confinery_sandbox/
lib.rs

1//! Confinery sandbox engine.
2//!
3//! A [`Sandbox`] takes a [`SandboxSpec`] (a resolved profile plus a command)
4//! and runs it under the strongest isolation the host supports, reporting
5//! which layers were applied. Each OS has its own backend; unsupported systems
6//! fall back to an implementation that refuses to run.
7
8pub mod detect;
9pub mod error;
10pub mod report;
11pub mod spec;
12
13mod common;
14
15#[cfg(target_os = "linux")]
16mod linux;
17#[cfg(not(any(target_os = "linux", windows)))]
18mod unsupported;
19#[cfg(windows)]
20mod windows;
21
22use confinery_core::audit::Auditor;
23
24pub use detect::{detect, HostCapabilities};
25pub use error::{Result, SandboxError};
26pub use report::{LayerOutcome, LayerStatus, SandboxReport};
27pub use spec::SandboxSpec;
28
29/// A platform sandbox capable of running one command under isolation.
30pub trait Sandbox {
31    /// Run the command described by `spec`, emitting audit events to `auditor`.
32    fn run(&self, spec: &SandboxSpec, auditor: &mut Auditor) -> Result<SandboxReport>;
33
34    /// Human-readable backend name, e.g. `linux-namespaces`.
35    fn backend(&self) -> &'static str;
36}
37
38/// Build the sandbox backend for the current platform.
39pub fn platform_sandbox() -> Box<dyn Sandbox> {
40    #[cfg(target_os = "linux")]
41    {
42        Box::new(linux::LinuxSandbox::new())
43    }
44    #[cfg(windows)]
45    {
46        Box::new(windows::WindowsSandbox::new())
47    }
48    #[cfg(not(any(target_os = "linux", windows)))]
49    {
50        Box::new(unsupported::UnsupportedSandbox)
51    }
52}
confinery_sandbox/lib.rs

confinery_sandbox/
lib.rs
