Crate capsule_runtime 

Re-exports

pub use containment::check_containment_floor;

pub use containment::containment_shortfall_reason;

pub use containment::detect_achieved_containment;

pub use containment::detect_sealed_blocker;

pub use containment::explain_scope;

pub use containment::ScopeReport;

pub use network_namespace::check_egress_namespace;

pub use network_namespace::detect_egress_namespace_blocker;

pub use network_namespace::skip_without_egress_namespace;

pub use network_namespace::EgressNamespaceBlocker;

pub use sealed::SealedBlocker;

pub use errors::RuntimeError;

pub use errors::UnreachableEntrypoint;

pub use limits::ExecutionLimits;

pub use resources::HostResourceLimits;

pub use runtime::launch_session;

pub use runtime::stage_session;

pub use runtime::warn_on_interpreter_runtime_grants;

pub use runtime::warn_on_workdir_exec;

pub use staged_runtime::check_staged_runtime_floor;

pub use types::capability_policy_from_runtime_manifest;

pub use types::ArtifactRequest;

pub use types::CapabilityPolicy;

pub use types::InstalledArtifactSummary;

pub use types::LaunchResult;

pub use types::LockExpectation;

pub use types::ResolvedLockArtifact;

pub use types::StageRequest;

pub use types::StagedSession;

Modules

artifact

bindings

containment

Containment classes: what an operator declares versus what a host actually achieves.

errors

limits

Per-guest execution limits: epoch-based deadlines and store resource caps.

network_namespace

The capsule’s own network namespace: the structural half of the mechanism that replaced the seccomp-notify connect/sendto supervisor.

plan

resources

Host-process resource bounds for every native subprocess this runtime spawns.

runtime

sealed

The sealed containment mechanism: a private mount namespace pivoted onto a composed root.

security

Process-level hardening against the /proc/<pid>/environ side channel.

staged_runtime

capabilities.shell.staged_runtime: staging a pinned host runtime tree into a capsule root.

types

Structs

LifecycleConfig

LifecycleOverride

Lifecycle override: allows a parent (mur-roost) or CLI flag to constrain the lifecycle down from what the manifest declares.

ToolchainHelperWarning

One compiler driver whose helper subprocess has no Execute-carrying grant under sealed.

Enums

AfterTask

TaskAcceptance

Functions

cgroup_delegation_available

Whether this host can hand the runtime a delegated cgroup v2 scope — the precondition [prepare_scope] fails closed on.

check_interpreted_entrypoints_reachable

Refuses a sealed capsule whose capabilities.shell.allow names a script that nothing declared could make importable inside the composed root.

skip_without_host_support

Whether a test that launches a subprocess-capable capsule must stand down on this host, printing the blocker when it must.

warn_on_unreachable_toolchain_helpers

Warns (W-SEC-012, non-fatal, once per uncovered helper) when a sealed capsule allowlists a known compiler driver whose helper binaries have no grant carrying the Landlock Execute right. Returns what it warned about so the decision is assertable without capturing stderr.