Struct JailerConfig 

pub struct JailerConfig {
    pub uid: u32,
    pub gid: u32,
    pub chroot_base_dir: Option<String>,
    pub netns: Option<String>,
    pub new_pid_ns: bool,
    pub cgroup_version: Option<String>,
    pub parent_cgroup: Option<String>,
}

The per-VM isolation half of [firecracker.jailer].

Who the VMM runs as, where its chroot lives, which namespaces and cgroup it enters — everything IsolationSpec carries. The jailer binary and the rlimits it applies are node-wide and belong to whoever builds the adapter that spawns it; they stay in the same TOML table, read by that composer.

Fields

uid: u32

UID the Firecracker process runs as inside the jail.

gid: u32

GID the Firecracker process runs as inside the jail.

chroot_base_dir: Option<String>

Base chroot directory (default: /srv/jailer).

netns: Option<String>

Network namespace path (e.g., /var/run/netns/myns).

new_pid_ns: bool

Create a new PID namespace.

cgroup_version: Option<String>

cgroup version ("1" or "2").

parent_cgroup: Option<String>

Parent cgroup path.

Implementations

impl JailerConfig

pub const DEFAULT_CHROOT_BASE: &'static str = "/srv/jailer"

The jailer’s default chroot base, used when the config names none.

pub fn chroot_base(&self) -> &Path

The chroot base the jailer actually uses: the configured directory, or the jailer’s own default.

Trait Implementations

impl Clone for JailerConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JailerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for JailerConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for JailerConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<&JailerConfig> for IsolationSpec

fn try_from(jc: &JailerConfig) -> Result<Self, ComputerError>

Who the VMM runs as, where its chroot lives, which namespaces and cgroup it enters.

A parent_cgroup without a cgroup_version keeps the jailer’s own default, version 1, made explicit here because the spec’s CgroupSpec always names a version.

type Error = ComputerError

The type returned in the event of a conversion error.