Struct CellHandle 

pub struct CellHandle {
    pub cell_id: String,
    pub cgroup_path: Option<PathBuf>,
    pub nft_rules_applied: Option<bool>,
    pub kernel_digest_sha256: Option<String>,
    pub rootfs_digest_sha256: Option<String>,
    pub firecracker_digest_sha256: Option<String>,
}

Opaque handle to a running cell (host-specific).

Fields

cell_id: String

cgroup_path: Option<PathBuf>

Linux cgroup v2 leaf directory when the host backend created it (e.g. under CELLOS_CGROUP_PARENT). The supervisor writes the spec.run child PID to cgroup.procs after spawn (see cellos-supervisor).

nft_rules_applied: Option<bool>

Whether this backend applied nftables network enforcement during create.

Backends that own in-VM (or in-namespace) network policy use this to surface the signal to the supervisor so a network_enforcement CloudEvent can be emitted with parity to the host-subprocess path:

• Some(true) — nftables enforcement was applied (e.g. TAP+rules provisioned)
• Some(false) — backend manages networking but enforcement was disabled (e.g. enable_network: false); still report for parity
• None — backend does not own network enforcement; the supervisor’s subprocess path will surface the signal via run_cell_command

kernel_digest_sha256: Option<String>

FC-08 — verified SHA256 hex digest of the kernel image this cell booted.

Some(hex) when the backend’s pre-boot manifest verification (currently only the Firecracker backend) hashed the configured kernel artifact and it matched the manifest declaration; None for backends that do not own a manifest (stub, host-cellos host-subprocess path). The supervisor surfaces this on cell.lifecycle.v1.started so taudit can answer “which kernel bytes did this run boot?” without backend-side state.

rootfs_digest_sha256: Option<String>

FC-08 — verified SHA256 hex digest of the rootfs image this cell booted.

Same semantics as Self::kernel_digest_sha256, but for the rootfs artifact (always verified by the Firecracker backend when a manifest is present).

firecracker_digest_sha256: Option<String>

FC-08 — verified SHA256 hex digest of the firecracker binary that booted this cell.

Some(hex) only when the manifest declared a firecracker role entry (it is optional — operators may rely on signed package hashes instead); None otherwise. Backends without a manifest always emit None.

Trait Implementations

impl Clone for CellHandle

fn clone(&self) -> CellHandle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CellHandle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.