From f18a8f958187aa52d028d1e3cc3dc0c03b742fed Mon Sep 17 00:00:00 2001 From: Adin Scannell Date: Tue, 9 Apr 2019 10:19:17 -0700 Subject: [PATCH] Update README.md to point to gvisor.dev PiperOrigin-RevId: 242690968 Change-Id: I1ac2248b5ab3bcd95beed52ecddbb9f34eeb3775 --- .github/issue_template.md | 17 +- README.md | 418 +++--------------------------- docs/README.md | 37 --- docs/architecture_guide/README.md | 1 - docs/architecture_guide/why.md | 9 - docs/contributor_guide/README.md | 1 - docs/user_guide/README.md | 1 - docs/user_guide/docker.md | 41 --- docs/user_guide/quick_start.md | 71 ----- g3doc/Layers.png | Bin 11044 -> 0 bytes g3doc/Layers.svg | 1 - g3doc/Machine-Virtualization.png | Bin 13205 -> 0 bytes g3doc/Machine-Virtualization.svg | 1 - g3doc/Rule-Based-Execution.png | Bin 6780 -> 0 bytes g3doc/Rule-Based-Execution.svg | 1 - g3doc/Sentry-Gofer.png | Bin 9064 -> 0 bytes g3doc/Sentry-Gofer.svg | 1 - g3doc/checkpoint_restore.md | 108 -------- g3doc/logo.png | Bin 0 -> 27719 bytes 19 files changed, 40 insertions(+), 668 deletions(-) delete mode 100644 docs/README.md delete mode 100644 docs/architecture_guide/README.md delete mode 100644 docs/architecture_guide/why.md delete mode 100644 docs/contributor_guide/README.md delete mode 100644 docs/user_guide/README.md delete mode 100644 docs/user_guide/docker.md delete mode 100644 docs/user_guide/quick_start.md delete mode 100644 g3doc/Layers.png delete mode 100644 g3doc/Layers.svg delete mode 100644 g3doc/Machine-Virtualization.png delete mode 100644 g3doc/Machine-Virtualization.svg delete mode 100644 g3doc/Rule-Based-Execution.png delete mode 100644 g3doc/Rule-Based-Execution.svg delete mode 100644 g3doc/Sentry-Gofer.png delete mode 100644 g3doc/Sentry-Gofer.svg delete mode 100644 g3doc/checkpoint_restore.md create mode 100644 g3doc/logo.png diff --git a/.github/issue_template.md b/.github/issue_template.md index 73afe1317..77c401d22 100644 --- a/.github/issue_template.md +++ b/.github/issue_template.md @@ -1,4 +1,6 @@ -Before filling an issue, please consult our FAQ: https://github.com/google/gvisor#faq--known-issues +Before filling an issue, please consult our FAQ: +https://gvisor.dev/docs/user_guide/faq/ + Also check that the issue hasn't been reported before. If you have a question, please email gvisor-users@googlegroups.com rather than filing a bug. @@ -7,11 +9,12 @@ If you believe you've found a security issue, please email gvisor-security@googl If this is your first time compiling or running gVisor, please make sure that your system meets the minimum requirements: https://github.com/google/gvisor#requirements -For all other issues, please attach debug logs. To get debug logs, follow the instructions here: https://github.com/google/gvisor#debugging +For all other issues, please attach debug logs. To get debug logs, follow the +instructions here: https://gvisor.dev/docs/user_guide/debugging/ Other useful information to include is: -- `docker version` or `docker info` if more relevant -- `uname -a` -- `git describe` -- Full docker command you ran -- Detailed repro steps + +* `runsc -v` +* `docker version` or `docker info` if more relevant +* `uname -a` - `git describe` +* Detailed reproduction steps diff --git a/README.md b/README.md index e960614ff..8eac9833b 100644 --- a/README.md +++ b/README.md @@ -1,17 +1,15 @@ -# gVisor +![gVisor](g3doc/logo.png) -gVisor is a user-space kernel, written in Go, that implements a substantial +## What is gVisor? + +**gVisor** is a user-space kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an [Open Container Initiative (OCI)][oci] runtime called `runsc` that provides an isolation boundary between the application and the host kernel. The `runsc` runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers. -gVisor takes a distinct approach to container sandboxing and makes a different -set of technical trade-offs compared to existing sandbox technologies, thus -providing new tools and ideas for the container security landscape. - -### Why does gVisor exist? +## Why does gVisor exist? Containers are not a [**sandbox**][sandbox]. While containers have revolutionized how we develop, package, and deploy applications, running @@ -31,223 +29,17 @@ against external threats, provide additional integrity checks, or limit the scope of access for a service. One should always be careful about what data is made available to a container. -### How is gVisor different from other container isolation mechanisms? +## Documentation -Two other approaches are commonly taken to provide stronger isolation than -native containers. +User documentation and technical architecture, including quick start guides, can +be found at [gvisor.dev][gvisor-dev]. -**Machine-level virtualization**, such as [KVM][kvm] and [Xen][xen], exposes -virtualized hardware to a guest kernel via a Virtual Machine Monitor (VMM). This -virtualized hardware is generally enlightened (paravirtualized) and additional -mechanisms can be used to improve the visibility between the guest and host -(e.g. balloon drivers, paravirtualized spinlocks). Running containers in -distinct virtual machines can provide great isolation, compatibility and -performance (though nested virtualization may bring challenges in this area), -but for containers it often requires additional proxies and agents, and may -require a larger resource footprint and slower start-up times. +## Installing from source -![Machine-level virtualization](g3doc/Machine-Virtualization.png "Machine-level virtualization") +gVisor currently requires x86\_64 Linux to build, though support for other +architectures may become available in the future. -**Rule-based execution**, such as [seccomp][seccomp], [SELinux][selinux] and -[AppArmor][apparmor], allows the specification of a fine-grained security policy -for an application or container. These schemes typically rely on hooks -implemented inside the host kernel to enforce the rules. If the surface can be -made small enough (i.e. a sufficiently complete policy defined), then this is an -excellent way to sandbox applications and maintain native performance. However, -in practice it can be extremely difficult (if not impossible) to reliably define -a policy for arbitrary, previously unknown applications, making this approach -challenging to apply universally. - -![Rule-based execution](g3doc/Rule-Based-Execution.png "Rule-based execution") - -Rule-based execution is often combined with additional layers for -defense-in-depth. - -**gVisor** provides a third isolation mechanism, distinct from those mentioned -above. - -gVisor intercepts application system calls and acts as the guest kernel, without -the need for translation through virtualized hardware. gVisor may be thought of -as either a merged guest kernel and VMM, or as seccomp on steroids. This -architecture allows it to provide a flexible resource footprint (i.e. one based -on threads and memory mappings, not fixed guest physical resources) while also -lowering the fixed costs of virtualization. However, this comes at the price of -reduced application compatibility and higher per-system call overhead. - -![gVisor](g3doc/Layers.png "gVisor") - -On top of this, gVisor employs rule-based execution to provide defense-in-depth -(details below). - -gVisor's approach is similar to [User Mode Linux (UML)][uml], although UML -virtualizes hardware internally and thus provides a fixed resource footprint. - -Each of the above approaches may excel in distinct scenarios. For example, -machine-level virtualization will face challenges achieving high density, while -gVisor may provide poor performance for system call heavy workloads. - -### Why Go? - -gVisor was written in Go in order to avoid security pitfalls that can plague -kernels. With Go, there are strong types, built-in bounds checks, no -uninitialized variables, no use-after-free, no stack overflow, and a built-in -race detector. (The use of Go has its challenges too, and isn't free.) - -## Architecture - -gVisor intercepts all system calls made by the application, and does the -necessary work to service them. Importantly, gVisor does not simply redirect -application system calls through to the host kernel. Instead, gVisor implements -most kernel primitives (signals, file systems, futexes, pipes, mm, etc.) and has -complete system call handlers built on top of these primitives. - -Since gVisor is itself a user-space application, it will make some host system -calls to support its operation, but much like a VMM, it will not allow the -application to directly control the system calls it makes. - -### File System Access - -In order to provide defense-in-depth and limit the host system surface, the -gVisor container runtime is normally split into two separate processes. First, -the *Sentry* process includes the kernel and is responsible for executing user -code and handling system calls. Second, file system operations that extend -beyond the sandbox (not internal proc or tmp files, pipes, etc.) are sent to a -proxy, called a *Gofer*, via a 9P connection. - -![Sentry](g3doc/Sentry-Gofer.png "Sentry and Gofer") - -The Gofer acts as a file system proxy by opening host files on behalf of the -application, and passing them to the Sentry process, which has no host file -access itself. Furthermore, the Sentry runs in an empty user namespace, and the -system calls made by gVisor to the host are restricted using seccomp filters in -order to provide defense-in-depth. - -### Network Access - -The Sentry implements its own network stack (also written in Go) called -[netstack][netstack]. All aspects of the network stack are handled inside the -Sentry — including TCP connection state, control messages, and packet assembly — -keeping it isolated from the host network stack. Data link layer packets are -written directly to the virtual device inside the network namespace setup by -Docker or Kubernetes. - -A network passthrough mode is also supported, but comes at the cost of reduced -isolation (see below). - -### Platforms - -The Sentry requires a *platform* to implement basic context switching and memory -mapping functionality. Today, gVisor supports two platforms: - -* The **Ptrace** platform uses SYSEMU functionality to execute user code - without executing host system calls. This platform can run anywhere that - `ptrace` works (even VMs without nested virtualization). - -* The **KVM** platform (experimental) allows the Sentry to act as both guest - OS and VMM, switching back and forth between the two worlds seamlessly. The - KVM platform can run on bare-metal or on a VM with nested virtualization - enabled. While there is no virtualized hardware layer -- the sandbox retains - a process model -- gVisor leverages virtualization extensions available on - modern processors in order to improve isolation and performance of address - space switches. - -### Performance - -There are several factors influencing performance. The platform choice has the -largest direct impact that varies depending on the specific workload. There is -no best platform: Ptrace works universally, including on VM instances, but -applications may perform at a fraction of their original levels. Beyond the -platform choice, passthrough modes may be useful for improving performance at -the cost of some isolation. - -## Installation - -These instructions will get you up-and-running sandboxed containers with gVisor -and Docker. - -Note that gVisor can only run on x86\_64 Linux 3.17+. In addition, gVisor only -supports x86\_64 binaries inside the sandbox (i.e., it cannot run 32-bit -binaries). - -### Download a Build - -The easiest way to get `runsc` is from the -[latest nightly build][runsc-nightly]. After you download the binary, check it -against the SHA512 [checksum file][runsc-nightly-sha]. Older builds can be found -here: -`https://storage.googleapis.com/gvisor/releases/nightly/${yyyy-mm-dd}/runsc` and -`https://storage.googleapis.com/gvisor/releases/nightly/${yyyy-mm-dd}/runsc.sha512` - -**It is important to copy this binary to some place that is accessible to all -users, and make is executable to all users**, since `runsc` executes itself as -user `nobody` to avoid unnecessary privileges. The `/usr/local/bin` directory is -a good place to put the `runsc` binary. - -``` -wget https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc -wget https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc.sha512 -sha512sum -c runsc.sha512 -chmod a+x runsc -sudo mv runsc /usr/local/bin -``` - -### Running with Docker - -To use gVisor with Docker you must add `runsc` as a runtime to your Docker -configuration (`/etc/docker/daemon.json`). You may have to create this file if -it does not exist. Also, some Docker versions also require you to -[specify the `storage-driver` field][docker-storage-driver]. - -In the end, the file should look something like: - -``` -{ - "runtimes": { - "runsc": { - "path": "/usr/local/bin/runsc" - } - } -} -``` - -You must restart the Docker daemon after making changes to this file, typically -this is done via: - -``` -sudo systemctl restart docker -``` - -Now run your container in `runsc`: - -``` -docker run --runtime=runsc hello-world -``` - -Terminal support works too: - -``` -docker run --runtime=runsc -it ubuntu /bin/bash -``` - -### Running with Kubernetes - -gVisor can run sandboxed containers in a Kubernetes cluster with Minikube. After -the gVisor addon is enabled, pods with `io.kubernetes.cri.untrusted-workload` -set to true will execute with `runsc`. Follow [these instructions][minikube] to -enable gVisor addon. - -You can also setup Kubernetes nodes to run pods in gvisor using the `containerd` -CRI runtime and the `gvisor-containerd-shim`. Pods with the -`io.kubernetes.cri.untrusted-workload` annotation will execute with `runsc`. You -can find instructions [here][gvisor-containerd-shim]. - -## Advanced Usage - -### Installing from Source - -gVisor currently requires x86\_64 Linux to build. - -#### Requirements +### Requirements Make sure the following dependencies are installed: @@ -257,9 +49,9 @@ Make sure the following dependencies are installed: * [Docker version 17.09.0 or greater][docker] * Gold linker (e.g. `binutils-gold` package on Ubuntu) -#### Getting the source +### Getting the source -Clone the gVisor repo: +Clone the repository: ``` git clone https://gvisor.googlesource.com/gvisor gvisor @@ -268,7 +60,7 @@ cd gvisor ### Building -Build and install the `runsc` binary. +Build and install the `runsc` binary: ``` bazel build runsc @@ -277,47 +69,16 @@ sudo cp ./bazel-bin/runsc/linux_amd64_pure_stripped/runsc /usr/local/bin ### Testing -The gVisor test suite can be run with Bazel: +The test suite can be run with Bazel: ``` bazel test ... ``` -### Debugging - -To enable debug and system call logging, add the `runtimeArgs` below to your -Docker configuration (`/etc/docker/daemon.json`): - -``` -{ - "runtimes": { - "runsc": { - "path": "/usr/local/bin/runsc", - "runtimeArgs": [ - "--debug-log=/tmp/runsc/", - "--debug", - "--strace" - ] - } - } -} -``` - -You may also want to pass `--log-packets` to troubleshoot network problems. Then -restart the Docker daemon: - -``` -sudo systemctl restart docker -``` - -Run your container again, and inspect the files under `/tmp/runsc`. The log file -with name `boot` will contain the strace logs from your application, which can -be useful for identifying missing or broken system calls in gVisor. - -### Building/testing with Remote Execution +### Using remote execution If you have a [Remote Build Execution][rbe] environment, you can use it to speed -up gVisor build and test cycles. +up build and test cycles. You must authenticate with the project first: @@ -336,152 +97,33 @@ Then invoke bazel with the following flags: You can also add those flags to your local ~/.bazelrc to avoid needing to specify them each time on the command line. -### Enabling network passthrough +## Community & Governance -For high-performance networking applications, you may choose to disable the user -space network stack and instead use the host network stack. Note that this mode -decreases the isolation to the host. +The governance model is documented in our [community][community] repository. -Add the following `runtimeArgs` to your Docker configuration -(`/etc/docker/daemon.json`) and restart the Docker daemon: +The [gvisor-users mailing list][gvisor-users-list] and +[gvisor-dev mailing list][gvisor-dev-list] are good starting points for +questions and discussion. -``` -{ - "runtimes": { - "runsc": { - "path": "/usr/local/bin/runsc", - "runtimeArgs": [ - "--network=host" - ] - } - } -} -``` +## Security -### Selecting a different platform - -Depending on hardware and performance characteristics, you may choose to use a -different platform. The Ptrace platform is the default, but the KVM platform may -be specified by passing the `--platform` flag to `runsc` in your Docker -configuration (`/etc/docker/daemon.json`): - -``` -{ - "runtimes": { - "runsc": { - "path": "/usr/local/bin/runsc", - "runtimeArgs": [ - "--platform=kvm" - ] - } - } -} -``` - -Then restart the Docker daemon. - -### Checkpoint/Restore - -gVisor has the ability to checkpoint a process, save its current state in a -state file, and restore into a new container using the state file. For more -information about the checkpoint and restore commands, see the -[checkpoint/restore readme][checkpoint-restore]. - -## FAQ & Known Issues - -### Will my container work with gVisor? - -gVisor implements a large portion of the Linux surface and while we strive to -make it broadly compatible, there are (and always will be) unimplemented -features and bugs. The only real way to know if it will work is to try. If you -find a container that doesn’t work and there is no known issue, please -[file a bug][bug] indicating the full command you used to run the image. -Providing the debug logs is also helpful. - -### What works? - -The following applications/images have been tested: - -* elasticsearch -* golang -* httpd -* java8 -* jenkins -* mariadb -* memcached -* mongo -* mysql -* nginx -* node -* php -* postgres -* prometheus -* python -* redis -* registry -* tomcat -* wordpress - -### My container runs fine with *runc* but fails with *runsc*. - -If you’re having problems running a container with `runsc` it’s most likely due -to a compatibility issue or a missing feature in gVisor. See **Debugging**, -above. - -### When I run my container, docker fails with `flag provided but not defined: -console` - -You're using an old version of Docker. Refer to the -[Requirements](#requirements) section for the minimum version supported. - -### I can’t see a file copied with `docker cp`. - -For performance reasons, gVisor caches directory contents, and therefore it may -not realize a new file was copied to a given directory. To invalidate the cache -and force a refresh, create a file under the directory in question and list the -contents again. - -This bug is tracked in [bug #4](https://github.com/google/gvisor/issues/4). - -Note that `kubectl cp` works because it does the copy by exec'ing inside the -sandbox, and thus gVisor cache is aware of the new files and dirs. - -## Technical details - -We plan to release a full paper with technical details and will include it here -when available. - -## Community - -Join the [gvisor-users mailing list][gvisor-users-list] to discuss all things -gVisor. - -Sensitive security-related questions and comments can be sent to the private -[gvisor-security mailing list][gvisor-security-list]. +Sensitive security-related questions, comments and disclosures can be sent to +the [gvisor-security mailing list][gvisor-security-list]. The full security +disclosure policy is defined in the [community][community] repository. ## Contributing See [Contributing.md](CONTRIBUTING.md). -[apparmor]: https://wiki.ubuntu.com/AppArmor [bazel]: https://bazel.build -[bug]: https://github.com/google/gvisor/issues -[checkpoint-restore]: https://gvisor.googlesource.com/gvisor/+/master/g3doc/checkpoint_restore.md -[docker-storage-driver]: https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-storage-driver +[community]: https://gvisor.googlesource.com/community [docker]: https://www.docker.com [git]: https://git-scm.com -[gvisor-containerd-shim]: https://github.com/google/gvisor-containerd-shim [gvisor-security-list]: https://groups.google.com/forum/#!forum/gvisor-security [gvisor-users-list]: https://groups.google.com/forum/#!forum/gvisor-users -[kvm]: https://www.linux-kvm.org -[minikube]: https://github.com/kubernetes/minikube/blob/master/deploy/addons/gvisor/README.md -[netstack]: https://github.com/google/netstack +[gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev [oci]: https://www.opencontainers.org [python]: https://python.org [rbe]: https://blog.bazel.build/2018/10/05/remote-build-execution.html -[runsc-nightly-sha]: https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc.sha512 -[runsc-nightly]: https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc [sandbox]: https://en.wikipedia.org/wiki/Sandbox_(computer_security) -[seccomp]: https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt -[selinux]: https://selinuxproject.org -[uml]: http://user-mode-linux.sourceforge.net/ -[xen]: https://www.xenproject.org +[gvisor-dev]: https://gvisor.dev diff --git a/docs/README.md b/docs/README.md deleted file mode 100644 index 6f847fa4b..000000000 --- a/docs/README.md +++ /dev/null @@ -1,37 +0,0 @@ -# gVisor Documentation - -**This doc is a work in progress. For the definitive documentation please see -the [README](../README.md)** - -gVisor is a user-space kernel, written in Go, that implements a substantial -portion of the [Linux system call interface][linux-interface]. It provides an -additional layer of isolation between running applications and the host -operating system. - -gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc` -that makes it easy to work with existing container tooling. The `runsc` runtime -integrates with Docker and Kubernetes, making it simple to run sandboxed -containers. - -Check out the [gVisor Quick Start](user_guide/quick_start.md) to get started -using gVisor. - -gVisor takes a distinct approach to container