear");
            cap_free(caps);
            return -1;
        }
        
        // Set only allowed capabilities
        for (int i = 0; i < 64; i++) {
            if (config->security.capability_mask & (1ULL << i)) {
                cap_value_t cap_val = i;
                if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val, CAP_SET) < 0 ||
                    cap_set_flag(caps, CAP_PERMITTED, 1, &cap_val, CAP_SET) < 0 ||
                    cap_set_flag(caps, CAP_INHERITABLE, 1, &cap_val, CAP_SET) < 0) {
                    perror("cap_set_flag");
                    cap_free(caps);
                    return -1;
                }
            }
        }
        
        if (cap_set_proc(caps) < 0) {
            perror("cap_set_proc");
            cap_free(caps);
            return -1;
        }
        
        cap_free(caps);
    }
    
    // Change UID/GID
    if (setgid(config->security.gid) < 0) {
        perror("setgid");
        return -1;
    }
    
    if (setuid(config->security.uid) < 0) {
        perror("setuid");
        return -1;
    }
    
    return 0;
}

// Container process function
static int container_process(void *arg) {
    struct container_config *config = (struct container_config *)arg;
    char **env_array;
    
    // Setup user namespace first
    if (!config->security.privileged && setup_user_namespace(config) < 0) {
        return -1;
    }
    
    // Setup mount namespace
    if (setup_mounts(config) < 0) {
        return -1;
    }
    
    // Change working directory
    if (strlen(config->workdir) > 0) {
        if (chdir(config->workdir) < 0) {
            perror("chdir workdir");
            return -1;
        }
    }
    
    // Apply security configuration
    if (apply_security_config(config) < 0) {
        return -1;
    }
    
    // Prepare environment
    env_array = malloc((config->env_count + 1) * sizeof(char *));
    for (int i = 0; i < config->env_count; i++) {
        asprintf(&env_array[i], "%s=%s", 
                config->env_vars[i].name, config->env_vars[i].value);
    }
    env_array[config->env_count] = NULL;
    
    // Execute container command
    execve(config->argv[0], config->argv, env_array);
    perror("execve");
    return -1;
}

// Create and start container
static int create_container(struct container_config *config) {
    struct container_state *state;
    char stack[8192];
    int clone_flags;
    pid_t pid;
    
    // Find free slot in registry
    pthread_mutex_lock(&registry.lock);
    if (registry.count >= MAX_CONTAINERS) {
        pthread_mutex_unlock(&registry.lock);
        return -1;
    }
    
    state = &registry.containers[registry.count];
    memset(state, 0, sizeof(*state));
    strncpy(state->id, config->id, sizeof(state->id) - 1);
    state->created = time(NULL);
    
    // Setup cgroups
    if (setup_cgroups(state, config) < 0) {
        pthread_mutex_unlock(&registry.lock);
        return -1;
    }
    
    // Determine clone flags
    clone_flags = setup_namespaces(config);
    
    // Create container process
    pid = clone(container_process, stack + sizeof(stack), clone_flags | SIGCHLD, config);
    if (pid < 0) {
        perror("clone");
        pthread_mutex_unlock(&registry.lock);
        return -1;
    }
    
    state->pid = pid;
    state->init_pid = pid;
    state->running = true;
    state->started = time(NULL);
    
    registry.count++;
    pthread_mutex_unlock(&registry.lock);
    
    printf("Container %s started with PID %d\n", config->id, pid);
    return 0;
}

// Monitor container process
static void monitor_container(const char *container_id) {
    struct container_state *state = NULL;
    int status;
    pid_t result;
    
    // Find container
    pthread_mutex_lock(&registry.lock);
    for (int i = 0; i < registry.count; i++) {
        if (strcmp(registry.containers[i].id, container_id) == 0) {
            state = &registry.containers[i];
            break;
        }
    }
    pthread_mutex_unlock(&registry.lock);
    
    if (!state) {
        printf("Container %s not found\n", container_id);
        return;
    }
    
    // Wait for container process
    result = waitpid(state->pid, &status, 0);
    if (result > 0) {
        state->running = false;
        state->exited = true;
        state->exit_code = WEXITSTATUS(status);
        clock_gettime(CLOCK_REALTIME, &state->exit_time);
        
        printf("Container %s exited with code %d\n", 
               container_id, state->exit_code);
        
