Module workdir_snapshot 

Copying a delegating capsule’s work folder into a delegated child’s own, before the child process starts.

A parent lists a sub-capsule under capabilities.spawn.workdir_snapshot, and every delegation to it starts the child in a work folder that already holds a copy of the parent’s as it stood at that moment. The parent’s folder is the read-only side — the child is never handed any path to it — and the child’s own folder is the writable layer. A copy rather than a mount, because a containment class is installed on the shell-subprocess tree only while WASM tools and the runtime read the work folder from the host mount namespace: one copied folder is the same folder to every reader, on every tier and platform.

The walk

Every read of the source and every write of the destination is relative to a held directory descriptor, and no symbolic link is followed on either side:

Entry	Copied as
Regular file	Its content, its rwx bits for user, group and other, and its modification time. Setuid, setgid and sticky are dropped.
Directory	Recreated with its rwx bits; its modification time is set after its contents.
Symbolic link	Recreated, never followed. An absolute target inside the source is re-pointed at the same place in the destination; every other target is copied verbatim.
FIFO, socket, device node	Not copied: SkipReason::Fifo, SkipReason::Socket, SkipReason::Device.
An entry the runtime cannot open	Not copied: SkipReason::Unreadable.
A top-level runtime write ([crate::workdir_writes::runtime_writes])	Not copied: SkipReason::RuntimeOwned.
A directory whose (st_dev, st_ino) is excluded, or is the destination itself	Not entered: SkipReason::RuntimeOwned.

The exclusion by identity is what stops the copy recursing into itself when the parent’s runtime or records directory, and with it the child’s new directory, lies inside the work folder — an advisory-capped launch.

The ceiling

The bytes of every copied regular file count against the child’s own capabilities.resources.workdir_max_bytes. Crossing it stops the copy with SnapshotError::Ceiling; so does any write that fails. The caller removes the partial destination and starts no process.

Structs

ParentWorkdirReport

The child’s session_start.effective_grants.parent_workdir: the snapshot it started with, and what keeps its commands off the parent’s real folder on the tier it applies.

SkippedEntry

One entry of the source the copy left out.

SnapshotLimits

What copy_workdir is told beyond its two roots.

WorkdirSnapshot

What one copy of a parent’s work folder put into a child’s: the parent’s delegation_start.workdir_snapshot, and what the child is told through mur run --parent-workdir-snapshot.

Enums

SkipReason

Why an entry of the source was not copied.

SnapshotError

Why a copy stopped. Either way the destination holds a partial copy the caller removes.

Constants

SKIPPED_SAMPLE_LIMIT

How many skipped entries a WorkdirSnapshot names; WorkdirSnapshot::skipped_count is the total.

Functions

copy_workdir

Copies source into the empty destination by the walk, bounded by limits.max_bytes, and reports what it copied.