sandboxing and makes a different -set of technical trade-offs compared to existing sandbox technologies, thus -providing new tools and ideas for the container security landscape. - -Check out [Why gVisor?](architecture_guide/why.md) for more on why we made -gVisor. - -## How this documentation is organized - -- The [Architecture Guide](architecture_guide/README.md) explains about - gVisor's architecture & design philosophy. Start here if you would like to - know more about how gVisor works and why it was created. -- The [User Guide](user_guide/README.md) contains info on how to use gVisor - and integrate it into your application or platform. -- The [Contributer Guide](contributer_guide/README.md) includes documentation - on how to build gVisor, run tests, and contribute to gVisor's development. - -[linux-interface]: https://en.wikipedia.org/wiki/Linux_kernel_interfaces -[oci]: https://www.opencontainers.org diff --git a/docs/architecture_guide/README.md b/docs/architecture_guide/README.md deleted file mode 100644 index fe0569721..000000000 --- a/docs/architecture_guide/README.md +++ /dev/null @@ -1 +0,0 @@ -# Architecture Guide diff --git a/docs/architecture_guide/why.md b/docs/architecture_guide/why.md deleted file mode 100644 index 2bf9c60fd..000000000 --- a/docs/architecture_guide/why.md +++ /dev/null @@ -1,9 +0,0 @@ -# Why gVisor? - -gVisor makes a different set of technical trade-offs compared to existing -sandbox technologies, thus providing new tools and ideas for the container -security landscape. - -As the developers of gVisor, we wanted an execution environment that was secure, -simple, and lightweight and were able to make trade offs in other areas. We were -not able to achieve that with existing solutions. diff --git a/docs/contributor_guide/README.md b/docs/contributor_guide/README.md deleted file mode 100644 index 83840bba3..000000000 --- a/docs/contributor_guide/README.md +++ /dev/null @@ -1 +0,0 @@ -# Contributor Guide diff --git a/docs/user_guide/README.md b/docs/user_guide/README.md deleted file mode 100644 index cd3d45227..000000000 --- a/docs/user_guide/README.md +++ /dev/null @@ -1 +0,0 @@ -# User Guide diff --git a/docs/user_guide/docker.md b/docs/user_guide/docker.md deleted file mode 100644 index fefb5f993..000000000 --- a/docs/user_guide/docker.md +++ /dev/null @@ -1,41 +0,0 @@ -# Run gVisor with Docker - -## Configuring Docker - -Next, configure Docker to use `runsc` by adding a runtime entry to your Docker -configuration (`/etc/docker/daemon.json`). You may have to create this file if -it does not exist. Also, some Docker versions also require you to [specify the -`storage-driver` field][docker-storage-driver]. - -In the end, the file should look something like: - -``` -{ - "runtimes": { - "runsc": { - "path": "/usr/local/bin/runsc" - } - } -} -``` - -You must restart the Docker daemon after making changes to this file, typically -this is done via: - -``` -sudo systemctl restart docker -``` - -## Running a container - -Now run your container in `runsc`: - -``` -docker run --runtime=runsc hello-world -``` - -You can also run a terminal to explore the container. - -``` -docker run --runtime=runsc -it ubuntu /bin/bash -``` diff --git a/docs/user_guide/quick_start.md b/docs/user_guide/quick_start.md deleted file mode 100644 index 219c1ed63..000000000 --- a/docs/user_guide/quick_start.md +++ /dev/null @@ -1,71 +0,0 @@ -# Quick Start - -This guide will quickly get you started running your first gVisor sandbox -container. - -Some requirements: - -- gVisor requires Linux x86\_64 Linux 3.17+ -- This guide requires Docker. Read the Docker documentation for how to install - it on how to [install Docker](https://docs.docker.com/install/) - -## Install gVisor - -The easiest way to get `runsc` is from the -[latest nightly build][runsc-nightly]. After you download the binary, check it -against the SHA512 [checksum file][runsc-nightly-sha]. Older builds can be found -here: -`https://storage.googleapis.com/gvisor/releases/nightly/${yyyy-mm-dd}/runsc` and -`https://storage.googleapis.com/gvisor/releases/nightly/${yyyy-mm-dd}/runsc.sha512` - -**It is important to copy this binary to some place that is accessible to all -users, and make is executable to all users**, since `runsc` executes itself as -user `nobody` to avoid unnecessary privileges. The `/usr/local/bin` directory is -a good place to put the `runsc` binary. - -``` -wget https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc -wget https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc.sha512 -sha512sum -c runsc.sha512 -chmod a+x runsc -sudo mv runsc /usr/local/bin -``` - -## Run an OCI compatible container - -Now we will create an [OCI][oci] container bundle to run our container. First we -will create a root directory for our bundle. - -``` -$ mkdir bundle -$ cd bundle -``` - -Create a root file system for the container. We will use the Docker hello-world -image as the basis for our container. - -``` -$ mkdir rootfs -$ docker export $(docker create hello-world) | tar -xf - -C rootfs -``` - -Next, create an specification file called `config.json` that contains our -container specification. We will update the default command it runs to `/hello` -in the `hello-world` container. - -``` -$ runsc spec -$ sed -i 's;"sh";"/hello";' config.json -``` - -Finally run the container. - -``` -$ sudo runsc run hello -``` - -\[TODO]:# Add some next steps - -[runsc-nightly-sha]: https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc.sha512 -[runsc-nightly]: https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc -[oci]: https://www.opencontainers.org diff --git a/g3doc/Layers.png b/g3doc/Layers.png deleted file mode 100644 index 308c6c4516c0d6043eea1b1f1f51503e08159917..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11044 zcmeAS@N?(olHy`uVBq!ia0y~yU@T@}VED(u#=yXE;_*`j1_rIyo-U3d6}R5bd+dClvz5wcQe;a(^%Lk zF?);K+KC?S>P`&}j@+8FRyZn!IBPJwbj~;y#NF$6i}P;bvMM#>)iK4-Yp3sh{kFX5 z{ptPRCw>34FMsXcPw)0VpI3d)_mlPScbm`eJQpb9iUWx*R=;0)?u~H%{jCm*MJN6J z;D7In!T)N_Q!m)x*B!pJ-|k-pNc`dZY5(_%xX!rDQQW0;Ce!55oJAbPQoRPtH4e>j zQ$C~FWw2cE8Av{(#nM&qnTb@QUto)6uiK1Zkwia;{6%b9!SahSwBD9^W*%Q2n{nRu z*NbJbpXV{NAIg69ZE^V>!My*^9<~=(-Mueox#{I~6_Cy6cit_(?CZGc=fb<6R{H1O zD%H36e&@riUA1RL!&`3q->=U1Tlal)e!X?Y`P=uzdhXVIUKTqU2uuoUAoPd3fw#XRV68<`^)c`*IK!5y(h?t`!v})rtW*ddNB2URrrSeTTNT; zet*9!+dE;O4a6o-MQC^Dq8-i!a~&t-oG*;A?7{XrV5ArjYNOqRgV-0;k)a z*L;)zmw4ml9<_-a*0R#KkEh3EU(b#c-t*$iWoPT>Z#Ex(zbv&t=J}&4jrR8wUe1!O z|Ft}^a&Ox6r_=SjS3kD7BOc>^yM6xr{m-O8@%8zvsRMt&HAlymNQQX%m{(U9=_q_V z>R+S8qH=2Am!tZ8bsrBftDnxYWcVK(9xFQSXsMT>U${=%+FE&ir@H8Y=+~FClcayY ztvy(|gKwYugML4@hgxs`d-?N&Qpe9{5_@tQ*cC3-Hq38bz+ZgeURv{u2P@Yy-)@-C zd!3=_!zIRlR}aP9PO{CBm?yL0|HJ5fUf%f+Eq^~$-g3~%UhB-Gc;WlXT*s=`?d98c zac1OtIe*Q%bZ1a>%?l3J_;ulGfuqQoy!{`KrG8zYx5gwnk;WM zMN}_)&&V%x;CN+6Ci9LJ><{H@`oA8qIdxkNoZh{6|M>Iy@Qh8p-+wtYU0=sMo6E^w znU!tEuZQd@JAXVikk~cNfV=PUOU0~D{Chrp)UW@U^5R(k>cbcQZ9OC-+aRB`>7k1B zXLXQS_k%7wS~1wJJF_)BPI4M!gD%I~?R=LRJ?a@m1hy6Cv^X(1&$iqwbVl@w8S}Aa z!AiOU21nDEgu2MU?Llb#o<3! zTqK-S8nhNvKdgMNyZf1!fqOcGfl|KAOx+!7L0pC!t2VgQ-ZEs|apJ`$i9ge!iYSNlCH@>1?95A| z_~!{MTG#o0aiWHL=Cq7v`?!YBZ-hIgiXN8+34uIRd2j8i3}=zRmkoh(+NXXPyIh}L z%RJ*)sRM&?UwU!x)T!%EzWgKNIz!y%jB#Ylk48vg2Q4Davpkqt7W`c^QN!7ir%z}K z*axH)i%^r$3fmdMpkfwLmVR>ekE{81NI3t#>tfL3RSUQVW(Q?n zlA3gF(w1dQrivacU*{dQ^k>XDd*-f1T#=!k*3-5u_MAOoez)iCy$7ob>&oTo-zQ(H zeEGcUpJsqa=m{y`TN}2oSI;b#UL&p`uXIMUYmu3Iu;=Sf-$FTh1gmaL-%|G8V%zM= zVUxD}^_2F$wQ$K+$@Mi+d;a|0wBBc(v7W3)^UC$6nZ2H`CogY~`(E>6x%al;u{AH) zb6*(bW|$pcHQ7v|RL1Alz0d=D!mPG)TAClU7wlTZ<;ZZ0lkvtqjta(2+)Ux>_Tns6 z4R4n;?2KH%VG!OG&UfJ2iArIn+iWitp7CA?EDJnvU*~wA=U?ATnqQ7>sSmhyLE~-w zl;RJzecUfzKYh-bSuS(t^wT+EH{~W|2a8NqEz_CrOub1 ztJqUL$t>By>Qzv4duUSKjHPi3ky-0*YBq$==%10y&hp1B#aQg(yCTMtsW-3dYztm6 zM{~=g!!pkwEC&9DI``+G>0J}8A4l?^{<%2r_|`2(ZA0>)GzL{kfFKS$U>2 z+*a}43i}5)v>di2WDCt;T2LG0Kbv!{O!>-)iuE$@C)ai_+Z>^PW^3$<*9}*!_5B6T zezN`b^i~CvqsIzm<}==`&nD}ME}vica${ZBqIv)8=ZNyxn&-R!TM_c$x?aJWE{)*F zmo`Vu;XJs7YtL%i_4`jQUCw;%lxftS0N<(J=NEZahKy(I8_QMaGpf=?n}L?3B>|6CRz@-(QE$y=}LOz$b@w^QUQ z+V-1tX=P2FseWVbrz2|;!&W)CbOeWdP6;8Qub}d?=D|D%3VqA|z#oC+ev(0`Q+f}pPvFet7oK+j-&Y7?78W@tt za$s9`_*?Jk`y7tlno{wYy+@oc<9o$(g(*#(Rmyv|ins>OUT)O5Uf#%2jO&o{?=$;q znMz^<*1I>%`*7}P%E5(A`?SsPS3KD{JFnsmOK+IRx2yU#|GbUXu2?!D@53S0%W2Za zOOC5-xwOy8J>bW#my;)ZpSSrsyTMIc`pi z&&Ih2_|LeU(PFu^^kWf^kJ95O8yt3?ZSgAU6_weXt>9acIHhd+-D&$&&t$e(hB_Ql zSi0}7=l!Ow3im2@Hq@vo9qTjtz5VN4MXVQ+K=9g8FrZ| z_4OH?+OfU9U3;0QeT!wU!SYW&%|gHBrp>TWV^qEK`StQMyT4qwU6sc2#n-j^I@s{1 zodyeTs>W^GXSw>&(l}<$%wt~dmh0ory)3(}dv}7ta=~XIjH{v@Y~Q^7uFmoGKt#yRvgZ%(B=d=J9poN(nZ2`3GThu_lAEn zt$O~#d-}^pVNe6|lyJUG^9<%smF+EFemg>@bv)D>BFr~kwP z)lI=)T!kbyT;a59C|%CE+{gRJQO+a$J70(g1b~CZjPpr1(>p#!E46=DJULV+?AY;j zSE*RKc)mQ?n6>hESe6`*`L+7ysgwtwX0!ygsi^I{e&j4a#|Q07Y0l4UZp&`JBfZSe z^zTPi$b^YLe&HsNF{Mu@|C%)xp znXt`^6|Jio?!|FVeG#;oWAO{2Er*R}NKRF^J9gV^#`7cltSZV2uD08Yy?MV!PvZA8 zdzRq-KPnRcP96N9-e>>mflt9HP1S=xOY=M1PCd`(O#FX+{tN4!@7LXa$M3Aa?N0Ok zDw`eOX5D*mxW26P!q)$j50<~H*4ebL{n+xuy8`&0Zp`hsH~o5gLv4omy5=JD|I=@C z6l;mUDtY<3W%W1j3K!d=lsRX-RxI&(bdO_hNww@@!|iwPe{-IZzmKs?e9zCdiX9Il z!$bC1w3r=IzQLZ5b+h~4uWtqO`NM4640;aPYo+~r>0hU~=J$8M`oM}eSAzYyUo&^) z#x|IrT4*=ruzybS{TOdd z%QJW4!9c%Xif1-wubmz**(8uCBEQS-%)_5a@_Wjok0=T*W?GL~622w&eVVFoY5b!+^lE0Rpq^u7 zi}j;~zJiYK6CI8-SQVvM%}*`%y>>W!L9#ttsP37++XS9PhC1yzyH_YHL+?^Wd!cvx-%In) zz0>aKpR)T$>5oLQ28rkU9z9*pV;sNl(^Bi{t*$y7YMo;_c1FzD|NT;J%gO_-NI*R`$HtMTiWiaWawEj+fnR9Cc~_3&Pyw5NmP8b&l5uc85DK+`F-Sq4=B6hfV)oZfe~rpRa!Ax(NF< zpB{x{|K@Lx%~`J`U2uAHpux)YK!

hPLDDysw*`_{O+?UDnR)Z&&YlmzRHGiqe_z z=Q9uA{?`9D_r32#gK&OHhifye_oN;<8{V|DKDUHn{k_Pk*Cda$)+ThU|2@w#ao)Q%_(&z@EDM)b4t3rbin5dm^nGre1l~nyGQ9Ce`_ySIC{8 zci-3e>zon&GDDJUg?ZecbtiV|o?*BBri#uea``soF0Uvb10N%vgV` zBp{gg=QD|jo@UE8oA|f19cO&Aqw23g_p|=Phuz#88UwC0e(03taJ7m1e6i53E{ki? z{B*w=&sAnGHB1sH@z`_TbMyNB4s2htY&^7&>`uA!V1oBj?r#ze(@)mU_+-^&XPJKJ zY1!P5f-h4}d1f4{x!PuvpRz%rUpgVQ|L**QnTcIBCHArx&v$&>TgJ0M$&QcX@S~!` zh8tEr{UCgO^YM=?jjxYy?Ke2@^@4H1@44RRQ#1|bvK1C~I8_uL+HhpE@H5SnKqqh0 zd*AJ}?sKo2Y;^odUC)WK&}p~Zt9Kk<8t3|yV5o^XD>O|ZeO$l1wyU%$z(zH7O|-+E8&@staq{+7*`6y*f?_g-rW z=kvDcHueD3zVnJpXEa_6oWB3(i&sChrg===Vm*Csz;d1)uVy_LRhwh1e*Bn^&AymZ z+a&t;b{nXl$!z(Vw({gsHF?>uMy{V+O_}nopUN%lTPV|7b}Pka;oYTb>Ae;HT(yGC zXBr=CKLJ(K`&ykc9Mm7o5$LzQZ}Q@jI?K~Tk8`IOoLX}r^6I0b2TBhV&p)u=@7%)$ z>Yz&XbJB*5_m5oU-~Goce$52+_8fh=Fs1v|$CereHg%j!y2NwjmSc*n$GhT~?{h${ zj!LnznZ+-=1Dl`{9b5>Xww5vW%C-ZggbdwOAhP(>UEMRh%IT|*vFgbw^;C5HkbF7 z6ABAte;jsru+OGXI{bw2(IrQASI7REr9X4e2UkvW&@kY(+=RTV3Ig_mjAaa)t@>|S zDah^oy60=`g0{K=C3-A~`EU6q`4m+9y%9e$Zb>mGLe zC|zlzxuS2@42xUVO0xd_m9rLz`^~tV;mTWVKj)&>2AgM(;#0RP%riP94W*Pc{=(Tg#4K7&|5?8~`J181sg^Pag?ddB;SRGI5hJI&@bbE-D)_xbkT^tsW~ z35ztcc;#x=GHiEUbGYK!*X%X!s2& z)=P~KxGb0}DEEi6(&|Ea$Ftv2??hY!UDbJFk{F7k6nG2xD+7+RtVsO$_)S)<@RsQmI=X9wRhozrCP;(6oVdQ9@J>zBNjoar_Gc~&w zaryM>+1{P7NTW+DKyh^{dp9fPrn)-H?Uk-En9l)^M-_g|5mrd^xxj*QJh|G)L-xaZJytn&)=N_ zLna=wk$xp6@YMRuN0x#fgXJ1o)`x2Ld$(FXh)oupZ`dezt;J)GUi2m7n%| zS!=1LG-m5@YRs*fZg3`Q(+}|yn*K2w5_JjQSkJ&?R$(NL0YGT^{PUi5Q^D@$9FV`=5W&BX2 zdLHlQ2Uf>pe>p5>y2iQZjnF(_$pkyK3wJVYN^6ZIOdqhm5Pvf3?WM{$Wh+~MYbzbn z;oSL-Pyb2rotovE=Re!O+G?$rviU)fzFYy*7q!gpudBS5I=_r#e0Kb4@zTs{&xwEE z8b5Ja`q%OLY57vc=-R%-dve8R+RJ3lM8|xY9pN`)+l>z{O3Y_gv#e-r*nIxL9#1Pa z^@Ux`Y9))_d&f-STdBtM?5p0twT9MDtb40uFSW4$)0i>cTefq?