        // Cleanup cgroup
        char cgroup_path[PATH_MAX];
        snprintf(cgroup_path, sizeof(cgroup_path), "%s/cgroup.procs", 
                state->cgroup_path);
        rmdir(state->cgroup_path);
    }
}

// List running containers
static void list_containers(void) {
    printf("ID\t\tPID\tStatus\tCreated\n");
    printf("--\t\t---\t------\t-------\n");
    
    pthread_mutex_lock(&registry.lock);
    for (int i = 0; i < registry.count; i++) {
        struct container_state *state = &registry.containers[i];
        char created_str[64];
        struct tm *tm_info = localtime(&state->created);
        strftime(created_str, sizeof(created_str), "%Y-%m-%d %H:%M:%S", tm_info);
        
        printf("%.12s\t%d\t%s\t%s\n",
               state->id,
               state->pid,
               state->running ? "Running" : "Exited",
               created_str);
    }
    pthread_mutex_unlock(&registry.lock);
}

// Parse container configuration from JSON
static int parse_config(const char *config_file, struct container_config *config) {
    json_object *root, *obj;
    const char *str_val;
    
    root = json_object_from_file(config_file);
    if (!root) {
        fprintf(stderr, "Failed to parse config file: %s\n", config_file);
        return -1;
    }
    
    // Parse basic configuration
    if (json_object_object_get_ex(root, "id", &obj)) {
        str_val = json_object_get_string(obj);
        strncpy(config->id, str_val, sizeof(config->id) - 1);
    }
    
    if (json_object_object_get_ex(root, "rootfs", &obj)) {
        str_val = json_object_get_string(obj);
        strncpy(config->rootfs, str_val, sizeof(config->rootfs) - 1);
    }
    
    // Parse process arguments
    if (json_object_object_get_ex(root, "args", &obj)) {
        int argc = json_object_array_length(obj);
        config->argc = argc;
        config->argv = malloc((argc + 1) * sizeof(char *));
        
        for (int i = 0; i < argc; i++) {
            json_object *arg_obj = json_object_array_get_idx(obj, i);
            config->argv[i] = strdup(json_object_get_string(arg_obj));
        }
        config->argv[argc] = NULL;
    }
    
    // Parse environment variables
    if (json_object_object_get_ex(root, "env", &obj)) {
        json_object_object_foreach(obj, key, val) {
            if (config->env_count < MAX_ENV_VARS) {
                strncpy(config->env_vars[config->env_count].name, key, 
                       sizeof(config->env_vars[config->env_count].name) - 1);
                strncpy(config->env_vars[config->env_count].value, 
                       json_object_get_string(val),
                       sizeof(config->env_vars[config->env_count].value) - 1);
                config->env_count++;
            }
        }
    }
    
    json_object_put(root);
    return 0;
}

// Main function
int main(int argc, char *argv[]) {
    struct container_config config = {0};
    
    if (argc < 3) {
        printf("Usage: %s <command> <config_file>\n", argv[0]);
        printf("Commands: create, list, monitor\n");
        return 1;
    }
    
    // Initialize registry
    pthread_mutex_init(&registry.lock, NULL);
    
    if (strcmp(argv[1], "create") == 0) {
        if (parse_config(argv[2], &config) < 0) {
            return 1;
        }
        
        return create_container(&config);
    } else if (strcmp(argv[1], "list") == 0) {
        list_containers();
        return 0;
    } else if (strcmp(argv[1], "monitor") == 0) {
        if (argc < 4) {
            printf("Usage: %s monitor <container_id>\n", argv[0]);
            return 1;
        }
        monitor_container(argv[3]);
        return 0;
    } else {
        printf("Unknown command: %s\n", argv[1]);
        return 1;
    }
}

#!/bin/bash
# container_runtime_demo.sh - Container runtime demonstration script

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUILD_DIR="$SCRIPT_DIR/build"
CONTAINER_ROOT="/tmp/container_demo"
RUNTIME_DIR="/tmp/container_runtime"

echo "=== Advanced Container Runtime Demo ==="

