Struct ContainerHardening 

pub struct ContainerHardening {
    pub drop_capabilities: bool,
    pub no_new_privileges: bool,
    pub read_only_rootfs: bool,
    pub pids_limit: Option<u32>,
    pub memory: Option<String>,
    pub cpus: Option<String>,
}

What ContainerRuntime asks the engine to enforce on each agent.

This is the cheap 80% of isolation: a handful of create flags that remove the capabilities an HTTP server never needs and bound what a misbehaving one can consume. It is not a sandbox against code written to escape — that would be a microVM, and it is deliberately not what this is. Until you have one, describe a container-run agent as contained, not isolated.

The defaults are the ones that cannot break a working agent. Resource limits are not among them: there is no memory ceiling that is right for every agent, and one guessed here would show up as an agent that dies under load for no visible reason. They are opt-in, per deployment (with_memory, with_cpus).

Fields

drop_capabilities: bool

Drop every Linux capability. An agent binds a port above 1024 and talks HTTP; it needs none of them.

no_new_privileges: bool

Forbid gaining privileges through setuid binaries (no-new-privileges).

read_only_rootfs: bool

Mount the root filesystem read-only where the agent’s config allows it — see [needs_writable_rootfs]. A /tmp tmpfs is mounted alongside so an agent still has scratch space.

pids_limit: Option<u32>

Cap on processes in the container.

memory: Option<String>

Memory ceiling, in the engine’s own notation ("512m", "2g"). Passed through verbatim — the engine is the authority on the format.

cpus: Option<String>

CPU allowance, in the engine’s own notation ("0.5", "2").

Implementations

impl ContainerHardening

pub fn none() -> Self

Every restriction off — containers as they were before hardening.

The escape hatch for an agent that genuinely needs what the defaults remove (a handler writing outside /tmp, an image with a setuid helper). Prefer narrowing one field of Default to reaching for this.

pub fn with_memory(self, memory: impl Into<String>) -> Self

Set the memory ceiling (engine notation, e.g. "512m").

pub fn with_cpus(self, cpus: impl Into<String>) -> Self

Set the CPU allowance (engine notation, e.g. "1.5").

Trait Implementations

impl Clone for ContainerHardening

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContainerHardening

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ContainerHardening

fn default() -> Self

Returns the “default value” for a type.