`zt#B+?$#H{tP{^ zCvso5!uQ3=vIgt*5ACn+(poiRC;x*c~%T*Xg_KqpC5k#!1u>LcFrS&dRIY>}nQ32?K96ukg7=B9%Z|K`HCVVd*4aS2kEb$;`*&ZgJ7u7VovewmRQmPk34L$mVlg=IxG`d$fL}`vx9e z?$Tq~=(O{r$XoB!w}#Izu?zoAzACh9!}Dw1>2KPNyi)7uwg?DG-dgwdN_Fn#Z#p}l zZjRpiuWGx^>*VF$ynR;8rThOC@y|%TSLzk}tVif}ThMyB>iAPWw*THQx|3bLcW1hY zYv66ChFcBdK?^lNMTC@>=ZCNW_?!@{V$Wuik7fZPuA+KJ4EHUW{8OsZ8>G3Wu~N-^0zwj!>9tqa{g9{GDR)%MZK;!8K(zJ_nN z|K7cS&)c1kO`;TUmd5{nzWm4i+1oGe*fBTYnvTJD^(!x3b~E1F#`|jVcH8Y=W^e0z zF#rDUem8B2!}oRnSAPzQuyVT3$sk?6^61N^852%TiT-EDkY#J||9*NX>wfFKJ#N|( z%4a?ssl{n3$P28<_KCTF!ctGdf9+52%q>lZhiu-P zJPBGKw?#@IBE0KtXJTo9j{n+x#>*i`=kA#*-S9L2ep%p${aJC|i$!|`pH)i6HHzDb z2@1!TtQ57^erg;hf0S!c?W3#VJMQd%QTzMwpZI&#nIG)+Ym9rt4BTequiS7*?H*@? z>V%DVHm`ekQ@?rUzgKhLGQGORQ~Iv(b;Wd@rw9M+uYd9BLA+k>qKjO|I6mtJ&u6GU zvNW#U;&qU>%Hi8`-_9Lm(73k8KIhw3k9G$CJNwquD1WRv^k=@6y^u~#hCIZg&M!;# zuN_`D&7g}fZd<2#-1E8I8Mn)izMJ@&sqs(Mvai!;oKu}}Zt0R0iT_r=-re+b_4*}X z>wGWEO|P>2x#4;2>L_1{r7moy>cw}~1xd!(YQ@z}FENRA<^3FA^YGY%@V&7nQ3oUX z66a0W@gc60(>%YJ=S|7V>l(KjPgga5={XP_FD$_t#*^_)Lf@ufXSC=>U#o6b{bTFm zsupD={`(xw)|9@#M7cN2U>oC%>D3F4Ex5blK;k*q{jz6<4t1H{vD!~I3;go{QBFE7k$2D`egHNjl_Rv zn(y<}eOhasxut2NPD|vfqtfxbXUcP%>%SUR9%^7;x7kFyclqk(iB=wwTJzS+E9Z+8 z_;XoUvwV>L*!KNc3Cr%K?-mQ)<9xDw-;3INuKSD2z1A#wk?^mdzgD~ASz~nu$k=0N z1g(C&&1hAj`#bpY`!lI^7JMfhA7Q>sWK@;N|=CL5Zhm#;g_0OZI;@iu8K2nQxBRspLNnF4x%i zB{x^wsqc z+uP}!U3PTO>Hj7>^gdQGPd<4`WnNjQ_tKxCvoCNp?0-^ZzPQNg-Q7JEPtE=qJxx6) zGs*1giRYHbub*)}{AcCO^ycMte>U&gvU>e4tsM{U#2)-ESEsY>jB2lV>$KHoHGf~< z=b3fym%HTc1y3(r^S}RLW$N)``+pZi9CyvP)8FxR+U-x@>JCTg|4#6GpKhkZzw9$} z3p;C*w~&}di0YkBHNT3c|9vwzO4v+u`i~!zTDIn>c_}Ou{`%l~k9hrs!qlS`GyZ>A z{`nw({ioM^wrtyG&wZ}y>FMT=hy9OCyBYia*oC62ZT<1pf4g!U?iPMuxIyOB?Z4mc ze`I_(Rvah)=lACGT<>fu>hIml-s-KtQ)T&gW9ez?*_)?$uywR)ah1jjoE5nFqFb>n zMIyp3>)quA<_^_|c7N-5zA?K!*e_{4!{?XD-3R&So%OH2zwdPOWq)f^iRvdSZy2qw z`YMfW@s?R;>wK0xrAeEGY@{{OXheBSrI_1oX{XU1{Qr5{gD+*^1*d8yUE#Ao6M z-`@X|7a{ii$MO3`iOz5So)JI2xpkY>nFB9YoW5W4rLSW`KzB#bTd{(q{Nu>RY-@9(&)Kku*q^74jJ`n!tCjI#T0zuSt; z`Fblhv)SgxvAXDWtG|Cf_;UaEMO%u*&Gs2rJm{RiEH-}aH(&81+mb)5`+eBx|IhR5 zIk)rs*$B@0$ga=nXZv=`gZ*`XttURW`S@7vDTTdtK^_xS$# zn$0#brW;T4=*X4+{9g1ZNb-h_qU^Z|AE&Y3Jr=C1&GM`{ZpATv$Cp>?XYXD&dGf4S zt<6h==Si%1%l6s7{^M#zoy9y3n?6X&+6ys>{QmdNdwZ)aW1UvS``RDv>W%%o{y$;X zeQ2q{-to$gbyM!)xyk)&xSnwpHGIBSE!Shqe*K{3|AlLnZP?#lc>Oo@eEOw#&OhJJ z7nEw?(^$NhtN4KQ{EKW`g4h3DtNg!WQ{Q%zKZQHi|9zExIQ!x6WchQ)|04JNo-jciQ+_AT}{r@ttf7#pp|2D^4-DFIZo>v`WX(Rcd^J!{lxZty! zpBsLkz5gt6`u~^RH)Wh>l&)O)bE(>#Mft*6rXS)=3cndyhB<5H7tdhc!w@p%VD#1x zj4bExmHMUB-st}%w$DQRK=0>W*SU&$;}?8(xceev(IK5*A`R~wcCCGBdUf^n-wgqt zA-4bu(!4ewzE%Wl7q{8@YSx zBEHE!JD`^QY@=cE>)PLJ>m`quN(*c^EOv-+mU!K2`Rc-QrUMcN?!V>!U0ko^IOn9v zytUsI*Dd}y->GKC`e&T()+~o?Rwwo{7WY3-Jy2-9Mmb1L_DWC0{KiesnzEm_{@7Ey z(sk*bZZ%1Tr@ORTDs9dfc1VVP`}3>YdB?3DE$U$bGZlnN7j8?smS;2Z~Q*vZ&9~y3OtJppWC_g^^v)IS$Q^c{p6d>^f*rP z&s@UuM^abGAA^x_{wmFPDFv|vzFSltQ)Hy<`r0|eDfywrKDil(Cw%XH%&?V7^rmKm&Z}d> zjFb$4d)reG|9HN+s@F+1$z=`%C+c$QzFMko+KPFXK1)lV_Aq z*ED~8Y5K{~w_n)oC(hmUV#gxI#B~fTC)Dab0bdzL{8Ly8|u6-4n9gz}d z)mu6JA799w^0^N?r+EAPJ9z8K-@M1G^@6~YUYjmh-e}z<#Pot$@9)+eU8b@wgXI@F zKHE&)_t@m}FO6Cu|K;FiZs&tvIz9D(mrD1<=a5JsUz_?=aC#1Pz~omU2K> z%z;*Dp{=L`t(c3Nziwac!~ZpJ`kpgMt)1}Z*6w+~<^Q~2s?oKGbmXNuam%|I$#;uv zq_e~pYjiCtTJUQLtKo4b%Xz%KouD-%Etal zna7vr#9m5U`X=QPANLvQl-o0l`&HNaYbGYCnyLzr?4K8@I;i+}vqq zIx1@??~m(R)W!SESuib;Z^bv2wJMoQJ*7QwDOz4r+K?;CFulsaRn|KweP+!%BRT7B z(y6=Mt=OhS``og-8LyZ7!t}ZBsmiZRKObKb%UE6_RQ*GH*^0Hn?SGUn8AZE`CEk-w z6nl2{SoJ!Q^A(2<)ZDsqQ^#Ptlv(1mjZ3zkeqMR=zW(jYOfQ5U|J0sy+*j85(!v}2 zC2b^CdU$8>wb##Y{l48ZFof@rj<3+ahVRuOds4VRa~99r|8_}nfWUUHl+~&tmo)_L zD}J3mt4M0s%!#j~W_+*sD&OC5ilhFhh^yeUl>%%|in(lC-byC)T{t!;JbXXnMyKli zZ}g}BvOe0}UUqsP+s8|_@9R!1T^{nT|Am8AjMg!~K#|Zd2J0uD=e!xeuPMFnaYy=l z)5MvT)90Nv()>LurTWm)<0rnK+SXPkB($ruxpHgc{>h)0smQnlinz`={amo|WlM{7 z70WhNJ*zdBG&al=)UQ3$TsghE?!uNc71zAeq7!?H`MLkFpDnGK;k@?Jvdo{AC$6{$ zinvPhTW@Upv@~d63G?+kircPbhkdw?GBOB?efWp~NsONh|MM3l3yG}Ft^Lfvz`)?? L>gTe~DWM4fz-3q9 diff --git a/g3doc/Layers.svg b/g3doc/Layers.svg deleted file mode 100644 index 0a366f841..000000000 --- a/g3doc/Layers.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/g3doc/Machine-Virtualization.png b/g3doc/Machine-Virtualization.png deleted file mode 100644 index 1ba2ed6b2dcabff1bd1ec47fbbcdb30023a62fa6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 13205 zcmeAS@N?(olHy`uVBq!ia0y~yU~Fb!VD#r;V_;xd@3-hK1A}plr;B4q#jUq<`3q#j zYu}f%@n$%PYz=heXW?B3uyJ-xZsO$PP}(rb>WWF*D#rlEy!p4S)>paqU)*D8{QKSaXXQ2ZR<~B$ zPfNLPKmYuh{F3tTZ{FR!x_AG3%l-FnZuVqiAQl8%`*U}8yw$hG=JU##4xc(Hx9>-2 z`;V_oI?DESuURku|Guz2h(}xf_eWQK`;+U%84M2yFdt#SpbWrbR3cAo>5ngqta@5~ zf3{uKiwlz0&ttF0&$myHu&cQ2`}1kNq+Hy^&;RDL%iBDD?!v<$&^&2-{+){CS*z>r z*;PNCn*L_b^gT~?e-^i;TBhp$|MG5k_>-Fcn$NReMq62ZVk%g6u2X_Rfh{#zeE+|% zFE5|7RJVQ4s_zkB^=@anFAv|{%Jizsq2Wvam;L{%U1TR4{rq#%hD#8OHW{?KXUYHn zu_rlfg~z#1yZ`=8cjXDYwdn|hGsqot{yr5Ae#^p`B{JmS{_d`R zZ@bk`x2&~j-tRN%&rZLpxSL=9yJy;-PclNAisygdv*lS~|LN(~j>W}w`zOc;#BTAs zeT6wFKVw~SUgh=Om(p#%u3UcZ=e%?0zJ!0jJH2x5uJ(m>=j(o5{#^R8k`okJ8kLhL zPut9W?zO3Yb>zK^$2qTFSQQpIHSkloU%+W2PEQT#Qzt{*QlDCEjXNHhan7N%%C)-s z-oew7+4tv_@3-E+=5g!adle5`f0hb$KA02#?UDHNepNw^lUbb+0=r*t%R6hcyv1SB z!~X4GFL{6d?(%xCLWVu(G0U%CGv7Zu`!m^V!j`yF2T-7GGT8d*>5eA}hj;1c-k%p= zewN*Cf+kzhrhQkd|L1Ohdi``{wYp~dukGJ)TP^1M2mqKqhi`P9QxC$t7kjCx(j z6!BWcrdyP`b;6eTjd4@n_3rokI_Xi7Rofxg4n~HgfKO`dt3SAT$W?Q1EPBeBF4 zal{Vy`Jz#pW-X>$c0Ctn{;DGODCFwv9bacr z{KbD@qr~_e&KV#1_H;+mWi!?GWOpg`?(WXU`WbIZjymj}{BzE#DweFyZ2QjR*7v?F ztLeyo@oe_z-%4yCy$0=j-%VYA=J?mY8dCX*DSkKPWLCP#rndU;`P|*AGDB$1Ej9PO z0)_!AJPZF))@{RC@SCSg_3eRO_R$j~O**9nHoFWM) zDgK=ymc4tgTRw?6d?Bd*+|MHpmAsrCRqRqvmDShnPn-Cce8vH~9g zW=;o*!}{&(=Q-J|@870bwmxik(uYo47BTyhWnnwYXK{VaxXFKY%83XOcbj=b#42M(6pUtEWPs?&fVH~$N%5Ca=&GZ85&lJHSb&#@q-0aUNA$8 zjUw~jYk^Lsil6_jo+Gr|BI*dJd?ltVJ(vKB_lDwwAiEi!Hz~3)bTFP{MKT*|1%!I= zKJNFT`o9-npSSHxe465Z?@N6Dr`N0mtBMBJpxK*wEnlCyd2Ehp$U)QX&(~bETVFPx zkzv)OYjb2z-;6l-?fIL6bIW{Wra8Hv+cy0}DgW#rot)n#85U?wWO&nkE%)@z&N)|g z9`2~MeC^J|z;LR0VUJi%?YXMru<15pX0JN8l|Nr|`AE`i%WI0i*OX=#m8qmZw!EGB z`^wGqskRxv+0CBk#GWg={cUep``c|gftq5+R&LzIH?wqi?rNVGPJg%QIPiqcbjbSM zpv%kSFg zwT+u5KU;JCR-wqQTUn>ueKj`Sn7lb~b$YvO`R1#Mr}}OtUAN3VuC2ya8rH9OJAJq8 z`f2Mq9WpN^+b87Yy^ehFHzs%OM^0fj%cS|n66Wc%Zu~O*z2~+}-DF+!-RJFmw%n2_ z&b_kR;?0qS{kOLrp0o9TJ%9R@=yShQu2fCm9G_o$Q(~(98x{p`9;vs#%vD+iZoW$S z_|RzI{L{bxvNUXV*lhWD^1A5)hYUKmzN>y)+}+w7B+RjOiL}v?1*iL-%N{JuUde8F z*18zXES!kR?4Pdm{$EphIw1wrOv}aM-rS%?mWI`9FhF|e)gdSudN=f zTODye;RMUt`$yhqsPHj-xN)G@Gdo4lYpp`onT_r06J{Ho+H%w0UM})-#_t@jwD#Fn zlV*0lNYfU#e|ksi?d_b`e=Ki3Us1nUHhkg2UoR|Tx9z(&%~@{A4dE02;?^wI=9%Ex zY|65H?ZTrSyR`(n(z1WPe^kcc@acxaB+YKIEydQWn7;~%ytkhea(s>}!vx>G-BMR( zYc8=mw3d-!Ma>lB+u6N`J~U);%wOl7_FRaOVF6RCgJRNC)+zsA8wP%0_EF)JYH_^B zz_5Vn;)Oul4J%)!|2e?J%N_n`$IWTcJ_=jxY@RbSFo-&Bw*0FsxtEpqVc+rzo@d#1 zmNGCr?Tq>|>q_AHA3q*GxPA8E@wI>TqVFf3KBcJ9vgCOWhd3j{6b;j7E3A#SX>zVf z@0cQPk+HWi@ipU#jq=);Zpm+rV?O_gfnkbZ(LHzN=d#PHz6X1^EdT!ZPSPvZHNAby z+fBbdsjt0y@8U}K>-JV(58Rq85$5;pw(|5j2js&{SD#t=d%Dfa?GN^gbFs@BG=BKp z*PFt@>C?L}&Fb%2XU(>$lRX7~d=0aG=o+-p^#1Eb_2!2E<0Q9p`aJv`f(om+Y7kjHA}haZGp%EC%LI6&=8jp8Ri4)+|Y3i?rC^!aJ1 zd(Q6pbGIKmW7eSsJ3D5~5CR+Sylc{-4;Mdt+n-kaVYbn!)obpRoN!J8 z8{B#!-SffSXHWiKKG;6_P2$4lY1S{Eep6(VNMd+;U;0L#(}h=)_WxttZ2IiWcPqyX zUoQUHYag2_f#rQG%q#!&efYs>+}Soy%PuYTYo+vdez1-HQMxx@KmJqnPTeT!fA!>< z{4-3W{S%^%K36h9+}k2n{3~%*hUL$*+t%Ja+!e9K06<6L6${xquao8_f976^(s2_iCK1AUAN^=#q7V|)mjx7u}?m< zMJQ@Jzo7$<0gs_Z{H(JV-)}kc!BM!u&zmJ%<3)r~^|}ShDjkB&KC^$Ey!-Nlt@%>r z@Au}+o3Vpmy+e_0sc&vj#od%QSElmM@ZxfInrd(_?e~?a9~q}wI~UwKn(*sB|I+!t zZlq>jHl8QdHh1nO)AbqWyPY+!etmYnHs@YZc)sBjPU&Wo&{#9(**(v4^DjAO)sC#hy{dwz}+L>W{pWOLU zJb$Os-uLgMFXzA6ulV=G)9K5;`d1c31%KZ0r%3b4_eJLAOU|CJ`jy%3XvxW##2}gB zm1%3bM^UrqQ|2bIf9HBWRqKj8IqZ3>-uIBUh9GnP`yD^NR<U!t3Lr>_m? zb6Tij`B48(L8?_{PDPmH+F%Zk)PIk<&c2NOd;Q5_r++ur>Svt0zVyb=?#_cwtq*?u z*!%O|#s3xWZ-4$O``54jndz%L?fdJae=YpJ-@4v*)$(=G%ZgXNv+92}v6ScL#*O*Q z=I{K){Ih7+ad-J2TuBVllWyuy7JL}lcvX+ZA-z6VD$bKgGx%oocfc&hh*g~9#b7tE$++P`Q0 zS^MOVvr_a!o!synUdMMmyc{jA!p1Gyw4Og^{x#c|oy%Vd6loOw_-J~{adpm#wI?>d z-nBJ;#qv`t*WHr49{N2dwS;Ht^{wf5gO4oGlH69YkN>gE)|UK)Ue&&<)-N`c&iz&! zaWk)VL9d)Q=pBl=2V|&NbCr@*(p1!c_LCjX&DZ#I! zey^Hduq#pNseO~c7Mt%gT~B-Wl+;-kf8{$=^_6eSdjBYP_4W6hC2B=qE!&h|cer(V zmEA5m%PLvxmYY{rU-&1~7~pqXCFIuq=jj5?tCr}_v<;syr>_4gJDU#Up1X&P$6QuDZoYk7tG@3!mvil#}Ncp~w4 z*U_#<7x((x=W65rtv_TK`Bc^7*18M+dwi7^J=wM2P4(Ji8Lu7lH|}6lm%p}u`Rhf& zdpj+5u9dr-9shY#mI$-uRotC)pL(Bn>PdENJ6@B^rHmgFj}{JzojIevx23f476S-Hm#3CTQ}pZ{*oMecwXF6TBx@YHTh z5^ypR+Hqmg`L2hr=RBO1#O)+Br~c0GkEOwXyRWKtH1?@KJZ%*&FpEpLx$VTs>?^13 z#QA2P`n50e^!BI~=8PN<7Z}8toDsc}db;*vo$R)I_SzfNg@hb*x&6zX%TKdfX>6_>^Yb;zcxU^Gf91}xJ#zwQpGgn9Oq;$2uKE2@Kq|cph1^>9TQ!O>O&Ji{b30*uvgfH;5UG|EV zr!rakr|IAPv24%h{?nS0uRlwHtg1R>n(dLHBjjaq{P?BPRduIT*{tSGdu%Y{mD~Mm&pZzmx1Kw^Aze5wmHN0i^?#33#e=iz`Ko+E5?`%0%?phhxpc=Zm;~KjLJN)mMJR$)S0hu1)*} z$+wr2UaL=<KS8wM!@R9wX2a9%dby* zRvH*ou~(OU;RmNn*$WpjyRxM1d|_Oeb)U{@@@VYiV5~!3G_B= z3BU5{Y?V<&(xOdP>)Iy&+W6<+Lo>@1S^uX`3?8%JOR<{%%IrEzRpOujF?-otSA`tw zUlvr^n{(->s!gPF{}#R1Qd{*_*R1fa(Y4Coao;NZn&H;@;)l6pqojn+?DtOVQ~H$u z#7lSGy#O}*k9Mo`+js9P6z<$H{jt13_NMcbr-{gI*>hl(sKA=uwBB`n!fG}FZ<87l z(|<19Y?dv%Jzd4Qe|B?d%-*d$pP0DvWefMt{2KOOSMqwzr7DKbqi?Hq+cy-muG?y@ zx##wS9kqNXANP8G3z2A$NQgLT)3`?LO=59aUDLK8Rf{ltuXK%*bvysetkO%E%X!}F z`sZ7zubuSMjbG_x9^&;op+AJ33ssVF->YnTxu5>+wZOO-rwtcWy{{M^I_A4EheVe zCv2Nj*?4k^fywr(t&5lC+zv1*=Hk9@oVnp1_vAZ@Y!YE&o2RYw=lU$wtG?8-)^)Mv zt>%fF@9k$Q{8`04ckYImqinnN6(`<(cjWTrl-K4D<_a?NXkXV{6Mg39QdODPeEN&y zPX=1$s#&=&iaC{KUA|rSy%*Qv^3wN*ss-IVq?Fkt!rr|%UQz0&XL>x$>#+aR6!*z9 zgS~Xbcdt>ukZ^r&T1@qRPS?FxQ$T?0YuY6pwe1op$ z{Ot{`p6`yGsi}$I+pw}H&SA!R&g1={)}VlDfvA?%tTQ$7O;M+2ds*bk#kE%6cy&KH zsqD(Dm^I=7$xIe4+g*7KcnnXZt?fK;k|*(n-o_bK@kZ5pi_e}sGc$I(*hy9mpJOFg zIvCp&**;%L(S5rx<=gI=hn*>oqL@$wdd*G7+i)rDP7oGu(t%kHz|kMt!c z{RD~gT_8tnFp*kwR5#svqDcMgTb$fC-^*ghHux^wX;3A{JGSxd2=W)v|996eQ|ANy&=N^$v2J}9?RV{N>y8z@AkRs-TzXp+zl_aEVpM|&=uGnC!DzUY{t^%Cl9sl`>M#s!0@zx z&YOKa?DZGye$R89{8i%HOy*EY-yNo@uP67!wLI(Oe<<&J);i<&i9XfV59e!=7Ci1( zYZdP=akHJ1ye*FZ^NUo4hcEs19!c5Vd9P#lK27cY$2$+coAY(o<5yPScRiKO``x$1 z;P8_vvFVTA9rUw)H}Az9t@S@M!#-bSwrGA**ZbD;^{RsG_@wR_zg2ogX>$Yh7v8L$ zb~(rRx!iZ2N0qmJPd+qx+TUk$vgb6*#4nII@p0Xzr@7Bg2(La~5>%m|6RaY3_*u>E zvsPynw@27+vo;Jk@p{AC@YgPf{4;JXYwuydY<^0pP>`v9b z%jr+7`6m2-_~oh2+Jfj;$!{M&ThJ8zt+GYOaK(IOACu`4CaSICh95d#9$XqAa|CvH9?)cnNcXu{OitYtn8 zZeogTe_f9(IQGgqaqZj0?5)*?FN%I=RTh{0;e39={fuY(gn<2j?>=*K`}*x?OC-ni zO2Zc&ef4+#Roy;R{;Q|EuY-`6V-2G+zEJBk1_m!C-__PBetMBh zBxDLs2cP@7ZRTR$B!jn3%3HVH4?3FQ9^}Ep-e~zU>i1y5!xKfjx__OGY< zl;E_j@8W(Q`82Ka$b$1u;k?`S9DC&XwnBLBQ zelN&{Cu_}_CEV$ypQkc6csc8)%@6tJd3VNynzfP7tW0)K`|h;Df0|iq!P>c-^Cmve z@vB(L3C~$`1V!53dQG#J;bve+Rbr9~Tpm~~bz(Qd z^V$i}NRQkhffoW&mx^_yKJA?z&CC!W`-1Vj$;`hBkKJA?u6ZOjH}#v$uP2Ai|2)cJZ%dwl-MMbrLU6@U4Gt6x1llLwT_y7MaH{YlJ_bP6KH92qk zs_m*K#pio2dKuI=>#_gjLni8`VnU~?IIlEJy?f%V_30#ozl)wP-~W5Bda`JGsc3fj zU*Grde|()LvQ>;rYLiR@i$igYuO;J)%@YFJZ~Ob7$lf*e@HOXz6)$g!G~ZumXaBeU ze4Sd`)Lveh9~wykQ7=?|W?g?3@#Mnp*oqZunm&U24{ysnw}x4-XUnwcO0lC4?C)Qg z`0tx)u0)ubS;2X;BMY{y*lutk!tI|!;^M&T%^aJb^r;#z@3~&g9((81W(~H<()VZm zd)9wFA>!tZx$O3B5_4=to?Xn@KP#|2JZQ!j!+Cjkr(gf&`&s7l{#l~u+9c*wyjOi$ zAM+=TM_YRL=iA|mZ0YTG*#}>c%qi3mZm%{umC;>% zW38CotZj0~c3ocKU$OMfmbsrZ4qZOuE!GXyp@s1ZR{M;N z|32uwPg0y`U{Z3Rit(#`t zOmv?;d6KeCZS#G>SWlC*EoV$kO14`54AkCithvX~;Mt0&fdysLw^}2s=Zhv=Z!={b5`D4qABxN4FU}}9JF8U#Oy6{`m z^z}RbJE|9)-KMwIXkn;r((CL+V*d-H?`M~tsbXDzTk5@zP+N5Jakxa)o!Mu z%B!t19$e?