Struct ProcessBackend 

pub struct ProcessBackend { /* private fields */ }

Subprocess-based sandbox backend.

Executes code by spawning child processes with tokio::process::Command. Enforces timeout via tokio::time::timeout and environment isolation via env_clear(). Optionally enforces filesystem and network isolation when a SandboxEnforcer is configured via with_sandbox().

Example

use adk_sandbox::{ProcessBackend, SandboxBackend};

let backend = ProcessBackend::default();
assert_eq!(backend.name(), "process");

With OS-level sandbox

use adk_sandbox::{ProcessBackend, ProcessConfig, SandboxPolicyBuilder, get_enforcer};

let enforcer = get_enforcer()?;
let policy = SandboxPolicyBuilder::new()
    .allow_read("/usr/lib")
    .allow_read_write("/tmp/work")
    .build();

let backend = ProcessBackend::with_sandbox(
    ProcessConfig::default(),
    enforcer,
    policy,
);
assert!(backend.capabilities().enforced_limits.filesystem_isolation);

Implementations

impl ProcessBackend

pub fn new(config: ProcessConfig) -> Self

Creates a new ProcessBackend with the given configuration.

pub fn with_sandbox( config: ProcessConfig, enforcer: Box<dyn SandboxEnforcer>, policy: SandboxPolicy, ) -> Self

Creates a new ProcessBackend with OS-level sandbox enforcement.

All executions through this backend will be sandboxed with the given policy. The enforcer wraps commands with platform-specific restrictions (Seatbelt on macOS, bubblewrap on Linux, AppContainer on Windows).

If different tools need different policies, create multiple ProcessBackend instances.

Trait Implementations

impl Debug for ProcessBackend

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ProcessBackend

fn default() -> Self

Returns the “default value” for a type.

impl SandboxBackend for ProcessBackend

fn name(&self) -> &str

Returns the backend name (e.g., "process", "wasm").

fn capabilities(&self) -> BackendCapabilities

Returns the capabilities and enforced limits of this backend.

fn execute<'life0, 'async_trait>( &'life0 self, request: ExecRequest, ) -> Pin<Box<dyn Future<Output = Result<ExecResult, SandboxError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Executes code in isolation according to the request parameters.