Struct Sandbox 

pub struct Sandbox {
    pub id: String,
    pub code: SandboxCode,
    pub private_base_image: Option<String>,
    pub limits: Option<SandboxLimits>,
    pub egress: SandboxEgress,
    pub privileged_supervisor: Option<SandboxPrivilegedSupervisor>,
    pub lifecycle: SandboxLifecyclePolicy,
    pub preview_ports: Vec<u16>,
}

An isolated environment for running untrusted code, created at runtime.

Fields

id: String

Identifier for the sandbox. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.

code: SandboxCode

Where the sandbox’s root filesystem comes from

private_base_image: Option<String>

Private ECR base image an AWS build pulls; code.image names only the S3 bundle, so this is what the cross-account grant opens. Live only: the grant needs the customer account, which registration reports. Absent means the base image is pulled anonymously.

limits: Option<SandboxLimits>

Enforced resource ceilings.

Optional because not every platform can enforce them, and a declaration that names none takes the platform’s own defaults. Naming them on a platform that cannot enforce them is rejected at plan time rather than silently ignored.

egress: SandboxEgress

Outbound network policy

privileged_supervisor: Option<SandboxPrivilegedSupervisor>

Have Alien’s agent install the declared egress policy before running any image code. Unsupported backends refuse this at plan time.

lifecycle: SandboxLifecyclePolicy

Sandbox lifetime ceiling and idle behaviour.

Stored state written before the rename calls this session. A stack state or release that old must stay readable, otherwise its deployment can no longer be updated or deleted.

preview_ports: Vec<u16>

Ports eligible for a preview capability. An application reaches its sandbox through the provider, so it cannot widen its own ingress at runtime; a holder of a remote binding’s credentials is bounded by no port condition, which is why a remote sandbox declares none.

Implementations

impl Sandbox

pub fn new(id: String) -> SandboxBuilder

Create an instance of Sandbox using the builder syntax

impl Sandbox

pub const RESOURCE_TYPE: ResourceType

The resource type identifier for Sandbox

pub fn id(&self) -> &str

Returns the sandbox’s unique identifier.

pub fn cloud_egress(&self) -> &SandboxEgress

Cloud routing stays open when the agent owns enforcement.

pub fn supervisor_environment(&self) -> BTreeMap<String, String>

Startup contract for the privileged agent; never supplied by an exec caller.

pub fn resolved_limits(&self) -> SandboxLimits

The declared ceilings, or the defaults a platform applies when none were named.

Backends want a concrete set: a sandbox with no declared ceilings still runs inside whatever the platform gives it, and a backend that had to branch on None would end up inventing its own default anyway.

pub fn validate_for_platform(&self, platform: Platform) -> Result<()>

Validates the declaration against what the target platform can enforce.

Runs at plan time so an unenforceable limit or an unsupported egress mode fails before anything is provisioned, rather than at the first exec.

pub fn azure_image(&self) -> Result<AzureSandboxImage<'_>>

What Azure creates this sandbox from: a catalog name or a registry image, told apart by classify_azure_sandbox_image. Refused while planning, because a value the data plane rejects would otherwise surface at the first sandbox, long after the apply.

pub fn azure_sandbox_limits(&self) -> Result<()>

Checks the declared ceilings against Azure’s sizing rule (the AZURE_* constants above). Refused at plan time, like Self::microvm_tier, so a bad value is a declaration to fix rather than a runtime fault at create.

pub fn microvm_tier(&self) -> Result<MicrovmTier>

The MicroVM size that keeps every declared ceiling, or why none does.

AWS sizes are discrete and a running MicroVM bursts to four times its baseline, so the only tier that honours a ceiling is one whose peak fits inside it. A declaration no tier satisfies is refused: shipping the nearest size would give the customer a sandbox that exceeds the bound they wrote down.

Trait Implementations

impl Clone for Sandbox

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Sandbox

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Sandbox

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Sandbox

impl PartialEq for Sandbox

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl ResourceDefinition for Sandbox

fn get_resource_type(&self) -> ResourceType

Returns the resource type for this instance

fn id(&self) -> &str

Returns the unique identifier for this specific resource instance

fn get_dependencies(&self) -> Vec<ResourceRef>

Returns the list of other resources this resource depends on

fn validate_update(&self, new_config: &dyn ResourceDefinition) -> Result<()>

Validates if an update from the current configuration to a new configuration is allowed

fn as_any(&self) -> &dyn Any

Provides access to the underlying concrete type for downcasting

fn as_any_mut(&mut self) -> &mut dyn Any

Provides mutable access to the underlying concrete type for downcasting

fn box_clone(&self) -> Box<dyn ResourceDefinition>

Creates a boxed clone of this resource definition

fn resource_eq(&self, other: &dyn ResourceDefinition) -> bool

For equality comparison between resource definitions

fn to_json_value(&self) -> Result<Value>

Serialize this resource to a JSON value (without the “type” tag - that’s added by Resource)

fn get_permissions(&self) -> Option<&str>

Returns the permission profile name for this resource, if it has one.

impl Serialize for Sandbox

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Sandbox