`4>TQ3_%iRy#NYe-5>u16>&=&7d2YC&LGIAUC4ba{S8uQCkJxu4zPP&0 zVA;ttFPD6uzym!{z&+EHCi7wneL9O+<5Yy_M+Vfo3*IONZFtPoeuYBbLIUa54 z=rlu)HN_7nB|Ls+;(lir^EEGB_H7ZbD;4+7s(95gp-u`b_QzIyek#zsf4~0UoBi*OZrHRj+HHO8O3gKoSvJeNUU}-|H97T?_lvCt z;k6=7Hxu}_+&{&#T-uH2XUd1L-SVd;%K~S-Y*DRop7DIcQf+TNsk-(RP``OfuswdSf5fBWnln*09e$}fzSgfgob9)^{=va~ zvAgllgC(b~|Mow4gMRNjjaKuyTW3t>UHhg;?)E&>`4@^7-E(cX{2G;>IAisBSs(S* z=hBC`ix1h}>lawFMB>k{g$9-Qk{nwpdfBpXL z|G&Iv9=~cQzUPhVPorDvIoY|nCueWlyX*1Pna|(+y}^Dt-F~%Z?Z40SC+na7|H|;T zb(QbRz08%1xutujX53hzKJ)Jxhwx1{!h2X9BSqKVPgyu`t=O-~{Jy%?+QxIv)SOdT zeVifPh3DVjj4oMU{hNQz)tr8Mj(PjJTi^c5-=BW}+qrey=SP*ledqu5dhMTE+LzUB z9&)~%A9Kkvdw*>Fotbv)o)x}qFY=2`-RghiTTi;3ZNB`E7r#HT*wEoZbbLE0;bhaLAN${R>VV+5LiEY;ek9S*) zq=oKPwMop;{r#)_`}v|D2b&K6yS4rOELFB&zpr)QpY!jZ{GYmC{8>A9{f+y5%-%2l z=c}v6r;a6kc+39&Wd7}MEAO58)#bHGeuf;j4WHxxU6MS$|IMd&TRy(@pB*ZuooV}!t;R!L>Ybe#G=t<1f$OX@Z6hg;r97MQ#dwzi*FeyiwR;@qfbiZUTSJaTs50)8D) zw=HyA;qh9Pt^GLvS#7q+g-Vg?+3Y;4l{9Tqwpwfcmo$An=@3it%^$#wxa>r)?#1vSv{)(hsq$Ke|nRyGkj?%+|#1iKkw_t%yIe;7RWN z2h;s6^Lp7XrLUds&r`F)qmrri+OF2F#wu3DkR>sVMQk08M>`xBn9j7EdvwcJk*L!z zq_)lcyuLf?chRTA>&&M_b!dFyJLcI&!OT^Mxig2ex4Oz~i~1M6RWis_l&8eMy`rV-JctMp(#HCVyqu;64AG^!jbPaFkKmC2?n$Dw| z+s2Q62sQ5YE6GxNC}sSa^F!Wi$q#vqM;HzZG>a~{8THg!*Ts0+#p;f=`4gW{*!=xG z;}7-D+iSP(zrW^g6`z!0$)O`J7H~42Oa$vN_UN^I!uQ(ML&t3QJjdfo{o8M{s6Eke z+L3kXsUhENh8Fc6>9ye(^Xq4(iWnX+II@80Na`8Yw%2RSH=O+>qWJB8;-d>^be%zC z6DxeK&0Kt6qO&D^^;f>Eow4Ath^eO;y`$P6E}P|_dEijMZyo&&^KL_?&Tejrs8di` zaQOFR=S4Hp*#ww*oOxEY7+j1I-p&NJscPl+JqP&mSd$tOI~+@$EjU1;L@m--;I;E3 zd-&WNpAY*dL`2^7T^w$IXuUYRw}FN6Y^hr18`pb}ExjinkGs2FJ-yW1CNKA#mDi75 z>_yiy=eyrYXJ}ZZ!f|ld9Mk7HzUSPE%L*j>ZpRuQ)3<0`t&fbhTcTKIowI^xU+UE}>P17}(S1P6d zE;5_3*|T`x>oW(no|ru7GtNBiTy{q7wph#KjC0?f=UAm%uZ@ec%Um?!XqEN51+tHK zbcXiMeZE4r{>nDfbINS&YjgHrEo@lN!4Se+`s~A#g5_rh15d zF7th{SpN2~OK%y^{Y&@W%H;01d@H3MAiR!m_oPROtCQ7CI<2qqt$zP-1-sF+Id#({ zJmv(I-*a1?EE_M}aB0c$x&t@vT-)4H9hJXu%H3;Ca>acm^DUnok;yIiG~37JiGlg< zX>~em(rdrodzv$SuDZns+l%{t-zl1I`CdgiX6m_zYqEVrO8&hq+qd(`f@AA`uZVpv zwQs)a=f5ls#tLh;Ufji2d`~*Ja&2pK)*97&4^OQ#bhpbpbYZe0TWr~$eLUPr7s6dU zo(VOFsx#v{R{;GCNw`8-3A&24` z!PU;~mf!M`0doEZf7IgTQ+{;mA+GGeq+}GDdFilHL`A#oQ!r} zdsTeJ@}I9CL)By_zl7z#*T|h_6xRM5d-^&v!-50PETf(?Fa$hY(YpRZ{~^`aJ7gIc zu67=><9aEehdj~+&LcC9KHYBntKhtDzufT+MVt8Ve|%96UZom-=iiGj6XX4tg1Xid zt^a@btlP@~n#5ON!=%9LquQuKhU&1z|GTyQvj4xQ;+N$6{$^h^n*a0A+e+)(rF-AI z+n>MwbzQUlnLGb3*!wOEumAR}X6Ekq|9?-~`+WX=^9Z5u!iEeEJbpK$|EC1cTAfyP ze&KvE-Opc^r9aJG`pV$X58zH8r~vw6<8)$8j29n>~%eXuoum&X3s`mHgm zzSmsU){D9L8?usBlP&AyYQE*#Y;hcBx%YxDIW>S5xON=m>TuLyc`DHF4q9i~CD_b< z+<(dY|1Z=p7oV@rth>$q|HYn?)9v>2;@_XvEL$%S@cDDx1pV)yOxK^Z{=Z@G`(5Xk z>+gIZ`qOI9rpKi(=a+rgiQo~_VmW2Fruy~Km&UW_&))v^|6AFY{}!^RPYJXw$$J`5 zqN}TKWBzw_^uAf~*K9BSz4)y_*6QAa5B)~P2CF8YdJ(hh+mCxnYz!Tat{sh&&K_($ zt$E7w_4;XB?Nk;|<+gavKY!Z&@8|E;yY8DKv+$Is$229jIF5h6Q>TmHb?5tAXlhz{ zd`;1+c02ozp8j6>zkijd-)aA4Z=s%F^kdcbZ@hcO)=pkow<}CGIQ9MillJEYMAlB9 z@WRIG{^ftCjW4PHzZaa=!Jov?ATec)#EDGSS`x-jq6#UC*( zM|@td|NBRGxto>kKhCW$yW^`4_S~Cz%{yX?94MZ>;&`6Ke6>7%rR&={?{lG#CYIV* z-UtXgtX`Van)*!Y)y@dRfZ8wNYfEaUZJv6$_w@T+KiBzOoD};{JpB3gyB~YspWne> z_(S80uEpOSdh+{TUHJyg8z%TT z6@FBmeR(z;pN=Qbra1+7ioV-QJY@*s&wnME5q%=Q<@bhwgZ86vA}@i}~b?cvPsgVuU)=WUET{;9Gfq3BA~`r_Bc z(^}bYOw(esa_2A>wHCJpt$|#0#6eMMYs2PKTH*^@R`$>Q{g&%+%e^MIdpgI9*%SlU z%6VI)dAtzgzN?Y{Ao;hqX!8W;56}6Rscg1~_@qTbgf`}KFeiaJ*xNAv$v1_wo-#ELah|Fe2e zM`rEW>&BNE$$8h{UtC|9U%*~g%WTz&SG~e5E#F><3M(?(s8V)Y3-lqF=ZwEdkD%OeiYxs>M|+W95YIrpzA zr~q<2I`h$2A)&u>SI==$`8@UVwjZ3&o*G#u&yC*}^!$WX_{#H>TR@puqK%g1996rD z*PX)C@3$pBO$~oz{gGpT9Jsv2OGL0`6<>=v;xMbpG?PP_H( z=>q-qzjyK&7>+O)GB9Wq8?HDRS$>WU)J}M7xq5T%Tg%%MHpkt*mvehtwEqt;au5l=j+cG&RKi<=D9h(kw4k2^CrJG{PDTuW?kpp z{Qa`YljknJzU^hiWHpxEJ}PcSWd}~>pS;;QXYHeSo`8KTSS=dQX4{_DV2eEd-7jkG zPqFRypUvU5X19A8^)_pwe{{BO!G+G_9dCv0`e$jVtYZ(5{%UuGubk(v?VD|D&7Z#) zzGwZmqQ?I8_urfhs$y!Zw#%3Aw|u|SgU9VoUF_sW`ok(#BO zVv^8TZza_H@5PVFVapSeEv28w^Du0%NeW0#T&T!>eM|Zmp0>Mn($58(#j=lT-!aK> zGR{5izQ$*<<@Y+_?rTdXl%Ei4&J8mJQp@yG9GT}xa0 uulL=JY@>5Kuf4kQ_!S@Cga(sTJ@%h{PLid~tFnvhL1Lb+elF{r5}E)thzz3u diff --git a/g3doc/Machine-Virtualization.svg b/g3doc/Machine-Virtualization.svg deleted file mode 100644 index 5352da07b..000000000 --- a/g3doc/Machine-Virtualization.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/g3doc/Rule-Based-Execution.png b/g3doc/Rule-Based-Execution.png deleted file mode 100644 index b42654a90e5409348f52b7f677b4dc7c3e745e43..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6780 zcmeAS@N?(olHy`uVBq!ia0y~yU`%9SU|7S!#=yX^>Ypqp1A~;ar;B4q#jUq<`3q#P zmbSm=ky^#sv_~^5pi@ICpo5KPF%#qA8GRkXF##R2E{45MF3D1*1uH#l7Kkt>En-`` z!li+^tz(ghcu%&(QjUNFBD~icj+?qkFf)lLcX`NWse8RnGm+eWci;V@zS4VF*Zs5E ztG<6~-TgC?FW=s~yZ3iaZS}pK<=-vcITTw2oY0786B_mBem!@t`}~dL2`ZX#KmVkg zeO^EP40l{~;k$$X>z+<+IOq|yr|4mN+t2IX8i{PpLTW8SX#s~?0uJ%8srqoJo>|bs zxv)i&$7_aw*9=EaVJA*wi75t(Qw$&~4Kxy+G!h{y6Cm2aDi1Db;Z!{X6=75Lff+qd zsCMMvu>KdCVKky$N#E+f9tva;_x(f z`6VC+@W-3PmWEDvR~Jz8Wa7d7w*UXkk@b@X+#ki_@;Zzh3jtZh0TES?!F^=h8D8Cm;Xl zzgwve@@`E96H^n<|A*ghHyis|s#?5k5$2oS@>%xhxhi+7xr3YWFuQRP!xLVs{{Vpq!TPxM)%lvt8OxpO>nj2z^oY#Io<*mng+wo2K z`iO~vuR10fc(Gcv*}mJKcdI1Bo+IVWUVa;an{3A~K7RQ1_1(J)uuOEaDOQMf{T;FAzMypCFFAo{$;T_T-&0eL z3Gk)){1EEXl6RCTqaC|!-u*rByZx!>sW#0-Cro@UD8Ba3N6y>{rpeXO zyJmPDx>bJV_}{;ZhmTpEZ3{iL?@!^xgP+#&+xvh#aGc$REmGliGl!{3bIY7uHSU)V zw*r563C+Bgy!h4m%M%Trbbh@&Q@3%A@FmxoET+jR=WmoP6LO3HVCD7dmi$`z)h&O^ zs{Ym8odwEMeLBi79!%z)I^%4bqAW-CE}^!R#VS2P?s}>{XGD^&8!`Q2R9qdfd167x z{jK&%OcnoDwVAJP?F~Ur#Acb!XBB; z+6LXu>GBzFT#}1L8toG2Tgcr~zWkm2rb7Oi0*C#Nm#r|3D|Fq#vstgeMn*hn+f6%g zYF^#`)uHU4vB;kW9mCm-l7>d!Q~B~nKub@za36{ ze8TK+o#PP=^A~jrMbYZV6r?t##`fDKHt?O^SRZ}vz`l@kS|M9D8XFX>(ERl{^_{ugw@)b$3~7@P9Jq{RCv3B(b(FV>Gj{`OU{0~ zmbL%dncLGi7q;;4Zdo3j?|12Vp`CS;klGXjXd(HSnK}M)3ua zGrZ&^vn*ZMB00rCvGv$$@wwaTpC3(slWZ_aB$G4$alAg3Vjry*IN`KRNmh6An*2#- z#!HXh)|;C8f139h(WR_^-d|DKA3pm&ry}QaHQ9qIuYX_OXwm(bZ}!_=mo837{l81) zS<}79FU5NQ=6+GMmTx<2}(nkMp z7eyy>ZeO14bL)lsi(e%@C+ghx6ftj;oRZ7-Z#Y47R{Uew3cD*vipTX?+o7iZ;aV;O>e{h z-&eO>|1+_`+p4L>-Fu#D&QT+wiLz!siVwdkt>+Tnt28IoZAtJ{WiM6c+*0BH9KlLv zQ?s`V{%+`4ckG1Ts{bc)%&Y$1Nn&aL9Q`Uc+Pe1=+ppV?b)%JPS5D~eo)E|Ce;o*Azo z-jcRCZ!yQJkd`%)#Zx^heT;7VoqY56pZ_&~+x@39_laL#TR2}=T*Wr;zllnWlK8gT zqQFL zmf&n-p=)n1mU(On-v58L@~_CeO=oBB5ua9ebNf=q7CW8i(MjhLwK%8GeDgEs%F zdoqI4Z+(&E%s2iUqglK0@0QzX+7DIl{mky&;Z(QIr1tg1)XAPZZdcb|J5?#*B&3#T z|EoyjVc2xb>P4b1JpXEqkj(N)|1 zc0%1c^S|5v=A8b+GJk5z+$p{r?lb3k#UyIFN)OjbJTVB!jTf6+` z-J2d9ik8by^`2LJ_C?i+V`j3!gKOz_&xB#kwV4SrDW>-JYZ+kunAK<%err^zsGPzV=2e~wgp9+ z-dl8El)tg=|M%&^f0;7y%F<=+`ZY1aHRv<%ogX1vOg{u>b<&Ou3kGf1RN}@K5eaf+1GPsQoyaPJ3h9@Dq81F%Gr@}(Cf#3yZtI4 zqx0>*3#rCLEV$D!lW(^2tHT0o?XGa~UwtJY`F-cd<6Exn==A4|i4gi18k-9;nl1i@ zAE&%r*OEI8$2UIOxZbJjEAC&PRdi@Uhq>x{YvpayLWS1KZ+i3oL}$3gemlQp-8`ocCntQkC%ukWqG!pG z+4}DnwLG7vHZgT(c$L3`JsEM{nrt%AAf(p z=KxvsuCe@+W@68UaIbG|_ODFy>g+#ed%8T^<#F!sf|(yLJU+I+=}i58zEi(hrui*q zvynFQV0&X<&UEv~J(qJE8d|>R{0anxOWggv>d~CjtBP``+h?6f^|z{fylDUb4W)A4 z6^p0ud^P=k*4yiqOWRg;)b>bm?$$ZYeK~dGm&5Zr0~MK@*LF_%u-m>?2NYiG`S;CV z+tQut@G_w%=W&u9|9|Ho3QRlm+ROTlcvJcy`;+5t-Gk@ zURF$Yi?v8#-Gyz{LoPHhv%!w`=)hoXnSHa%Qd8VQl#GGr&aU3 z=BlSvGu~DZ-*`6f8-LpS>D(>$vmY(k{$A?kV!y^{?c6_~Jm!YGdA7COuUe@O3V_{h z|7@o-7pDe^&(%^sw&47!7S0_(N3K3Knx7CR7q~rl^0u;{ViU^)$swnH@_2{M&vD|+zb^*LU9tARUG37`btc z)}m+pcWzGn#umIw!q+2gkDk+^r$KE8kN?U$saN_}%lzZ+``6ApJh{B^M6bPd(o&9y z>^-l2Y%TIOZ%RWZ+EqgrkBOFO?5 z&#pOgKlj%@|4sg9--S-Fc9}G{$Wg0wXZ;4h$(kQ^%$KsQ{rF1v!rpm*w3A<5`Rs5g z|1Bq%>AtViS0C<(zJL37&4yR2el7Uy&i`zyyua<=J5zF_uHBRQrkZs(dv|-&?7TgO zG5-%&*F|i2|9zRSe@pF=-%%@SWhDMxeYh`q-N7>&5=E`Ht!v|stonL6ZF;40>$(52 zDX+FxKixC!`9k{%uNtKH=kB~Qd*a2{Q>C_bl)O&;>t=qxp{0E9@6QVY9yfhH$E%$8 zcX9uBmQeM%5_gKSv+w=-(3>A49JB3_cJMZ5=`Tm)|Gj#^?s)k6dcNxq)#Jop{jNP< zJ2%n(<36!0dG>q%OBL^Ii+Oo$eyo9-{Kv^2M`f;rdN2JFknOUje}9a$p>py}P1B5T zc1pS3&z82tOaDs^SP>W+D(ZIU*Sh*DEf3jXp_uzM-f_PJHh!&vy91E2lpLS}LtO|drbHDx7jHhRdCSLlU zu{ZL*;(U!a&W*o5nJ6#bplb8sVB>;-$3H&Vb13K4K3|r8sQ%9WAJ=?^uYKM7t?t6d z2gwJ&zyDjfq4M;%8?`pqeg}QnyIY>;w%z{E>5{MK)%`sCV8{LcB?Z4`&gZVL&-@_1 z@wesgJ=}-(y?7mdPnvgM!O5 z*%#W`-~IP(;lJG4$A>?Bcb`{fSSBy^;=iqZosG@?72jEIFWz4f&;9eiYoqOf<8|9_ z<%L)Dhv|qtT>E9(R=1SJH_siC=oP4(&QZEjaG&fCZ_nIa+UJdpG#>7pX2A00>#=1I zIu=>EpuZ~VXiA3i^K`o{iK=jT~HY}&N#?Yjpr zlI><*~w|Nm-l`zC)5Hp!IJvfta7e!s~~mpLW0 z|I>2bgA?}$%h+t#s9w|C^XYVbkbGWuj^S;e8(cs7r~NC;sZLpBVW-EU75it6#m^}p z=7jcXC4P|?=a|E76gkyEPsW1pTl=^1anZDEDJw+)~bmH~ZfS7^<`hwZ3J(<##oF>IN=}NcAI<;an^C zzBv`JK+CoF-M+aGzrARmYM{sR&(1{q+i8BS@Y>$bM=F234cVn}G~keB^3v0Df@8Kb zggmNmcJpHU+w~-=MN<6Ni8FVD+B{}%I~`M$&pZFWP+NdP>xvx@x9vYW!Qj=xir%OH z_9D>N}nU9f2EMyHF?#C zD{`c7XGyY4n%-fB|{&S{j-EbiK_)6jooYtg#0tmtlz8)0*_019D>zrXJj&W0(LSj;?X1AYYmug_j~GRl%~;v;mX)FCvo~|$*EIVtdqNKd zHurz4d8E?QeLCd$rP_c)mdhPC?Q^i3w|+Leq`c9cvq9n4-cJoa`RcP;*V!EQ-yxf& zBKtQTPI7-Xza{YW(d;X}f46Cvx_EL&YHbQjnRUYFBHPlY9Mw1PrJGZ}Deq_V61>4S zsh7)|Imt}u+9x(WmcrwQe1yC#@|U>mWB2V`qP5Ce_k*-h(?^xFSkIJqr$flyu1>vaXvb9c2~VmiXbm|eDVrr|9G z>DX^iPxEhe?u{^ZX1SKR*COjczLn6n*QE_-{ZgBsD0+EFt-lzSI+vUCwX4VX-rOxd zNzV;~4;6bY{n;TmW0&EpRoQp$*i2S3J$WE$_LY+BJ3m@8y2m`LNvKZTxZQsJv`7J& z3h!MlihEBUVRv-&+h?L6n=i-wfzk#`ag=q5q3Cb<~IalYKiI?_q=zPyUdrSO(?d6}B1nm1-C-LgJ)V*Z+ zy(LxH%i_I5NNLcj5BvY;g-lyNF_OKzNMl=(xNU3ROrBj|J388ZWv@?@(&=8Z-->tb z3Ed^p{m(bINcONQBzD`qN!!a)cJyq<#rF+|KWpt;QrmsRhi#wLo=7fLrO4lV3&WOG zmB*|<+1I^PDkzU{J0+U3yc zrT?to9Gf3(Gid{(o7aqk3tG}`FE4W2l;%-2^<+zS+K%;R=KoAKE1CcM;W5?r+E;J3 zJx8x>zU_L*H*ev+w{D!q8i|t@AGG{!vN>p_<9fk`;xi9!Yp&T19`ikC+k5Z8tZoU0 zI~hiaPGF_ZTX-(!vpr}_F>_h0BVTwiexE0J2)XD$(8;#fzGXHV7vFLHcM}4;MA(0O z%AP$Zn}pH~G#(yiIK`W+CapHbpxKf0yrF0fH`opcA38L>5H?ti7=nJ%AuWHi{=<6t zyYdDSo?Wlye)Z@6d9B)lF$M^KrNE>0aZVmWDr**PxtOoA$3m9fM{Tx{JKlZ#W7Ir+Vp zWiP&cy5;nl^Gjb!Ov;H=-E-@7TJE;!B$XJwMYI`@nysZ7+jH{YE@hRN6rOxea+r@-(ZToUU7QbjvtJ+P8^;+Ew`8WESUM+YhuEj z7HO9iPu+Hf9XjFXez)Rm*~FBa&S~-%^UeidYutBI<&Nsif>Tp?-Bi2PTP8HIF1jtT zQKmWX@2BdWDf@oAtcz80JzMts?hl2z#*b_t9Ap36);lG1lUcOfhd6!X Ulk)zb3=9kmp00i_>zopr0Ak|w(*OVf diff --git a/g3doc/Rule-Based-Execution.svg b/g3doc/Rule-Based-Execution.svg deleted file mode 100644 index bd6717043..000000000 --- a/g3doc/Rule-Based-Execution.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/g3doc/Sentry-Gofer.png b/g3doc/Sentry-Gofer.png deleted file mode 100644 index ca2c27ef70ac1d969ccded4aee1c365ef192ed8d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 9064 zcmeAS@N?(olHy`uVBq!ia0y~yU`%CTVEDr&uaUVS1~+RR~?>Tin*pS(M{@=Lswuhuho?W2d#H3n_h8p5~K1mA%%n~ z0YRNJoE8W&s|Xb=Pr{qajdPHgm~h*|6mBs@c0wy}DIyZ~fl-^VxHD zpP!$ZKd1Op^|h*Nb2fk9zW?vr;(dQ_zpvY$KfhC{MZk$e5se6Oton9%`TNRe&C9<& z{`Bo#v47@rbL9}ms&~ont-s{&E}yaN}T11@k2|lv^5%0@zMr7_@Lw z`=|4Al`8ul?|S`+ec#94Oy&#u^D30?KA-&kp7oA5*5-Fb>hu5p%4A)5>%!Ny`HZP8 z0WTePzBQiTIXUamEAu^ybx$w4FK2boxBFAD>-=iHohb!3t^KVu?SA(dFUy(#z4q_x zkFN56Uu;OtaxRk$aO03Q)%gGI}@5{B~vEkwzn@j6(tcKHN-Sp2_{R zV*jU~=a(-ybNY4G-A(@WR&|f&RX_S}ZnmsJ_(=Z0OVit?Uf#xZ|NqYa|9(9BeBS@` z-q%kiKeo@$lba@WviTFM{GWtf{TueB%U3Au`=BiE`8pu>`P|a5JC(;}-KSjKSK|2b zZ{}=US=pDrrq_R2yv5h*-1a#IPQPyT2d*#8Nvu6(IN!d$E^7Lk>o@mo-WFJ0DsyZ4 z`|!6H{xujmIaJ;e5U^R*XRX)T#sA~wUWF;TtM|OVegD_BAHK)s=Qp`$vP~6^V7*iD zz~^+xx4p~firp`|8v3#8+O-mE$In;a-abAj_!_Ij?YR-rv#%|@()B7pTJ{Xnrc)WW zpNhxNxwib<%AQ*vZcX-ICeFMy{^^ue7qi=Q%$CmZ@O$$L5OO z)#cq&zOCkNdv&=Gl!`v>P*ga6P8vyYKzt z+l^gI3@=#iU-6?bdxFUt|BIWay-s4BBFJ>=@g|4G8AdV7G7R*uYjaf2QjXD+Xn!hu zs>|Z@H}wa-tf#teZLNE$ZeQtQ%e2;isqm7+nWcG4L$}nAs7?Jec@l%>G+SJv)rviehOcZJBGY+O%vF@9pg%MG><-4eBp89r;OkySKOXOtA}yI>s2yGiCF|{Cl#E z&N~BKctMUzw)<)NLv?~^(;6k$M%TdfvIOnuu$?heLtA8>G|vR@KCD^3*zu;~jI)Wq zP3#)Ok1t#i(VXj5-ZRZjg7?