container: improve documentation

This change removes inconsistencies collected over time in this package.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 11 insertions, 7 deletions

diff --git a/container/seccomp/libseccomp.go b/container/seccomp/libseccomp.go
index 4684be26..afb1848b 100644
--- a/container/seccomp/libseccomp.go
+++ b/container/seccomp/libseccomp.go
@@ -88,18 +88,22 @@ var resPrefix = [...]string{
 	7: "seccomp_load failed",
 }
 
-// cbAllocateBuffer is the function signature for the function handle passed to hakurei_export_filter
-// which allocates the buffer that the resulting bpf program is copied into, and writes its slice header
-// to a value held by the caller.
+// cbAllocateBuffer is the function signature for the function handle passed to
+// hakurei_scmp_make_filter which allocates the buffer that the resulting bpf
+// program is copied into, and writes its slice header to a value held by the caller.
 type cbAllocateBuffer = func(len C.size_t) (buf unsafe.Pointer)
 
+// hakurei_scmp_allocate allocates a buffer of specified size known to the
+// runtime through a callback passed in a [cgo.Handle].
+//
 //export hakurei_scmp_allocate
 func hakurei_scmp_allocate(f C.uintptr_t, len C.size_t) (buf unsafe.Pointer) {
 	return cgo.Handle(f).Value().(cbAllocateBuffer)(len)
 }
 
-// makeFilter generates a bpf program from a slice of [std.NativeRule] and writes the resulting byte slice to p.
-// The filter is installed to the current process if p is nil.
+// makeFilter generates a bpf program from a slice of [std.NativeRule] and
+// writes the resulting byte slice to p. The filter is installed to the current
+// process if p is nil.
 func makeFilter(rules []std.NativeRule, flags ExportFlag, p *[]byte) error {
 	if len(rules) == 0 {
 		return ErrInvalidRules
@@ -170,8 +174,8 @@ func Export(rules []std.NativeRule, flags ExportFlag) (data []byte, err error) {
 	return
 }
 
-// Load generates a bpf program from a slice of [std.NativeRule] and enforces it on the current process.
-// Errors returned by libseccomp is wrapped in [LibraryError].
+// Load generates a bpf program from a slice of [std.NativeRule] and enforces it
+// on the current process. Errors returned by libseccomp is wrapped in [LibraryError].
 func Load(rules []std.NativeRule, flags ExportFlag) error { return makeFilter(rules, flags, nil) }
 
 type (