Enum Isolation 

pub enum Isolation {
    UidSplit,
    Platform,
}

How an image ends, and the isolation that ending permits.

One value rather than two, because ALIEN_SANDBOX_ISOLATION and the trailing USER describe the same decision from opposite sides: an image that asks for uid-split under a non-root USER has no privilege left to drop with, and every exec in it fails.

Variants

UidSplit

The agent starts as root and drops to the exec uid before every spawn, so a command can never rewrite its own supervisor. The image declares no USER.

Platform

The agent starts as the exec uid and supervises commands under it, which is all a runtime that refuses a root image can offer. The image ends USER <uid>:<uid>.

Implementations

impl Isolation

pub fn env_value(self) -> &'static str

The ALIEN_SANDBOX_ISOLATION value the agent parses.

Trait Implementations

impl Clone for Isolation

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Isolation

impl Debug for Isolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Isolation

impl PartialEq for Isolation

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Isolation