(DZ+j|F+m(K}mc5Sg6vx7ot(%&i`Lji|lpERv*E?%i z$NF8kQnb|h&@R!==Z*K+j~z3*p#FgCQKHn*+s}4>cym-)X2Y3nWoc1@7MTlK)^#ImfOE756Mo`E*{k$<)1EXR<)! zcTZOVpJ{*_hcDL@+q)CQW81E+VLRxj$-R_Q#))a;H1}`OlCu`e@ReCk3GriY=F2!} zCi6%7b$&d@wucAi-g>ObGJm;_!SAZAp1D^Gxy~dWSvOO-sYqgD`oc9UV))xC;_iN* zS^GyuL%BswH%RZ8Vhc;6qp9_01%5BB@HfJFH;-?6nxm!sXQ}nt>#Qj{n@x{>nys+U zUv9G-$5fLk$0x1VQww_X9aJ_tNNO;rwgmiijI6w~@z1*rY{x>@%{boEXcXWED>fxG zlwrjt4=64n#U{AaTmUbB1wh3pr2ORonFuL=S*CytT4D6%P33Z4o6ip~7tXY9EHd9K ziC*fXRRT!dfR!t?3bP-5J2JQPy4pNj&aYwW>vS(B=lR?b+mp9YTA{_ub+*uZ?>%=O z?6Lf~@JO**#QHkUwJTlvBL&`Z$K@{vscAXEUO5saXbJ&Yiw$=;Wx`%ky%H-D`Go4)G z%f&Fi*pQPGQ@|hJOW1Y))&^xOqx*dVPQlAk%T~{xx?CWpTX$1z?#0>n@15s#xR+v(eVQ>dozEtn zJ#$jh!aa%^{n0=5E&(TMf%*n2+<{aRk~SqcNuJhmh3T?nzi<#FoQfOVVbfXbNXCt?$-Kw``3#% z*e0)9n{!oV`(7(6BlCC1O*Wsf?y%a$;%!c>!4ZF% zqyPSQ`MdpNRrK=jwcoCz##r_A;EX1~msA zB>nZKOpj2JS*7~%Uf_Z?B5vZKMxn;zldYTno&K@#h_TVcqIiay2YSN64IoBuB;{4njukH_~#=Kpnner)#pH#4UF{ciJ> z|Ks<4zmpf#Sg>A{Z-}&f#(dBwWx<>u>w5W*Ophya{nP0xzHHy0&+&cl?|(Yc^7`-Y z_x7UO<7zUao?mo9fe+DA=WjIp0#eD!KK|S@k`tvH!NdzUKS#-~6gY z=Ig3&d#2V4`6T^H+IQCX-S+)w5AHIXJ-x=qDN_91|9b}21{D>*J=K@j9=|{TbK~br z+%+2;5B5mr%dRPZ*nW=vltbmOyFV}Zvsr)kwq4H`z5VmXy_xOebGqNYNdA~?e`oGC zMvdvyym(J_C6%(PuaBs^yTNYdzE=lbHyZ5y{;pknkv!8=qxMg|@qg2934S%t-Umf5lEgP;>s`IUs9Sm^ZLxMk7I3FuQNXV)c$Gadu#2t>Rz!TTA$UQ*IDQ;{%3aY z*VI+gFJl-^IaEfyaR^zWBhZ&B-S~dZ&U%}isB4ACLzgm~pXZXk=Q;o5{=Y9-51-Qd zRCeOGtKyaeuhl!0l;YR@n)3ah{?`4~E+P5~t9iZlPZ5~1T30kM^igcUX4_et-s-4o zXy-1pQ+UxA;wN74mC^O;!y;C`SKawFkEJjFTmDh#Yi<1ch69(C-v8Pgd}-gaWSQM% z|7>E{Pib2p9?$=K!Kp0it1FA0e@m`i>maEizJ)n#!)1o{Me&Ur1AZR6eBL8pQFQOB zWUX6!Uj(nsl$A0#<7TF%&#}5VTl!$I`T>uLo17zmU*ue{=bLQ(Ue$fyR++vma=nu{ zTjt(T7mvw2sf`i#QeP4t-B+0xu6B3B&7vF9f1QH70=~Tu|C_$&_OHA1el7gf|4Jy~ zD*s-2O^bm0>KIIqI`TO$?n$9+FeRaaglDoq7X_Q@%-%abCpIUA@I?h$N$)|rp zyUT9Y{Kr3^$9{{t^sJuS&e=Bgdbr!a+>#&V=Ko@ud*b(%oZdf$Yl`fQ$8#4h-ly8I zO22L5+9t-vNQSTf=1$)y(6QC$ubp+Y=V{T#_S>ue`#=4`9bm`yTvL0|-$zfwmv1j` znt%S(hrVZXLuA8c4YxQ*Iz^~EalCxPX(p!e{Oq5AmPOktXaBht78tp8ZWfN&{LSRrDbe_|tyvPazjxVaXd49nKcA;P zq5WWE{_5SfMW-ApPpyeIXAGF@yMWKXZ{nNc*{rE^6@(j$?wx#caTjy6dXwLTJqM31 zo)av#KzzERU*xLIKQEl#yLTx|YVGk>wx2cYHof^9x_;}q%UP8M;jxM>pBJq8{wlii zK{(4g6W1MYFY@s;6tOx)u4H*1(fTa!mqUWZ@za96g9L>m+hOG?)qq{ zT`{x9bjc~TX)X(wFEm-Lc;@XdhuP0BZMyurdJ@uGZu7Llb4Eo!bihHk``Zd481!+o^{o+b%A6!@u`Of^S)uOu)K5m8bY3 z?%vdlIN`m$a@OI6Yi?Quo?}*hrT=R6!y7Jg5!|f0^L_=W@J(s_H06%euLbj-pEt2R z_gwzBZj{CI%g?K|au;a2RISgQa!o>iN~z)p_gzz`T{v(zBjDRjxyTvJPfxWLSzK82 zZ`qVt%LQ3tSy|`hainKfa5<-%$SvHhHD6N1@8KEd)l6((eIvzLr(QJUV%c)$vXX^@0q^b`>Tsx%5J`e_4CM!8=5+D zvixdeH&5Kce?RWAWa579ExG}0r;bng%V}Tt`_YZ2qOvoGyx7yuc>$@7GuA|L?a+ z&+94#HyKJmHV8TeFPgpnr|13yJ*RKq-&6NouF4p7T*t{&H7+FK?yACTS7)qTy{+Th z7S(mnvmH5PR|{2`i$-j(ol~mou}5h|d8pvqmz%j+oj4eu_Sht?^|U#BC*}Rp$j;|# z>rPF%eE-{#*G3nMl9%n#ULy_~yD4fc-S{`x^Umao@JG3wzlHNRT;I!RXQpHFJh)57)mPu=EyGW*P2G1u$TQ=H#2fu+9&#HDU1J+I5~ zG!HzQG@1WtDdUvu5xWjum6{T4S2=I*yqP})0`#mkTelwCce(W7cgu;tyj)*h?mf7( z>B1I=p9_`>--%XdJhe9L{izopczW_Sv$1}UUZSIGVvs#w>cwsLDW|=zeyh#f@VFL3J5b$k7<-285L`d;|WZFgt>Gdq3i?1?Y8 zrB>I+T}Xe%GBH>2Y+sxITONH5-)s5q&71rm&+!$PXrAQ1&alvXX0_P;Cx(~(rB44y z&e>qS=$giVPQQbeHK&R@!-f8yZ$$9?_~yWHp7q+iHBmf^0xxWP8dg`DR{5JF;GTp-{O`EnCwF6`IqTjBU$npE zzwV^pj-oQ<8*_>@rhD0EuA0!l($AX+~95z1jIdZJ0q!%rmQ=C%HdbWhsWa=vo#UHKe5gYg0 zv@Z*Lts8YG`@);^E=NMeI@fVd`x$cLTSmqM-L5t^KH0A9#S1fMJq+2Mv>+z+>yHKV z{)Jcg?+LB%D~4WBSc(cCF~`o6}=|`BYdWJNN1H8z!d|Ubwhw z?U^}qsDS#3FJF2!QhxQ>DJ##uynHV{y|3uIsruz}w-V$-9cRC4Dqd{2{4HTYr$yneCSGHkZ=;)j;|o-yRyZvJwVuX|Q(Q*m^G_4C_XBt!P@d#7Q4ew)42Db=vs z`?7e~CB|*Ke`^N&Q!DFhvmP9YcM#X`JiA@QMOL2GO6+Rt1|f^-EDbTq>TV*uzOt)~ z6!;_r#Mz%ZYjE#*d-1{)mH8*$zmB=-zVUEOOoepRi@>W<-IuOMg*>%?7^xBTZbNeJ z_GH!N?E+e!n!92WHM#wHO(I&X^rh@7)5XGE_OK;wO?Cf{@K~eEdibx*(P7!&-}&o!*!aJ zg$QqNM7ZRXYF$x*e?_<1ym@tu7=8)+?dEy2Rk-1k&F$-EtIJa-RNWNi<<pN5t1&roOr0`i`&?n!pWG2=S@S-=);+cETx6UuL(IyilT~xJ-1;_iu9^A0 zS`n+T76GlupO^h>9aVY+oL*>T#U4psfHHruEaLQgxr&F}-+6cvV*K_!dUt(W;kQLy zSH!pPDf`lF!|(_6pa{qJ$7?0WX!IeS+mEv(77runh{pP%Wm)Q9!EK1D6) z(ULy(|9g+|qyH8w`5tfju=@HvhADxm&OhVN+p7Qjev=nu#QL3*8jDZ0eQNC2@8X|l zEB<)X2kqB+%%@gtT4?j(=J_M+VznHPHx=A}d!G#?_UEgzGyn41kJ{Vsb`(bbSl(~P z2GU#^fBe~xr@!-#@6h>k>706_(W)Gc|6h*tAGLqKhyU@W58dZ&m_d4few0_+-g5u& z4xK+v=RZ40hMG;OF1Hi=Zg;PXwl}`wTV&7aL+Ag05na%uC3EWJ+Xwe-^`|bW|8U{($7%WZ zCG9t_UY;Pi_I*bF{7Ypv^J8|nX&uj_4=0{; zf2=BAlXRuXyzXt=7F~Y39~T5)@2dObvggAc{v+}hpKU+dmgj5UJRd!ObD!h!pjEjw z|HSt*f<1a?-@hL_=kJf2wC~BJ^GBCon=e!T_D1Z6o@@0r7Z+*fAI^BXZr`(CTkhgFwW9j>r8|GD%*VY`L8}0RN^R%y)uO&)!RBxZ#cfA1=>fir-+WxV4zfHiT ze@~W2KbrNpUj5yjouCk~-<|ny%J#%9Mbl#|OQYW1zW?{&gH7$*-gn*q*jIimzw$HZ zNArJa-Y4tM<<*|EVw3e=xozX~sr9UvsSzk&e z_1`w6-k$$EwdSDf+K-;b_XXv{Lq*U3`g{3NYIvOV`+x1shfm$zSQ`DO{qwm_|BBDi zLHnQAzVFZ9^L5?9uijD9kE;K>zMc2o<4yYYOB1Z^%8!O-?(F?;KWX3l8~=QEz5SS9 z75wKd`~P(h%CxWF5t?82tNO9|o{d&@x9h8`|9te{dZgd(b9Z8@Sk0TJAKK>ke%*{(hZUYO^Uwe@Mp@@p$& zG{18%=xHdDbo|-w|Gz|_?SFA*^qyDCq93=;-%+q(PIIJ!@CMeT#=vXYQ;Q9_TlW8F zU(Vl@b$9zaY2hiyxl-)++0XmGaLe3X1y}yP>(rd%Z1DQgqX*Xv=fwP9C$gz(?WSD| zUPxSR+dS)>_v=5C`{&s2*xMI*eA#2s4W%)^azf@$`<>1-MUd%Ka?_^_zJ+gYR~&gI z_F>B({jmC41Fmb;2X%YYSod)2$5px1F5Y@|q0Wx#5?u}PT?;s_X)P{mIemNgJikQE zinf5Tn>r6l@9aBYu#@>lzwhxiMNIV(?`D_VPSD%`Y1e)h(9Fq3=g7eManCKeQyUFt zpDTEfHTRNe)%uW@ZK4gLH~X%&ZFGt>5ShYiwKu$Fw(sl{xAGV6W^mozRp+dseRqQH z^8h}5olTd767Om)|MltCLXT(x@O+G?f4oNN!tb~A)~{jEJn-_Xu>PMc15?H9or{8> z&QxbgWxT1le$TdPnxO$4D{kdq+f|VjHkiQ=_Q8~C}b794(ioI7ws+8dDBCx;@=&yZ-gtpYhXcGb19mx-;-z77}jVbV0v!SEQlU7Jnpv~>&9r(KX_lX=&W_x%zSAl4;to6hTDD(0SKO|y zpQ&aQSDOZQ?kdrToK_EW>#s$vZ`a8X>7mi@e%?#o`I^`@c2XM!w$sL442V<1hH9R#>U6*M0bW+28q_ zANXHBapU_^ZU>9Aeowc~eLe#;rCk}M`-0Q0GWg&o%R3vV%=XIuU-|Rt$!*Us9iCIV zQ&K~DL60FQGLu1FxMPqB8@5xRi5MPGQkMWtZGtAq8B^gCrZv^efHD}ecycbl?#WWNmH0; zLw@k13Zd_p(@T|F1ZJsdoZs^Fvrstu>DNNnRp!mE2-{HO7jSLinoV0BXG*4p=RT`l zoNKOrd0N%#?V7=Le&>u@1XfvStoL7YKk|jgo$U3mbLVb*?^ko+TBzzfBY}MHJ?0-9 zuCA;yWBXc`{%yUiV5KYA*u z5gz&F)~t&8uIDc?t@ghEyJq$M#g7xFsQ zU;W&V>?vZp|FMtr%j%@xpN=V=pC4LwQ0Lp8+<6T8Qr#&bwHNr8$7Zit+;@Gw{{rW) zJ`0?4^)@-@&TwdtGHc`u%}JkS+;}d;);HkY$;|R-zh8^aEm(EFaDVRWfH=V^+1vj~ zoKjAey?pQpZ`q`6xBorA{p;SDGOg_wUX^dKo^p7K+x&xSf6gt_j#@YKK=~bu#(h_9 z8vpG{VtRh@7-x(?*VChYoCT})dzc-&c3n_w=a<$6mopRInmqWHwm`=1>+R-JMU&Z0 zB1esOAJFUNJO3{tIW9LfEqcq|^9Sa#KmE1f-}SY*ksN0pYrAoTN==zADRcNl?RAcT zxO|6_(8!WE4zWoLZ?}3>G%mHTV(utQd9^~4^;C87BB`Z;X`e)uTeNsjt-W~RK%DP{ zTN*5>cPGhjy8YU!xrF0NRC7r@!yV^oLY+++yG~!b8o9+rXv*{`>8Wgia+OP6ziq8K z%CWHMQiPn`N}~ \ No newline at end of file diff --git a/g3doc/checkpoint_restore.md b/g3doc/checkpoint_restore.md deleted file mode 100644 index 5fa3280a8..000000000 --- a/g3doc/checkpoint_restore.md +++ /dev/null @@ -1,108 +0,0 @@ -# runsc checkpoint/restore - -gVisor supports checkpointing and restoring containers. A container’s state can -be checkpointed and later restored into one or more containers. This can be used -to save work and time in cases of failure and allow for container migration. A -single container can perform slower setup tasks and then be checkpointed so that -many containers with the same task can be “restored” and started more quickly. - -### How to checkpoint/restore - -To use the runsc checkpoint command, first run a container. - -```sh -runsc run -``` - -To checkpoint the container, the --image-path flag must be provided. This is the -directory path within which the checkpoint state-file will be created. The file -will be called checkpoint.img and necessary directories will be created if they -do not yet exist. - -> Note: Two checkpoints cannot be saved to the save directory; every image-path -provided must be unique. - -```sh -runsc checkpoint --image-path= -``` - -There is also an optional --leave-running flag that allows the container to -continue to run after the checkpoint has been made. (By default, containers stop -their processes after committing a checkpoint.) - -> Note: All top-level runsc flags needed when calling run must be provided to -checkpoint if --leave-running is used. - -> Note: --leave-running functions by causing an immediate restore so the -container, although will maintain its given container id, may have a different -process id. - -```sh -runsc checkpoint --image-path= --leave-running -``` - -To restore, provide the image path to the checkpoint.img file created during the -checkpoint. Because containers stop by default after checkpointing, restore -needs to happen in a new container (restore is a command which parallels start). - -```sh -runsc create - -runsc restore --image-path= -``` - -### How to use checkpoint/restore in Docker: - -Currently checkpoint/restore through runsc is not entirely compatible with -Docker, although there has been progress made from both gVisor and Docker to -enable compatibility. Here, we document the ideal workflow. - -To run with Docker, first follow the [instructions](https://gvisor.googlesource.com/gvisor/+/master/README.md#configuring-docker) to use runsc as a runtime. - -Run a container: - -```sh -docker run [options] --runtime=runsc ` -``` - -Checkpoint a container: - -```sh -docker checkpoint create ` -``` - -Create a new container into which to restore: - -```sh -docker create [options] --runtime=runsc -``` - -Restore a container: - -```sh -docker start --checkpoint --checkpoint-dir= -``` - -**Issues Preventing Compatibility with Docker** -1. [Moby #37360][leave-running] - -Docker version 18.03.0-ce and earlier hangs when checkpointing and -does not create the checkpoint. To successfully use this feature, install a -custom version of docker-ce from the moby repository. This issue is caused by an -improper implementation of the `--leave-running` flag. This issue is now fixed -although is not yet part of an official release. - -2. Docker does not support restoration into new containers. - -Docker currently expects the container which created the checkpoint -to be the same container used to restore which is not possible in runsc. When -Docker supports container migration and therefore restoration into new -containers, this will be the flow. - -3. [Moby #37344][checkpoint-dir] - -Docker does not currently support the `--checkpoint-dir` flag but this will be -required when restoring from a checkpoint made in another container. - -[leave-running]: https://github.com/moby/moby/pull/37360 -[checkpoint-dir]: https://github.com/moby/moby/issues/37344 diff --git a/g3doc/logo.png b/g3doc/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..bd1a1e4b79787a5e8a059de9a11ec1da000ce250 GIT binary patch literal 27719 zcmeAS@N?(olHy`uVBq!ia0y~yU`k+MV7S1+#=yX^!0v7j0|Ns~v6E*A2L}g74M$1` z0|NtRfk$L90|Va?5N4dJ%_q&kz#v)T8c`CQpH@mmtT}V z`<;yx1A_vCr;B4q#hf>D%PXdYemlPZ`8gFuStrgGfk`J*m{=wxEncxA;b3TvMpuH7 zm#j!7tY~byQ;xK6}6lnR&@Sgp#!i;Z|9t17yxb!xaxs1`WtA1Z_ zr;E}=50!gP|NInYoH#K<>Q;=nC5w}J%L1O%MLbD7OcPiZ%;pcyWID+8?5$6d^2TK6 zjwasd)7;;G8n8q3$|BZgr;Ac%w@AYNg9$TaSF8VKJ!8^&U^0Wm-?@{gzhQn{tfs@u`~KU_YirkE z`DLvLF+Zr`V9Kn!-EY5TbMD|fV9D_1-#JfZDaIP#p6|I!>d$ALwSD%!1#GfqsHG}v zL{U-NcLB%n#ursdF&*o)cUdhGZ23R2$$ZhHFZ0*L&(Ho`?gVni#5rDbyqJ2}RMTUh zT)6o5$PNjI8T*B~1il$5_m?VNPda(~?fVpnv7#?NG3h8j{-zOK`}nNF8O90k-q$cm zSRe2fbvz%X^V9x^wItZ7yNqJP8fN;WF~6C?`#_AL@ZUN06A?=dY*RI(KNvE6D>nk$ zTVlFv4ui2on)=I|{|q>8GL-C_70%(b{@%tH^DhY33O~BAIo%{FdGUq4?kZI!{Z2XG zJxbo+`&7Q@Tm2hfU$YR|wMQ>5-fB^_gw37r`hr!f_}cly7oXY1|1|Y?VD#+=tMfS- zu4(!7N1hVBzZozhH$}gTUHnf=v^$d>pE(lrH)FP4w}0 zn6=VgNa&G((4t!1|Ns8F2d3R^H+pR+BKr2=FB_nd6CEp@75AM_(zIAnRsar0Kh>s)hNm2p6R)pju;*K_ zJ1Ve~!