Module guest_worker 

Guest workers: the processes a session’s WASM guests run in.

A mur run session is one supervisor process and up to three workers, one per guest kind (WorkerKind), each started only when the capsule has a guest of that kind. A worker holds the Wasmtime engine and every store of its kind and serves WASI filesystem, clocks, random, the execution limits and the wall-clock bound itself. Every other host import is a host call to the supervisor over the worker’s connection, naming the supervisor-issued call it belongs to; the supervisor answers it with the objects it registered for that call, and only while the call is in flight on that connection.

The supervisor keeps everything a guest must never hold: the trace and records, every credential gateway and its key, formation and door tokens, the cgroup scope and the session processes. No frame it sends a worker carries a key or a token.

The wire format is in [wire]: u32 little-endian length-prefixed postcard frames over one Unix socket, which a worker process holds as fd 3.

Structs

GuestWorkers

The guest workers of one session: at most one per kind, each started on first need.

RemoteLink

One guest store’s way to the supervisor: every host call it makes names the call id the supervisor issued for the call running on it, and is answered only while that call is in flight. A session-long hook instance’s link is pointed at each new call before it runs.

Enums

WorkerEntry

What mur __guest-worker … asked for.

WorkerKind

The three worker kinds. A guest is assigned by its artifact’s runtime: kind, never by the role of one call.

Constants

ENTRY

The hidden mur subcommand a worker process is started with.

PROTOCOL_VERSION

The guest-worker protocol version both sides state in the handshake.

Functions

entry_kind

The worker entry args (the whole argv) asks for, or None when this is not a worker start.

use_worker_processes

Registers that this process runs its guests in worker processes. mur calls this once before any command runs; from then on a store created outside a worker is refused.

worker_main

A worker process’s whole life. Refuses a non-empty environment and a missing connection with exit code 2; otherwise serves until Shutdown or end of file.