# Setup directories
setup_environment() {
    echo "Setting up environment..."
    
    sudo mkdir -p "$CONTAINER_ROOT"
    sudo mkdir -p "$RUNTIME_DIR"
    mkdir -p "$BUILD_DIR"
    
    # Check dependencies
    if ! command -v debootstrap &> /dev/null; then
        echo "Installing debootstrap..."
        sudo apt-get update
        sudo apt-get install -y debootstrap
    fi
    
    if ! pkg-config --exists json-c; then
        echo "Installing json-c development libraries..."
        sudo apt-get install -y libjson-c-dev
    fi
    
    if ! pkg-config --exists libcap; then
        echo "Installing libcap development libraries..."
        sudo apt-get install -y libcap-dev
    fi
    
    if ! pkg-config --exists libseccomp; then
        echo "Installing libseccomp development libraries..."
        sudo apt-get install -y libseccomp-dev
    fi
}

# Create minimal rootfs
create_rootfs() {
    local rootfs_dir="$CONTAINER_ROOT/rootfs"
    
    echo "Creating minimal rootfs..."
    
    if [ ! -d "$rootfs_dir" ]; then
        sudo debootstrap --variant=minbase --include=bash,coreutils,util-linux \
            jammy "$rootfs_dir" http://archive.ubuntu.com/ubuntu/
    fi
    
    # Create additional directories
    sudo mkdir -p "$rootfs_dir/app"
    sudo mkdir -p "$rootfs_dir/data"
    
    # Copy test application
    cat > "$BUILD_DIR/test_app.c" << 'EOF'
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

int main() {
    printf("Container test application starting...\n");
    printf("PID: %d\n", getpid());
    printf("UID: %d\n", getuid());
    printf("GID: %d\n", getgid());
    
    printf("Environment variables:\n");
    extern char **environ;
    for (char **env = environ; *env; env++) {
        printf("  %s\n", *env);
    }
    
    printf("Sleeping for 30 seconds...\n");
    sleep(30);
    
    printf("Container test application exiting\n");
    return 0;
}
EOF
    
    gcc -static -o "$BUILD_DIR/test_app" "$BUILD_DIR/test_app.c"
    sudo cp "$BUILD_DIR/test_app" "$rootfs_dir/app/"
    sudo chmod +x "$rootfs_dir/app/test_app"
    
    echo "Rootfs created at $rootfs_dir"
}

# Build container runtime
build_runtime() {
    echo "Building container runtime..."
    
    cd "$BUILD_DIR"
    
    # Copy source files
    cp "$SCRIPT_DIR/container_runtime.c" .
    cp "$SCRIPT_DIR/kvm_manager.c" .
    
    # Build container runtime
    gcc -o container_runtime container_runtime.c \
        $(pkg-config --cflags --libs json-c libcap libseccomp) \
        -lpthread
    
    # Build KVM manager
    gcc -o kvm_manager kvm_manager.c -lpthread
    
    echo "Runtime built successfully"
}

# Create container configuration
create_config() {
    local config_file="$BUILD_DIR/container_config.json"
    
    cat > "$config_file" << EOF
{
    "id": "test_container_$(date +%s)",
    "rootfs": "$CONTAINER_ROOT/rootfs",
    "args": ["/app/test_app"],
    "env": {
        "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
        "HOME": "/root",
        "TERM": "xterm",
        "CONTAINER_NAME": "test_container"
    },
    "mounts": [
        {
            "source": "/tmp",
            "destination": "/host_tmp",
            "type": "bind",
            "options": ["bind", "ro"]
        }
    ],
    "limits": {
        "memory": 134217728,
        "cpu_shares": 512,
        "pids_limit": 100
    },
    "security": {
        "no_new_privs": true,
        "uid": 1000,
        "gid": 1000,
        "privileged": false
    }
}
EOF
    
    echo "Configuration created: $config_file"
    echo "$config_file"
}

# Test container runtime
test_runtime() {
    local config_file=$(create_config)
    
    echo "Testing container runtime..."
    
    cd "$BUILD_DIR"
    
    # Create container
    echo "Creating container..."
    sudo ./container_runtime create "$config_file" &
    CONTAINER_PID=$!
    