`Wz(!M`~?J@)AuZhc-~PoA1K>&kWWhrg#rfBZV#{_*Vf=8sQIlrlXm&-B^( zXe#sPRC_P5SvJZVtTz;#pBbbX&gV?N(q&l^VWhYB4Npwf%a*klqsm0oGSF>uW-TPUg2F= z#1?N43BUgM?)Lph4_)7PWM8fOUe2oy3);KZaL0vcn}dU9mlmV$0XEfiHEpXXmSvl5 zdj&;B`)1A*o|w9i!*Js&`AKh#Zse5h`Tox9%y~ybTdgzAeD&2czMx`e(mJOD zoCb>v{UkI?i#c~(o&3Ahs!@9R{C>-Ff5)8f9$PP4r-D*;@%-qf?_%q}tcaN3zecPHhlOSbKK!bVi9M@AmGk zI{v7Uef`lX+Q&<7q+b-)((Zro_o#N^hXaOpie4|3Fj%lXYh!co)6>@;ZFCoV_#tt7 zxoAJfqtoS6#MWF>(uX*1VuL_}T63jMgDS%vyLlC7w?6)O;r=p3tEjo(9M1GyUA^t` zTJwE}`t9Ew*!w-cS32J+J~UB$jf`znxBLH}YSZ+iU%y+sRUsxkX4d~su}V)+?iI@U z5gWQ>d5VAPqw5SimM+*;-hXIu|M??Fr}u=Z^0zx5Jnns6;rss6i5o*6^%(nBe9HW+ zx%bso!TI&u82kSuEAq(}Wt*O1TlBiiTfAmPXdE~Nv2fRkCSw@=xuPbQ(R^oVAUMsaBB=qW|h3woP zu6E78yL0VKmiX`#%^x1C_kbL$#L4z&nSoE+8hgesbF3{}+Flj@pTGX-nKPYn`J6_^ zcCr72<0{@UzqwP%z%apLf%v@nzuo7U9n#+XH<&H$ST<|?gPY6mx1UWb|7x~VNNu8r z%A{bq{Tv3957y{6JioJZdHQ*YJvQ(8dZco{RQ>a{kN&vc{obKzXH(Vpl^r}HSn+CR z&XFS?=MBnl?pew6{m$3;H#cifT#a7BG1)^!=%i-vdDe)iRX-V%Y~G%;ZD!*?u;*v- zgbVwZhZoD+Ms+`*S1JEqKaSHik%2+*;Wumj<8#Yn6}QXmUGOWy_T4;V{?*~R#b2kT zCHd%TosM6X3Jpmmt9ZX@({9ueXps-gh>pEZCRh^xvOCBRoqUwQ~dsF+*%)5yO`cN`}L1JpP&2V?)Arys};%* z-kmjL+q_qM_P&U=`E}krru4%4FqZlG8%1&o>_Q;okmk^=IK7j_%X>-cbe zzwcpC?3~^G?6~ZX_x?LADjwW;zi-~OX$^P&*efb3o?HE6Qs2*4r+s&%pR+MBy%{4} z7r>r+rz|_M^BOdPa%AWoU|V`lYVC$kybRN;esDNeJc&0hyt}2?cHZTO0Us`P%P0QZ zld7Jzx6e53O~Rfpr({=2ZuhcEyZZfh!SP)E#S8bHY`qwgl`N%R?G7qho`g6AGfuNB z2;+J^^>_Lt>~z=EO1`&g0@NJ5p9Hz07Iz z`H$|5qNfu5&vmxGIeO;h`3KK?m*%dEE%~VN=YD;jbH)mh_K-1BI-R{lZR$*#?U4@zJFzmV$F%1_@a;ipTHcogP!Q>v-|M zJr}#q%sij;f8XNVb-w%F_}Kh^B){m8CJWWcXRq#*IZxc+1cXp zRaW!nTT5Hb{a~^0NcFETFZ+6WRCMCEt@Dk&cTylRDW+dgx=-fs&KvG8!Ntm>;E?r< z-u{O12V3}KduxBso&NZpeeBDRHS=pf3BUV&dG*_Eha`>542s0>G+zjq&KEyV$i(#K zhWz`1Z*Et!RDYLqd^+#2MZp7!tW~cAqi;9Nnl;USzwVs;j0~sZ*XPZR7D*pcJ|rL~ z*EM4XM@xIVlF}mSs&8G6^MAa1aaViW)BUwc7nl2gH=D~kt#*$X|DE5fw8cbCyB=)T zoyIhMZY;Q_ldBcBRwBwd?|~PyJZEUb0<%-lx)XNc8uA;Jm5YENEhm%okSRGa=y==gkV zke97P|6bK|{f_R>=WOj~WMpkh{OhlJW5d0sUTN=* znaP@2w{A}2wd$x>Y5laIV|`cIvz;j$^(T6$2zf48Jd43t^2~ph36D?RP;{R3;n;2d zsy$X;uXfEZeE#--X8BWXH8rO9x<94a)Q(q+SkJf-xljIn-ELOx{eM|sUlZF|aLV9? zCiBJVEPL+fA7~K0Uo-jfmPPTP)Hun(MU-*cv^k|>oWJDsEbbmJ>pwE7|6k+3&b>CX zUjN8E{_TuytHPPnd%1clUMqU1Qer zGdmA0zR~EDo6BtX?|zg{-E-?do0i_W|B^-Nb?3{Ki#D;oXZ#S`I2)9}RpcIh{dnM5 z$Assxg7FLn&);dvb+313?@tW7c8Blibyi{b2ivUmzH5{%*p&QRPp9UuH>jcZDmLqR z@hPKOo%c;8&tykF-2J3$2FNrf+4W%uqIA{mic;U)OlDjB;OlRNmfyivGF*B4UP`Ws zzP(R3V&RAD(|B;VNtmfXsua!H?A2xCOf7U2d z`1rSc|AV7D<&!?ERo?Jt-N&=J-S=*g;riTc7LbV^e|nBbPuLdlhgYvdpW(;z#pabd z`#^Og*XR8&KKu#|@8_-hxb@$1A)D`Keltdg$V;tquW*q_TBIx>w937rLgUck!va#P z+)GLdxWs$H%|Arls<1)->rUm!JZuZ zb-Nx-d2_d##ovCX#C)Cj>+9yvyw=j%x}ZKuU**gD&VQV? z7tIy>guMb;MOsPfu!Z)zOT!wCL#D4Y8u^8?&z~zPVQ_ked2?LvA*!j_TB` zuFbk-FV0U)TNm5B<;fXAl_PGwhw?SIJu6?Sd}W!)=Nf^uY@s=Y>4lO1>SInFPLT6I z5mQ$2LO>%#v0jeE3S>!~c~k>fO&eDIH0gY=wUZ;y_{?x*EG zdMH@Ra4n1fpPzFl;?~0%|NngV^O<9E>Ftew#~ua*O!#jZSNBo*?B3laR*grF#Ce#0 zYgRO6Y`e10!`Ij0QA6B|tJ-dtciJ9(7!Z)P^2jaIqY>NJajXu{b^f~X8-M%`CdT>V zk=bg@-LhKCG(QTfHUCs+SiH4!-JHlA-I(RRIrk?`EUccgc3~kugKpdl-o$Sk{+-+Q zgI&_7-LP}|jKX=`hLQ)|t(H}9o349frQa+e&j*jbi7h!fp^~j3^V~5`$BI`sBjwin zi9V^nxAKS8U!LHAuJuN*?QFh0|Kqpc+`qHuO`Bsgd%}qcDm>>r4n0uxG>{T*S|`5D zPd&lQzeUql(ERKk2D90+tHW~-FF##>s7v3htU_p;vc!%PQ-o^$3nk}W)=2HtPdvk} z7~Xw>P~Laof$O;=;kyj8yB1xLPH@>NF^wVSrGnh_X_IPmJ#RL> z-*Y}hi8JO-9HX)1nRuoh2X5||ofg-y|9|l=ch5+jsXKmkxnI1JlKtIEF!AD}c7vjn zRqh}EHZC%V)BeF!JU@QXsc*CV)DwKX51a^e>yeq-C8!)U(PTrv`*NRV&e>=C{HLvT zepf$z@scH%=0?xHq3Aa4&6(TlLi2>~FZg)MFV~}DdtLPQeL<@obLJ-*&A85J5!-!Z z&4-(FZ|>#sIxDr>pq5qqREX6AH^E(oMczS|rWU@wY;|@*tz@HpnVFuIl}voi-~2Bx z9=>WmzurQIYngBDqRW#TChJMHPJe#)VOdUnU}PoB_q)dO($}JG`W9a1)G28h@T8W!JT<&u=?^z9XlHOOs9c;A~HcA4`u!89Pnm^Vp@8 z_tsbN$NF_Wvuj_c^dAvt*z^0__PJg9bNwFN`@Q~~#y0ziuYb+%l%KDWv3>QAxpdV= z`D1;uO@@!z9-rCFrf6jq)6CN>taRvU@VR3f9%}CRdu@6^*3H+aavxs~-mI^u75ic3 zwV$3_TsO=(z9d8GK-6}{=BNhEBipmKi}`)F-hE3%vPyl%UZHpfhXVn@Szo?93fl87 zSEo}&pzx=u)d`F2rbQa@*3#G4$IIBoeze$C%3W$bbJeP-n3{)&SFCy!u_mVQsf5kv zJ38Bwe@msgy{n)8_^7yD&i2fT>M!qvyEi^=+ww=!nx*#9?(8|K*B?A+OrBx)_Wq5X zmsPiS>UXdGDZKTZ=OSCR=1SfMaLpzwblh@<-eZ zn>Oix(%7cI@wV)b+s>^KpAKd%Pv%|u*P!r{htC`np~L>(jDgqJJ-pO(uQq97_z(4% zpY85`6@8_LTHTVbX>>15Xx1;9oWb7s%s4`rQEkQkPU&R|$H`?_% zGiT%e9<9Pt@9uU>N7-^-wV&wxVrB7_c*cZ{uQr;dOi(PI!8B)S;E%IMQ@O8|nKeih zuKA>7$62jks_doG*jQkeP~i2=fgyNqueaB$=5D=@XQV$)*M0iq+icyreVqLqhh4?9 zpX^=1boOl7ozmxf?sw`tXW5_GS zt%T$i7L-H@yyNY9kh3-^yVYq)?`vBIwr7^I&U{z5bIlA~T;|iMB2ci4>6yaQeg;cf z^Vj{;9hMibdVcF^>+|Urxkrm1wkit#r$#uOfBDHgm= zs(InzNq^_w(md`uy~oWbrzQA#jas2%1M9w%UW-Jn*R)1o3O-|RaB%ajc0Yw)z+{u%VLI&aeRrNZ1=M5b9jSV^414jDXrvW{kBpnK#5bpD%3|(GT8ZIk;?Ai zs_&ggL&N(&Yc%#s>-_k)JAO`|wY`IMo;KIx#@}(SzP`-!s?4Od!|mJK{}(ok#Me13 z7q)mlXQAJ5!@>_cet22A3f|iBh*^N|kxp;YYQKtzFJCV#lH+6O5R25w53`m|+ZdA1 zR^W1UX7{#f;$DnuFDI2~9eDFK@H*p*$2uNq*Hrp%-_@!3YP>wT#Hz9QyzH~Unzfqx zx7)4X?UBjXuj2@hGrjg$c!AJYiHAY$EQSuBT~zEAE?oIcmSOI;qaT}c5?1*wzOl+_ zP3%Wo!`(Zs?!Lj;7Q8vnJYrFjPN&L(f=%fj+pW1lJ%`up%9ozciY|L^)v|uypPMgt zC`vL53crr@_grhZf$pD$)vu`<&k+1XfX_N>J1mI3kiS<>t-y6oPzO|Z+^vDR5Q$IN=x z?6(;?8EuCb&dJaY36AA|CKk=V`*7njH|aNJ>`IHHZs{LA;&LFv=fI9)qXd(G_eyrV z&-tv!bEYHs=j~}f1jCNlT+%E*)ckMTIR!Vf2LCI4tJRz|wr5?9@9vxTDNZU)xu&X9vdLzwzrko5>aPtugC!b7XHwwVE@4Nr6 zw+riEm0Y^QF0B1o+V1_q-@D%L|IK>cr&1(;|MzennH%g^kH=VYp7-PKQgvjzTqCer z?*PM#*`-Nr4e2HwZ%r32na#DqOnX<)_8855`R~sqW&hKeteCCs(9c}3b>dq?gR`33 z^depyoFn8JaB&^O>N}x^oDIR<-=y>AJotE|`+n@pOBRY8CpACHoxdz zr{d4oG4h;P+pFhhY%SJ4X$JR-{d;|SA{pkjo-%vCYQe(Kdj$@y7G8GrT9bHCP}*Km zr&G2J>lh4{%uVEym>qF}-K_ob({oX>o+`1OecKe)7nLQ4gzPweY_+H;`-Z~iqf0mL ztuB9mNu8Ttc9q-Hd53lDwfK|Y-%|!V^SyN!GyAH7g!<46>jQpv$=)u1cvO7aj+AVt zmL&NlDjyY}K5gyIWc&P@<<4TqipiR)#WjVI3$y+E><&$tW66=w8`W~*ytUWoYt_YdK}x?*FI!{5z`H0KasPYGe3h{MN5k>;p(ZiKN7!| z<=hPFJ7wGccW%%HLBUlH>+^5E?0mIs&Ihl|O~QO()z8e!h1P6tuUYP<;F%B@6Sw1V ziotr8f_1MBcCPdGJGVzYVA}~Jqh)Qkq#`yys^&U+Tk7aE50wn}hL{n%kXZOzwJ%b!hqYhC=kO4vbYhe3v2<5lqlhl&{sq#ro> zyTo6(BT%f{Se-36`#`>!sOSl~9-+>*ErJPW-drj9u!r;T!t2#(e0v{#?#&bJnrznn zdR4)iReY7}>$+U?>w0I+Vyj>NxLk(IQN7_`VOE8~HvjV)>~eeS?91M89{y%KudDc1 zz||!xjIJ3KU#qvZz1YbRBCdXC6R)HI6VIAEi>^v9ao+vSPpEUr)cckX)z#C>*bPqI z^c7a``%-a8J}jS^K|nAmNm)QxT2N$l%>JVf13pwe_KJ)mu=)#&MNmi2>l3!mtdRAf2y1*Y7-IBLG&u`E&JW1jnZyJ}>w{n^3Xbx3bk)~~*~%6w*d{jQbm=ntodISl2iWUtH4c(c91H0ocH-P7>>J;z=eTDeEq3q5iX z-1KO}b;S^q*R#IxZkw<{S?sj8@4qvF+C9fC6A#5rKIAl=OQV*7OL##<+BLz6%`>wZ zO(ys8Yn0v7JmiuY7`X4wx^E4Ww<)}IN;fk<+@`KSmogxRT3YLW>7mu|LB_hFy#t>?`B~_?WhcH;A^p<@=z& zbSdlZn3;!DPSmw@x(g(m8;4I?5Swu8FyAVkUaq@aOJ8fR+IK;B+I25qw$J7aHrZD% zTAHh>ocULrnwqzlZR6ZaK{fuyrd;vP3%~T4GhX72{GWOuHA}_$Osi`uYkjzKnERGL zHjB@*8cdvdUTM+80DoF=vnVO!ILbHq;GX#nwhZqRFNC#4ET51(clG+t z0}AduUUzLTF&?*I>ScbcqfzQ9(8SU6_`E(3+l%Y}nHaQLgjlvQsx|*qaCkjq>eVwp z?(xM1$Hhrpke{;H{XE~wRhz!@GO}$@`qjL{o|*YV5l10I^Y!Tw+%em>c*-aEHOxDv z$@FrGhMT}w_in~Qa|S+!t1Nj5i)s@hI&T(DVt8CU$JeMVr`oRS)#R)(4`4^4^LYO z1+g6ESf<@D?NhTD=NSdr!`CiwOgw}^uCRyQ2ypf_lTV_b)@4kHG&UA_1?I|2b4Vgm>ofB0i zeCIy8mvNqt%jC`mgMhu7SNHe?W+X)_{Y#+!4)5JVlUnXw?04)8n84x0 zB+MqD%;@lc*5YsbtOPU}9CGh}?pSf@rcHD3=Js2X#ti$q8ciCaok~Bv?{HL?`#&?| zIVa<^Idg8#y;ZLHPd543Pqzj}UH!J%X>kuW|Fl|U@W0sR=ZVYJvDs+hl~_inHD2EWnI%e;CCqP0NlE*#eU4^2 z)eUNo-{}!%PT+8GcG&M_tHd^C+AjOa2k)>X=pWd5^jeepTvnc!VSgLfD*j?H5ztn# zkggL-NVs(7=e*WQ%R}EBP;g%&skLsASn`dFQ97;08k{}9C3fhaP59T^A*Zh=`$2EQ zyTr#bXL5-d_vgn&TNT>6a&@WMirm}_(+BCQyB(^GZyQQw%*%5!zYb- z%gr#>hOMzXf80wk=r@@mwCp$wtl;UC`E&`0*-A{cq6H~J0ar*8G%{bh`Y5D8Rl{d#{O!?{~vDho%k*s>$iLM34b9&{= zqPny`voV{R^6q#)@8>4|#j_2V+p}smbBPJAQrI~C^ZkCNZ(oJy$4koDD;u3nn5Qlh z#eU%B>nP_W&QsOPL_W*@^E!}JxmKhhtaZuE#qQ_7-4xDz9WzVxzOu;sERoy!5|cNd z;}(4+&bCQ_L;gq4YZ&WHm*b-$MdE@G~mzQ~OmK*h4f89Uc+pWE^%-68)Uc{|sKfgrh*YtkqF!0&^(B{mpr$S#|t-bke?dhC* zA#MEk;-9`ZX`1GIbzZ6Ghn6pOzCYePKPSCSdx3+X@~k8u!}uo*_gdRb1>~F<=Iq;_ z;TkgM-Qih_zwIqpczo?`gG~>W8QCta`w=I2Wog%Y-?lgI5`XyXpI_u;d2n#AsCB!F zn%~~K@9&PT+EK}GbZ*vzfGMgByH*RHXFnpWIe&@tre`9N+)RrPyJ#OV*yI<5LN3U~A zlvKK8oJn6Bo3Tg9_GnG(B8}66HjiFgSh4L*GMe%K?R%Fx?(HS4mokpd+{V22=$thh zg0p}3^fX?0xo7oXo_>zQPfnjZ@`(Rm+w*7V+V~aKB4SecShEyTIogCxx;?stdpC_*W-C$vT|Vx; zXkptn^IpT`vMNTmUZo$KWS_P^oyX?kZy3+`%!cLq_q&4SOO~hoKYiabgYP5XgCATH z2QwQZy}Ev>%5*YUJzQJn_VKUwE^eNk^yUqVcJpSu1;|ro7$!QTOnqyw{A1|JuXE^F5zy2t=*@qOyGH zn`?_s$TI}&T>YqM%Z~EwgVM9V>wnp?F-yVGYkT{`o6{z$-Do)!y!T_Av0D1v<1OU^ z73{n=Z8PP~Bscwg^4?}ki^rc`Om1&t8h9lZoXxy=uQti>`_kxz*SCwlkFVLssK58e zM77V`j)!a4eY?48cAUYo-qlPDU%CntKCM_+%&>Cb&F$JJ{>E4oYL+NP{`RTyp1kj6 zDT7=6b3vUi{$4R$O_#qZ&2xB=qx*=7LE@I>eeKx8KkZCQ-Q=0>KYed=r@^u0bl<0@ z^ESK&8kWY998pbrJAe6}=kq$Z>&E@ajMjjHmqagUPQRL|V)NWqu8d@6h*?q=!=P}CU-fCLeYW83 z>m082+)bVx2LHlhb{%-!tO#nc2DVfPH>B+~`r8x0qI+e*?6&)g3+k$GHpDV0u&KK9 zF`}p}o4XQ6aykD!kGTeBb z#p3KMO{PC8SkH)_H*9K4_Ex~=h3D=>U%l^qf@Jy?rl57SyQE5Rkyix;tK7Jk1OH>7IMtJ z{PuVqXCVjY#j@_m<-$8YuhYJ@H!QG_VZC@(v`qbrfUW0y!t?k4DA>K|;lI=Ti_)iv z&F9^>^yIV0q8r|w3qR1YV>y4&M^426Io5@zYwY(O$vV51;loa|i<#SIT~zZqaZ&i- znzS?b3)ZZ2ysz5zJ~()D?}aq&eS!!48SL0DTPHl(_Ge)^!y3j1Wp_Cm|A(in{kqEd z$bu`8i)X%!%THqAb}>;rE3o#a*dF_U3!DCOFjN^x&yoFgW!1meDSC5j*#7-KWh5g0 zHm_J$|9h~{{6a=0r9&n&tJ8nh`97L=X2Cz-9Y6OhejE2%?%@IEaG3+~_qdi>UE0PW zFR%3OU024_b&3%|!JB&%&Rr_vV|pd|L-2r=LG+9b{j6HfIf~Vy3%{^UF_y3pZs}%Z zxqnSBP;Z9*RfSIqi!a(7OFH@Au{WW*{QVvtgF6NcG&xwog?{0mqleUlX0FQ+|&*o*z3{#{w+~{8ZMrL8bQSA#SCM^+V ztB_{Auk8|jFeTM><<-|ETg%#&yI2-EPEnd+EONnu$!NjCQWnO3ekqgUkA1T1<;(1D zJvV45P58reC{EyePUcn@O$8qJ>ebg>to#12mt$G3|AEnSpJ0NMz`EIGdUDlI)|y>k zwJK}lkGby)im$2oK3liKVuk0O`$EzW4}3P(wqE;n*Pkz0IU4-Ocdu?f>-|3b#PO{; z7a!_z8svVzP}`Dlj&XtOe@AIXZ&{!9rngpwmpnSNSNuR412@Bk1y|M>a$W9aNih_- zc+i&7^-u$&e0W&M8^$^Nzwhi0n852G%6P1+?A-T^pMOg^qoR5%|NcDB@LWZOx8~7~ z7q=4M{%N~bxSC;&)U=Y@_h&oJl4Euhbq3#^YXw6C{o*nGL^d&-V{bA`qidFR%8?K&j(ks_GdHZyxXeVanV9s z@PMk;lgo0eyH9^I&lI`+-QZGa$0v`CTOS1a|2E27Iiq~b4wL_NVHGwFnGHmYLI=}`c!o(w_JAE6cMJs ztqfPg!z5GkY$phDtWj>42nvb%;NbpF(2FKE(pk3_45o;-nzI&D4(*75@k4?V({oxvu>;Gc6b!^=$ zG3&~TNWUm0rUKR;N5}n4Y2s$aSHAwfdD2I?Ywgd-+o#3ed{GOyxbDv>q3nOTU5A7j z-vn#gpABHy&z0NtQMpz5O!h<_kyNoQM%PqIB%l8l+jDQ(RuvUh+jVYgs!v(7b99a| zMBM+i)XL#!^U+UHE4OddE`PgAtl>BBOzXx*A;zaYN!fLM+v^HIBcZO>Sp7LQlo@gY zHIF`Sc@e?VWPane;zQHN-DS__>TI%Jx@Aj3_(s$JZb|b5#lk|1{=8=L@$28{cKkmo{cC1op8fg3J>^S{mD}GOd@}Lf+=8CYf&~x0#qKCru}!-;>cML} zp+LPg4U8REtoU{yy~@8S!KzmZ3;9eSE|#CYip|Lk18wPM*CEYqh<7Y|!0@tFlQ$(r0X$LZBP zi@q$b%vr0FY|IzT&z@b9_MR_bi>raPdC}*s4APSfHypm)mwK&s#md61E=Ru$FpAF& zYi=#p`cVJOwxj>+yMtXEJMw%)?S5uUzMENd;dRA6g-csSHLr5;2R`tc|Kph3UNiTM z+9p5U%UAzixV?T;#Jww5O3r1ST^k_tNGjtpL$s()>ebVX6wW8j z@U2~M-S-%Gs`QvhZu++Z#a7FSJ`*B<-#7O+wvPupSkhNd#C^BLiV%=30vh7 zt4d!laQf1d#=daZ!RxB;-U+`xwbDgYk%`6ff2Fm|)`QvyX6T2j@?Bhe^yvEcfvVGl zb)Ht*8|}CtUR-%BiJifB&PPrYWlPJ;x#`~yGN*r6ZW9xeWccv++a=b0+20=;d$jVq zRVkfKs7t=EU}j@QL_5P(mKle9j8C8XRP$(e%GPIc!7To+-OFc5`Fz-EZTDC)f7a6S zwuA|ng{}AL9J2Q-DmuQle_M{;_gE#l4I6c2uAi6fm{b0H(ZZ9zr@rk?eYoS-&Xhf$ zBK7B+?fNDnp1mpL=+s<)SI$LYs{0RS%#mYmIvyRRo=_7Nv+IGgXi$-)_3M9K(}Keo zJC%+wWfT_~>$zMA&3nFh`}rm_Gi8S0>4p3L%br=a=9!Q|Z05E1CX#3VOU{{P8`3)? zYl2z9H3f!~t5}rlT;J~UPmj=Hz0L3^dTBwEv!}HFs&A3uG1E-^S3h9Vo3o0G_iOD- zpGyaR@U4G)W8dlanH6lt8-5&*h%ql$IQ6ak*2|U7GF%4bmHKCDDjBr+*!+J6_4J1y zV7Sg@u|o68=J=NR7nN&7LJGbIlvISYmfTtN)N}UqpH*?;8zVlI89Pq3nmbu>M|Fmh zyFvD|n)uM$ORD1+->7S|+QRgq!GmGD^^EN^c%DuABJ%n2%au2$OYm%-d&@MFl{0mZ z*TOzW@lPFI8}BTNp8Ga(O9jU&hW=pnKJ5$6$8WP`HhSm3Iwt&h>lZ=i@hk!