Module child_launch 

Launching a delegated child as an operating-system process of the parent’s own runtime.

The daemon referees and hands back an approval; this is what turns that approval into a running capsule. The parent’s runtime composes a directory for the child beneath its own accessible workdir, builds the child’s environment from the child’s declaration rather than its own, and starts the mur binary as a subprocess. The child’s runtime registers with the daemon for itself (see crate::registration), so the parent never states what the child holds — it only names which artifact is running.

Three properties fall out of the child being a process rather than a thread:

• A daemon crash takes no child with it. Nothing the child needs to keep running lives in the daemon’s address space.
• Each child has its own process environment and working directory, so a native subprocess started by one child inherits nothing a sibling shares.
• A child that declares the sealed containment floor enters a mount namespace of its own, because the containment machinery installs per process and the child is a process.

The approval travels on the child’s standard input. Not on the argument vector and not in the environment: both are readable from /proc/<pid> by any process running as the same user, which is exactly what a sibling capsule’s shell tool is.

Structs

ChildLaunchRequest

What the parent’s runtime needs in order to start one approved child.

LaunchedChild

A running child capsule and the handles to end it.

Constants

MUR_BINARY_ENV

Environment variable naming the mur binary to launch children with.

Functions

child_workdir_for

Where a child of this parent goes: <parent accessible workdir>/.murmur/children/<name>-<16 hex>.

launch_child_capsule

Create the child’s directory, start mur on it, and wait for the child to report itself.