Struct ProcessBackend 

pub struct ProcessBackend { /* private fields */ }

Available on crate feature sandbox only.

Subprocess-based sandbox backend.

Executes code by spawning child processes with tokio::process::Command. Enforces timeout via tokio::time::timeout and environment isolation via env_clear(). Optionally enforces filesystem and network isolation when a SandboxEnforcer is configured via with_sandbox().

Example

use adk_sandbox::{ProcessBackend, SandboxBackend};

let backend = ProcessBackend::default();
assert_eq!(backend.name(), "process");

With OS-level sandbox

use adk_sandbox::{ProcessBackend, ProcessConfig, SandboxPolicyBuilder, get_enforcer};

let enforcer = get_enforcer()?;
let policy = SandboxPolicyBuilder::new()
    .allow_read("/usr/lib")
    .allow_read_write("/tmp/work")
    .build();

let backend = ProcessBackend::with_sandbox(
    ProcessConfig::default(),
    enforcer,
    policy,
);
assert!(backend.capabilities().enforced_limits.filesystem_isolation);

Implementations

impl ProcessBackend

pub fn new(config: ProcessConfig) -> ProcessBackend

Available on crate feature process only.

Creates a new ProcessBackend with the given configuration.

pub fn with_sandbox( config: ProcessConfig, enforcer: Box<dyn SandboxEnforcer>, policy: SandboxPolicy, ) -> ProcessBackend

Available on crate feature process only.

Creates a new ProcessBackend with OS-level sandbox enforcement.

All executions through this backend will be sandboxed with the given policy. The enforcer wraps commands with platform-specific restrictions (Seatbelt on macOS, bubblewrap on Linux, AppContainer on Windows).

If different tools need different policies, create multiple ProcessBackend instances.

Trait Implementations

impl Debug for ProcessBackend

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for ProcessBackend

fn default() -> ProcessBackend

Returns the “default value” for a type.

impl SandboxBackend for ProcessBackend

fn name(&self) -> &str

Returns the backend name (e.g., "process", "wasm").

fn capabilities(&self) -> BackendCapabilities

Returns the capabilities and enforced limits of this backend.

fn execute<'life0, 'async_trait>( &'life0 self, request: ExecRequest, ) -> Pin<Box<dyn Future<Output = Result<ExecResult, SandboxError>> + Send + 'async_trait>>

where 'life0: 'async_trait, ProcessBackend: 'async_trait,

Executes code in isolation according to the request parameters.