_4`-M!tx)`nu?!QLsy9KnPL?6drxTSVn)n}!sxbxbneUlRwY*-D-tDSc@u@o>X z3(F-u^Z&9z-ca()Y#+_Y)@34}<1YtqT0Sf2%yLzgGv8brw^%XtObCyeQ|&P|BJWaC z;X(bCB7VA#uX?T?y~Y}!W!dP>)N|td{OG_y+5Bp`)m(a$FWqu$+|B*#@!QaKlDFj6 zU48iMKhJ?xvIk$z5qR4!Jez6Vm4=PqWbbZG+`(n|N3H42n%`0d55=FTcdb1+pGo7o zg2~If8z(1Zgw>pPn!Y?VXTS4@)|G1*3}jr)n?G0x@8>>rKJf0F(q$sWnN?jsT_+#3 zxj1>3y?C0PbFYEbTRD>$C&3fVQn&y1INC){RN3;jbA=I;-X6nW$*el7Chyw3SZepR zY)0b`H`qT`WT!rF_v63%BC#%&!Rs4a{@#js`#D!io=Pr^-oRxLlo;CbvGaRpMcdU` z)jSH@?`*C0?mOf%Ys<65XKy%#i{?zL1nur(U2x6w`s4*u#ZIqge0%yCZ&g^>PgBOG zM$U4^A4)zQht--ZJ*&EYa)sBuKX+0vL1It8vwi+{v1u0a%VpQjWw^4!URhB_>yOW$ z{_N-pbrlu8U9WyPF8UQwux^PlvwzJE_W05bvNuzd{}`GJPOCkry^ld*-)?!98QR(j zcc(lMN$7FWSAL_fby`12RlNV<*?)8Q7dy%J*;HhwU$Cn!e}CucmypH1Es|2A_l31% zH~-i-H7qgk-Fq8`1zY7`P4)S)V$-5Sv+_>tyFEMCt9hZ3V8eBJjy3D#rym#CsP$}( zRr{n>ZZh?cFLBMV-*D6F-Z3t2?s-jLCMUAV#a-dA=G*>P?%&@)`8PL&?>y4B332TA zxS#L1tH^50&YjT@X0O=V>JVq%`)%_NCJvb$&uSUAO%s2|{9&WmM%Fo2kA*qr{cbDu z3-t{?!7g=_Pom?6Z~gNNe9RIy=2~~+lDtgM=e;d>AhyscFmq}9^;N>ht!4Pu1gcI5 zNDjU5e}~Eek)z+G)^5JnW4LjjX!_uhQp{pgpznfv3rSNCOCtrPth@pqFY zN16Dm*Nb0CHTgC0_Rkk&%%9(I@;{S~gu!ND@ zN6Vz>J1j73N>^zxyq~h-$DO-vm);b72~uS}czbUDB{}w&Wh(^T69qf!a`TiKENYF` zuKrvb{NmTIzUMu>MT~3=vriq~_+_~mx7qCG4{t8rt2^f*D^&HPZu|SI5vR?X znY?PXlK86`W=of+#Xfk&tFtF}^A#tT-q^`~{O^Lorj;}3W$>j}-2HFtAfO;qYIZ{2 zH2msS+5de>$yfj1{QY>z^VRXk8YLsPDYEVEXL-NvRsP50ToHTEsxpQxPdgkNzfhy= z`tnsA7naH?XT5LAtk$wOuY!WojtU#NPPS}(ALVP{&skFT*Pijm(X@lSRR)*U zUus5P-(@so##IZh{QQlL92^n{3`HNY{MX`PaP0bQ{`^(eeeMl+ck`81tc`b?^Xl`< zm`t@5Mo-zDHZENxZ5Q=?i)5qwi`+|R0+|js~EF~2yaDK_D?t9M-HeYAzY3z&b zRo$=LGPNcnu*ctE$?{q1bN)OHc;u52Qgi;onwu34n`+bF#j&L-HT>@1CUnY$yVvcr zL^`wNs*?8~{)&Y?uZZVA_2lm`yZIlQ8JHX1Z*zb6 zyy)wH-O~PogjW*xv-y(k@4x?Kx?>xY*c2w6kU&?SFQJOZG!I_;bf}g^=c>}SL%Cfa zJsEeuoc3O+=djt)i%+}X`!74PD?zd`&+$R`hP0 zOWirxti==N=CEfST{l;jdxN4B#|DADeqU#-`*2l1Fk{>5{eLZUV?@sg_Z_&t%gFTJ zckP5yy)U;*QkR+wWU^HLbvxWrm-VD*)q)KdQl54+WE%->_Sd;To9Cvuz=UN-V-)s; z#l_uFwOev$>4{wm^A(pdojaZVhfCR!J^K0DMvkmCbuFnWKD=|xa(LEfcg%2^ZV{o> z5hIweFP1SoC&#VuQxFK{}jWo6T-p6Trwd5?>2i^1AA*JO@e_W$GS z{Jh$AgW9o82c0@i-!rp+%w(u`FXRp=m{n9a!t)*o}fsFtT$_q6-W?Ram`NntEZ38>h|yQ3eL746|7nl8FS}+ zTp3z2(`R#a;}0+0X9>^p{gyuZ-KU|edm}VQcL$qKI`f4s%jb)?Y_ff_j&D8J(+yIS zJJPPDExqdNln}1UuO<_y+_zt_=|*PzC)?ejKg}N)y{>=tq)LXImb%y4wH^r%t7h$&@_M?cMtD>~5`sa|*fJC%G^Aas17n3EI&U zxW4^V5ba&ym9Ms9VGJ1o8naL8v0%{i(glygnZjPJHc+#=663d>iR z{C}O4eb7{~YZA+cctHkPB?g8bmc<(v#U^fAyeChbVg3A^nT7kd8(wMP6u#2Ac*;t_ zKm%aaZm+Qv5SoV#T!N2Wqe|*m4dVZc%q}hw+SDzR1Ugc#n-*3Y(|F6v5 zXSW_k$>yDZ-9Od(%7!T~XG}c#PcUKKl?KiL0d9i|-2)vzi%f++HXW>+cR!b7O>Zyr zL7r$v!#%PbINmd0AZ9chV$U zG`!Z|(`Sy9-vQOEBV3u+G81RKDRyao9AP=<$_$e$<_}Ly+@`G^wc$;D_Q5-KR@Z&4 z!#7ucwfcXhVWp?#RH}Qu+(bT=ub<9~J$V@Qe808Y z(U)P>2M(<{G@Caz!Q|X0Z^b;fV{Zc)+I}VH+2`q7E6n~ zJ)^C?@!9|FH)hqBZZx&;%Xx8LM^EX2f5H={h{kDe^?ZHj%)EF~OmXGK)tx9|i8o#=A?7gDAPyUX?S7#?h~OFN(UcDtgq^z4t%q~o_%>z=(LFYYI^ z@aCO^``5kFk@!i*K(n}4`=yaua4q47TmTd_UBa9)XI2~$j{Hk zra%3^@y0Csl{<9oO%*jY?>J6zJ7XNxI#bJ**WW?n>P1zy^+Cy82WysJv~Zuj%X#?| zj@E*HuY>!-HT&*cuCqEdmv_swto_ZO&n?O?OsM}|=KKBs&nVy9tgO|%H}V5#d^mII zUc@Fdv1zsYD);t&3H~c?yy5?h;`s*!X6t2aR}dA;;xI6{XzP|d?fmRMBbK>)+F@$} zeuTxJUn#cBAexcsyyu=;kHxydocn&N9gmCJbs#7t?1S5C1L-qd^LY~l8QQN48~jpL zPv7>sYJKyfE{5a)A`pU<%t5k4os?&Y5<`^dF4Fbu!hO#sgmA?BCJ~=G^z8*O{>l`n`MZ?%d+n>L`u`RmS zEa_ZlXF*n{g_?}}EdwXMTq>%Rh->mCJYc4)}?IbX-DoyOy*Wmp> zzn%Q@Vxe1ZLc+y^k!)8b=f^#te(XNOhTk3DOl!1dBJ+MTedJO4FxxHpn!waYr5>rS zN0S-+u2;#ey_tCOH=Bck^lYPvdgt$ZvM9Y=`Rp^hWZuO)%>EAFr)@VBS;iO6*zs}O z_K*GtO1Al}Jo~-Xvbf6Y%jY9IBGy*;{OOC@$i&FVaA;kz)&V}*Re9yDr=qw0+a&z` zo~?Y>rEkoC7Pc=3?KBFmJ@@U!z1Z8qO|dgSHrL)?^VeePIu3(p3&ay#mP}({ZirZT zA^fH0W|Q03{k_lrlWt(&+V!5DY3J7S;hTQ!(|xJAxy|^oGi#qHXpddgxvNLsd~IKR zNaWtdtxDPd`~#jF@G&$vnlF>q`qZ#8>gv4-npgkm2wRo?ET8YTd(rDErkvmB?(8ji zsPd$2>UPEYKZ({x={DW3Ufs{1FD&@3`hnD$Gj9$^xiar6KPYMtuh3zrcelPaFjgqR z#Zmu2mlyjVhN-U{qB_%q_L(nD^A9#uyL9>N#bqL&Ym)v=pH=v`mt*VxHU`~e>eJ4B zS5G!LN^ZQG+!Tmoq(jP_T z8oAb%A8$V=KH;1GjwJ%Ss1?M|EbmAWJ(VvHSankmeR-cL0XHw zm+iCCWX0EiK@-q>xTh*#;@P||O*)q)ahugkRzB;pJ#{l0zyF==)ZATxFE(I!iG-Z?*p1EEP3B-td3Lnx&}ZGJ%;DQO?4GNrr_6H-W9#{xL@Lt(chNV zSgSYVjFwgHbb*AUPg|{h*gh9AM9oRM!o0(gW7oly6*tZstQU9?%GJHL$~7F+E3jjj zGsD8vMoTA4WwS-|!O09hOov%TW&Vgv7hPu}xoKP3hllU@BiL0ZWM8iF=@W?gXvL7O z8(by)_+@~ioT22V`{^Irb!P3`5OHr!S?RJXS0rm$zFh7&8p{*5c%RS9u>9g*4}(+I zo;6+Sa-Zpthv+k#nHPO3)TbQTXwv+XoAFm%;;m)Mw&WO<xtNBbSF`@NMY5Q~#%T}gl>FsOEDzty1nenLc-+HxfBw`Jr)$I>oG(e_czZK+ zX$eDu0OLZ_!vYfQ7R+S7NPl@$hVpIG6`9xJhk$}YUmXK6ogYK@P_e|p14z}(DOBK%?ze1aQ!>qn7lvc;|dqq$2;`R%Xb#t z)-l?>KtQ_q#*?D&dd#n0hgM4OK5Zh!xY+IV?N29ydEVdeh&y;nPsg&9VgBdEpWGis zsRe%% zFy*gigkR5j1CbZJUhRs@Kig;SjWRoUa9LULX5RhpzU=tE<$kZM{_&e`=Zk+AyzKr| z7E;&wn8hch$-QpVuWRP#TX(JAT)oDo_#0n?Y=8kvUizBb^85TfX3RV!5zl(S)b@JH zAxpb=C)OS=j_Q8D={7^f1KkL->lx?1tyr`=*HWL+c$-{FaRh(P>$HZRDfB2T1EZqEa%j0@=y#va^8=O_WU$bW9F+ccnR#!=JT}o=rzr{D_ zJXO5zWu?9{KW&P_t^Mo*t4efYLoOXUT5k0_X|d{Sbv`@ZhTzoXJ4}b27OQ4&yOg-Y zN&57*I}d|ioS)6N^`_Mc;UB-MlE0L`+NZN%i*B^5>ejhG>91<~ zAIXXX-x>MV7|hC+547S7&s1hi<`dp9X_A-B4SnCx8q=zRTNO*419W>C?if1#e0zLP zu-_Z20vT_XLvGu^K-*<%Ma|;f3EZH^7{LG4;1ab)VSl6E9Z=hLA!+y z92E`L-%xfoFOn&!`OB9I9>4b$D|_E1gcQjxa+>;I%3Q=UwCT{pvRA}=;G{FBk( zEY{qup%K8=^t!l6OyfW63MMx1Ytac691XW)-4YJ4?H2ejWlFLX*CzYN54Ia0;H`g= zQrs){*Ti2-@=1?b*nw%c=SH$dZ_m?zQ+EDl*}e-`GKHt`IZk~id2{L2qLUKcb6?&* zxyzM_jls?P+wPvtyBA*AHbdCv-L`2jZ!C(Bjp1szJ##_%! zd7Y<-`pJtLA}P1(~Y`A}PA!3UQnczR&MvNfy{M$Ln5g z=qdcV=8NIB6QRL{ZM=8?eyEN9bf&w=<)9Ud%zUS}s}Jz}?|OCp{j_s;s!GD@9xhtE z@2jrzxjLIGIp&+Wn|B}1J?@=p%=r1^>PUX|ZHnRR3L?zT3TY5NP>dfTR zQ~4Mf3U)@A+4JE#8EjXL_=d$C%rj*qk^R)IWWM_x$uXC38v6z8tY9G6U z@#7ikk8hD0dD_X~*rpdB_7XqP=Py>_GPrG_hNYRkmaY-<)@ zO4L|Y-ob0m8|c6HeDiS`^#rBhEkQe1N%+0!?wR&xzm)DT3x_>S2cmnD)t5v{TC+Ux zE#NVW`l1}QUHbMew{uD=GggI&-^(2#U8&d^4kE@aY?BkNvTU)se-MZ^$$!H&#J9YN&#JLA2ecd-bKiB5*j3Wp3 zGbmi&*4E1?EpeknezyPp&7Lm`XFe;6eyj6VXM1z19^>)&+tLc=+XZ&lojv?Pkaej8hsH3do2}+$qzzh7ba*@CU9DQ7;dTDv8b>BICSn>_JJpSi_XzD+PJ3|{Ph{^B%|c`uTglV%)9 zwiGyNah*v=BH`YHJMuhc3|o5^#YlHU69sqN)%kHv{L;*IeZ>`1bpogFZtCo7k<{)!-?Z%kM}&r-?E2m-1`g8O@TnL$0Na$ zr|=z4H7e;{<+bnCY?d{*#h-kz$k7uez$l1T~^2b0}>ym+s_TO>iJx=*;?YOZ(n_yfJFSe4~mbR z-tcj<-`0K@(IT)&;`sZt8OlZI3$Md=15 zi>!TIIqz5+W8~~ZGWI6|QVg!=O|@5g)N^FV%Igd#CgeDrtDl;q@3)@*x78f>_VPMc z>>p3mPVD#BaZcG#HS3bR{?|k5(ue0(&q&N#q*pv=kDy?>$`LNT8W%gaWj3mFMG!7Q6CXbP|D|o~(Zct~H#0G=c`0w5yQ3#@WmwLeD{_BJFXsn2%QPJjJJ31%+PTMk zw-*aKb?h#%VlsFQN7jP0;`trnKM@8rFnG*F94!iG8=_U)K{Z26)+MgRRYlY=(9+}*OD z`OU=5`+dYDt2Jy?=Kf?;d9!w<<)cluPgP={U1oUZVWpA2+LyIE<^4_%4#jns7P72a zl@(tb;jv3US>ox7n{#Y`?)bbe`@!qmdF!49USfMaVb-$4=V$XR+8Jq^zG9A`WX|C~ zXM#U`408Xpqbgq@tzMM#-d5Q)`<_nyZ9hdz&D6W+^c>D({|XQ0|87WJGyPb)Tg8in z^#>jtY+t>K??l;FQ?s(H{Ts znBC^F$k0yOYPNXOCcfn3OUtb+%0+}Pb0;6;JN7NUC@}V|TyD1n^FPa_9G!cwUi5sl zIo`>z+*QTp-qXj$a!jDSMR;?`RQNG=on)Vd>K9 zS%(i_%4Ya;^5W)7cmISB39`SAet8vA@J`FdMqvA0L!sq<({>(hZP~qU&7moQlfLM` z70Tv5JV$hT;=}%jZ`aj)?c#B)a%1Wfx6+%M*uG)cqOAIbQwmpk2Hoii(Myn>lfB?I ztHM;ne-4{NYm{tsYCR${s$9-b=y~>O)eoZw9hXnf*VLT6_i&S2jI`jSe;L7(SEMHd zGq#j{T7S__?_PXdsY5OA4o<}-+*Z4f91tqKyq)2Xlso^ocd~7!_Gerj9LlZv?`Hkn zwD!mC*YS%s2FkAX7VqNAK4`8l(>#B>O1I+NvL{RU<9;nN_gP+htM*;jL(huxdxtsr zz8$`*JkL2a^mljk9B$!H++w*?jKa2h_{_P)ZuWLP!<-j>_w3kA3JjDjc;+k&V9*yk zc#b1RWXFL&QPM)2?H+V6O{n>1zkc1h*DaxL-EpUa#99OvaruR8%Mlh=I3ti~&#}P0 znqN#j{J~oDeTQDxS8tdcymR}>^7!sAJuEigzc4+KwOv?Z@mx^i`2BabYcoEDW?y~q znD=4CE>o7WkC*KEGfbG$&dlmqK5r+lRByxku(u^MY8V^ZZu)sku8&etO=bHewvFvU ztlvI{2Ie{jd7id|YrbAjc<`WS>p!OF|K0~(U8G?1@KYqG;t^J>J*<^}kx%!1`f#B{ zx8Y*nJljdtGAB>|6<8kpCT!25Lx-3Ouiw3X==yc`>hBVX+qHM!DmnLMgU9Z*a(w@B>D5&W zH|_g7pHc0eg~;l#^Oo|IiuZ+*GW`fqmOokb-wMM)3h zCC)~APw8tGaC&m-X?7atMq@XQrX8|=D#hXPlbc$9r7Lge1E4k zW%~6UHUA9it*8B8DlnaO`;L@-R;wFwEB{4I7H-jX|1)>j-5a~hCF1Jd-s|4QbK|X2 z-oA&X5oeC_9T$+0pP7E{-o=*(LNx--{{}YHFDQ}O^yo(X^(A|Et;ld}zO+!lsUyZ} zFKeZr>(zae1s66iW-z;Qar5#1>4)y`XKzbUDJhNGeoW%<)8?eY?|T;?uylX-&}n+E zH&@T&yDMEi`lhXw5n))c!>jv!ag#xQEKA&fE1}nXEDs}AZa=&$E@~~?<#fLzzdy@6 zUTWAU{`cpn_1lu3cD?m;IZ$U9@uk>Wa$lA!%aZv`Y>yc#Ue(oYJaCkgReh7!RK6Ag zrza{WgQobIYe#V3PP8bL_FjGU!R7Pw-H%=P7v%F+&~L8J;p+G64t-x;esW&NS()&@ z<@r;}UT<6&=}Wp@LMuO%*JR%{UnpYX*XEGXugy~W|r=WMK1lo`GES1?B9 zPA_+yyDjyzqKca9;_~+f)6d?NbafRy5w}I|{+c^|w{E#DJv`C(|G&VBKPNqB7#JRY zxbuMR?%o+i_w5zB`iiwCKCTLGtZNP_TooDg=S%0D&pA83Pg~Micqd2Wg7g$n)Wx`7 zdZTVucjH;wY70RJdH3^T;^7N+?UGyUw%kk7X}6QppThgL`HGniCcj+Dcb(k)hKaeh z@a+o6iiA@UF5i0{JUyqn-&K&c(h=0(V<^w_ulp@+ z`f$$U2aQaBHstYd%lUV9Wf6~;<@QPChkXwhyj|h=;p5962mhR(o_FYu<$UYkKib{8 z|83;+e-!wP<8NszztIM92A%+`S=$WSbQk$nsO&G8cvz~bMc~oO6zvmJC8k^Q^Z0EQ z{P_9vLGjaZM-DuxD{3vCXS%xl;m+ma3=Bz0${){FZ!Y+`AY%F%-K~=*dA+$)C}O=` z{^&egw>efXe?3~opuoYiv2c3ghXmP6?J5ej9yX7J7wro9ocmr*S#Hn&`5SJ|(MpMb zmHgTB*V`ZNr^-dc*{2Ciw~Wj9E44>3R%e$EE1wM8jqab**1VtE*DByNMJ<|X+C;S4dd|SwLr=M0md`0ZGwYw-w!ELb4zI)RUp{}Y>x`uE-F+T8 zrJ=TcGM0VHJC7HBc~K~%Z_^yCemWpb&G%qEamDXSgTL z;C1|TLmej$MHewW>z?Sio&TSI*ia(dV3IyhUvJ%kbF%J*e~<8ddGT<=l8EJ;OowN@ zzVzX8|L?%a!n*#0%a)1#*-~i#?TwjItp}5n)6@H6Z~L^gvOZqusg#ZU$;2F=yWxlp zTh6kzdQKdQdB>-2UnsCzdfT#_T70YzLe$?GtA_rlyzJ<+!_N8ITMv18{T`{gU8eWn zIwdE6cCD{_l_L4?^U*XDGqc1O8(cC>y6(UDF4212%iwEc{i7EXAInyVo)>L>Hd{;U zS#&CQkAM@$#EIU*8y-E9+1UU6>FS(&voZ-df$FgPPgw z?wOHyP0)#>Fj~*|0K|vtT%%gTJJA$d}H( z0}YL}9}n-^J3Z%DOk`yH`>?l1E-I@VXy}R^JossP>Iaju-5ve*zvR~M+rtu;-Thhr ziH11q*@(@R3qAL};81K4__@=Dk-1^hrsm%1tjpJmNbZ(w2#($O`t{m~zjyU`eBQOs zxZ!a#sk?hO&&Q8@Hx?e=_xV(C%!&g=Qm6ObVOqUaGPC*d!>3E9>Z_s6%}q8ei7=SP+}th)iSCp=Jvk-6d0D&|s0MM-Uwp8Fi?;fJE4aw2x8nIBSa zO3js>a>1U9neE%rW4ym_-RZMAo+mzWv$;H|V(s{#prYn_Irn5)&F`~*HlHrkh{(PE z@GfzyMncj)*ZtmoJHR#s>o77mtXft3Rgm%J>IDbqGgw@0?kMg%JDYFOo;_mWy*|_4 zI_&YgE}hx@cw^#WyBkrr-n&M`=YuT#aQfQej^5oowJ{g`PR@-ubF|{yOV$hNYu$@C zuU)LaKH)%1&E~r8G8+Y*I264Cju!a_-9Mx8uC+HKxBJnSD_bni{C*Jl<(;fraEe1- zo}%15%k|FeN7qZwZflp{E1B6`y6NaszE`i;{wVmDrE~7yiyY^-p9>V?AN-iS(BXYe zEteCA;t}2zN{q}6j(_Dib1#{#Wh@AFj}w=YYN+4)UBE5w?!r53ox8fVKYTb-dBVDC zk@I@#IqMEjS@{^0Z!)%a>6z^c2@d9-R=bmRe$5`S)TLMF%BJns_;7p0Q31sk0skel z);#d}8ka5q{`B;ldrV&zZ1R)15an2V_EqeLtv3uyB9vGhf9ak);1KV#>#Nrst4OxR zAE#ViZ(X}f=ym;xgQrAqU$~Uithdj+ruM0}*6J}I@k`{H#qHP^@T|L62Ip8UIn z|IM2G{Wm+W$NdxudwrBOTJ~ZF3y-`Z!}fb+qU-iM-sAeeE+j0fH$Uv%flI3P3zsa} zr0r~K{Ggsk>~D3@Q8y07mK76U32oRMF)8mCx6B{j5(77Rd3~F|Z*phMvSe&hI3KV7 zy+CnZeV*c(Wsm&&1%-qfX8$W;&6`=G8g%(lN_VJU+3t?Fw~Ic0?aIBeW8dG~i~JHT zw2bQZpPaJSe-;O)VvE4nps%~@f?}S9v@7sJwBU04#Y%n0d`o7}c~y=UY6`TZ_|Ufv>>d~#b7-p;xUO6sRhWi64I z)|{N!-!?6sf2z*f=}8Wta`A1*+y+L6MR~6b3=%~xtmb%TZk4jJ$d!?+FPfC&dG?;I z+nKslO`l~-p2t3ayOwlAv{S+^iQ!VaO2UN&5kItMOb89TmiT>r<&8~G&2#RRa6ElF zNhS9A903*ry<7e+G?ijxX8Yn=l*lZ;J5-_ac%J08>^J&`>Wkp5Cj^5X;Gj4c%c_Z00 zL7<+6{kO8k4gQ0Q|2TO5ykECgqie<5T$T$}!5jDNVN+ENU7@ksF*DNC>wL)K9Xps* zmuv5?n|6Am>4is{iv#l~Rx5$RckLZDMr(D=x?e8mehM+{wX!}IsyzAQ^#41BH8l-| z+`h%91sguwyPxaz^`|E`Ry|o)#xNsy%ZvIDD*=%1%)IFhjQjIF>(~-}(vJ(Uv`Od5 zw5iXV)naisRmkmod^?}mgT?&U6Fx6%-n71By)=Xc>`I^3bno^xcl?e z>Ff=UR>yz%+Vxh$CQRw)53Pch#@Z}#7u&4@N-Y9TdS~AXZ`d4>RP)TIU=Odtiq*|u z--!0yelOAKxjnA+N6S5-mU6pumPOy5J%0W4_J+K>aVBM(Qv03DtP?*^K<2=NU_Jq=bwC@nUmoZcaKxXwus5SPv-ceN+{B~aH~rC(&Y(FKab1%pd4+^sTexWvUubA)Mpo9#FFzI~_%FDs z4@#+4cR}e~_31^1*;_vbp1XN@LPho_+kN})dAzvK?#aAJQ2xI3#oB76UHL4F79A20 z5>j{>^Yv?3NZ6HyTefherkYyR?h^Xh7X0IF03%P^WZ7Kv6oaTQ%qqMSK#qU5E0(Fu z&+Al5ezfxim2*FIJOZ58Xz$sxg@c>hrJ_Q?$tilWVXs?5y+gm*{O3yl_ik5yE@NuS zyJGd`May={nVRxW`d0je$N$;vub)+=K}IUxHD~<2SS9vZz`2hs67Sd^EH1IpDmuoN zyXfeq1yP{!gBAgQC(ax4Dk?s&HE*=;mi#f_@-Roq`+k1*!@h2t>*ii+1ZB~A%dFKU z-g^0*xl(BT+nD*ku?3r!Z2#+z`=xYm=4;5ZDz*qb>eOH?c5*uOrG)pnx$_a;IS;uQ zq?RU63gl+4Kb3Iup9j=7SI!7_UI_!$n4FJN{1fjpw7q6@(UP6qQr4V2ZKFed092V9 zXTBIf4cu zObqE62@ayn>!0+58Vauc&#q-5?BBdOcu|7>wkYW?zj-nDUL4wQqSzwfbnC-^o?rK0 V-j1q1#lXP8;OXk;vd$@?2>{s?b|?S< literal 0 HcmV?d00001