boxlite-cli 0.10.7

Command-line interface for BoxLite container runtime
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

[package]
name = "boxlite-cli"
version.workspace = true
edition.workspace = true
authors.workspace = true
license.workspace = true
description = "Command-line interface for BoxLite container runtime"
repository = "https://github.com/boxlite-ai/boxlite"
keywords = ["vm", "sandbox", "cli", "container", "security"]
categories = ["command-line-utilities"]
readme = "README.md"

[[bin]]
name = "boxlite"
path = "src/main.rs"

[dependencies]
boxlite = { workspace = true, features = ["rest"] }
clap = { version = "4.5", features = ["derive", "env"] }
clap_complete = "4.5"
tokio = { version = "1.37", features = ["rt", "rt-multi-thread", "macros", "signal"] }
notify = "6.1"
futures = "0.3"
term_size = "0.3"
nix = { version = "0.30.1", features = ["term", "signal"] }
anyhow = "1.0"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["fmt", "env-filter", "json"] }
tracing-appender = "0.2"

# HTTP server (serve subcommand)
async-stream = "0.3"
axum = { version = "0.8", features = ["macros", "ws"] }
# Decoding the box spelling out of a raw request path. Already resolved for this
# crate through axum and reqwest, so this adds an edge, not a new crate.
percent-encoding = "2"
base64 = "0.22"
tar = "0.4"
tempfile = "3"
tower-http = { version = "0.6", features = [
    "cors",
    "trace",
    "request-id",  # SetRequestIdLayer + PropagateRequestIdLayer for X-Request-Id
    "catch-panic", # CatchPanicLayer turns handler panics into 500 with our envelope
] }

# Serialization (aligned with core boxlite)
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
serde_yaml = "0.9"

# Runtime extraction
dirs = "6.0"
ulid = "1.1"
tabled = "0.17"
chrono = { version = "0.4.43", features = ["serde"] }
comfy-table = "7.2.1"

# Credentials store (auth login/logout/status)
rpassword = "7"
toml = "0.8"
secrecy = { version = "0.10", features = ["serde"] }

# OIDC / browser-based login for the apps/api control plane
# `accept-rfc3339-timestamps` enables lenient parsing of ID-token timestamp
# claims (`updated_at`, `auth_time`) when the IdP returns ISO-8601 strings
# instead of the OIDC-spec-required Unix seconds. Auth0 famously returns
# `updated_at` as a string (`"2026-05-21T01:46:18.164Z"`), breaking
# spec-strict clients; the flag is gated off by default but the maintainer
# added it specifically for this case (openidconnect-rs PR #55).
openidconnect = { version = "4", default-features = false, features = ["reqwest", "rustls-tls", "accept-rfc3339-timestamps"] }
webbrowser = "1"
dialoguer = "0.11"
reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
url = "2"

gtmpl = "0.7"
gtmpl_value = "0.5"
[build-dependencies]

[dev-dependencies]
boxlite = { workspace = true, features = ["rest", "test-support"] }
boxlite-test-utils = { path = "../test-utils" }
assert_cmd = "2.1.1"
predicates = "3.1.3"
rstest = "0.21"
socket2 = "0.6"
tempfile = "3.24.0"
# A WebSocket client, to drive `run_attach_session` over a real socket. Already
# resolved and compiled for this crate — axum pulls the same 0.29 for the server
# half — so this line adds a test-only path to it, not a new dependency.
tokio-tungstenite = "0.29"

[package.metadata.binstall]
pkg-url = "{ repo }/releases/download/v{ version }/boxlite-cli-v{ version }-{ target }.tar.gz"
bin-dir = "{ bin }{ binary-ext }"
pkg-fmt = "tgz"