    sleep 2
    
    # List containers
    echo "Listing containers..."
    sudo ./container_runtime list
    
    # Wait for container to complete
    echo "Waiting for container to complete..."
    wait $CONTAINER_PID || true
    
    echo "Container test completed"
}

# Demonstrate KVM functionality
test_kvm() {
    echo "Testing KVM functionality..."
    
    cd "$BUILD_DIR"
    
    # Check if KVM is available
    if [ ! -e /dev/kvm ]; then
        echo "KVM not available, skipping KVM test"
        return
    fi
    
    # Create simple guest code
    cat > guest_code.s << 'EOF'
.code16
.org 0x0
.globl _start

_start:
    # Print "Hello from VM" via serial port
    mov $0x48, %al    # 'H'
    out %al, $0x3f8
    mov $0x65, %al    # 'e'
    out %al, $0x3f8
    mov $0x6c, %al    # 'l'
    out %al, $0x3f8
    mov $0x6c, %al    # 'l'
    out %al, $0x3f8
    mov $0x6f, %al    # 'o'
    out %al, $0x3f8
    mov $0x20, %al    # ' '
    out %al, $0x3f8
    mov $0x66, %al    # 'f'
    out %al, $0x3f8
    mov $0x72, %al    # 'r'
    out %al, $0x3f8
    mov $0x6f, %al    # 'o'
    out %al, $0x3f8
    mov $0x6d, %al    # 'm'
    out %al, $0x3f8
    mov $0x20, %al    # ' '
    out %al, $0x3f8
    mov $0x56, %al    # 'V'
    out %al, $0x3f8
    mov $0x4d, %al    # 'M'
    out %al, $0x3f8
    mov $0x0a, %al    # '\n'
    out %al, $0x3f8
    
    # Halt
    hlt
    jmp .
EOF
    
    # Assemble guest code
    as --32 -o guest_code.o guest_code.s
    objcopy -O binary guest_code.o guest_image.bin
    
    # Test KVM manager
    echo "Starting KVM test (will run for 10 seconds)..."
    timeout 10s sudo ./kvm_manager guest_image.bin || true
    
    echo "KVM test completed"
}

# Performance benchmarking
benchmark_runtime() {
    echo "Running performance benchmarks..."
    
    local config_file=$(create_config)
    cd "$BUILD_DIR"
    
    echo "Container creation time benchmark..."
    
    for i in {1..5}; do
        echo "Run $i:"
        time sudo ./container_runtime create "$config_file" &
        CONTAINER_PID=$!
        sleep 1
        kill $CONTAINER_PID 2>/dev/null || true
        wait $CONTAINER_PID 2>/dev/null || true
    done
    
    echo "Benchmark completed"
}

# Cleanup function
cleanup() {
    echo "Cleaning up..."
    
    # Kill any running containers
    sudo pkill -f container_runtime || true
    sudo pkill -f kvm_manager || true
    
    # Remove temporary files
    sudo rm -rf "$CONTAINER_ROOT" || true
    sudo rm -rf "$RUNTIME_DIR" || true
    rm -rf "$BUILD_DIR" || true
    
    echo "Cleanup completed"
}

# Main execution
main() {
    case "${1:-all}" in
        setup)
            setup_environment
            ;;
        rootfs)
            create_rootfs
            ;;
        build)
            build_runtime
            ;;
        test)
            test_runtime
            ;;
        kvm)
            test_kvm
            ;;
        benchmark)
            benchmark_runtime
            ;;
        cleanup)
            cleanup
            ;;
        all)
            setup_environment
            create_rootfs
            build_runtime
            test_runtime
            test_kvm
            benchmark_runtime
            ;;
        *)
            echo "Usage: $0 {setup|rootfs|build|test|kvm|benchmark|cleanup|all}"
            echo ""
            echo "Commands:"
            echo "  setup     - Setup environment and install dependencies"
            echo "  rootfs    - Create minimal container rootfs"
            echo "  build     - Build container runtime and KVM manager"
            echo "  test      - Test container runtime functionality"
            echo "  kvm       - Test KVM virtualization (requires /dev/kvm)"
            echo "  benchmark - Run performance benchmarks"
            echo "  cleanup   - Remove all created files and containers"
            echo "  all       - Run all steps (default)"
            ;;
    esac
}

# Handle signals for cleanup
trap cleanup EXIT INT TERM

main "$@"