bvisor 0.9.0

Sync-first boundary supervisor: platform-agnostic boundary contract (types + fail-closed planner) with real Linux (landlock/seccomp/cgroups) and Wasm (wasmi/WASI) confinement backends. ZERO OS code, ZERO BatPak writes in the Backend trait.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

//! The pure contract: types that ALWAYS compile with zero OS deps.
//!
//! Every module here is platform-agnostic. No `std::fs`, no `std::process`, no
//! `std::net`, no OS syscalls. The only host-touching code in the whole crate
//! lives in [`crate::backend::inert`] (the no-confinement reference backend),
//! never in the contract or the [`backend::Backend`] trait.

pub(crate) mod admission;
pub(crate) mod backend;
pub(crate) mod budget;
pub(crate) mod budget_witness;
pub(crate) mod canonical_policy;
pub(crate) mod capability;
pub(crate) mod events;
pub(crate) mod host_control;
pub(crate) mod ids;
pub(crate) mod lifecycle;
pub(crate) mod lowering;
pub(crate) mod plan;
pub(crate) mod primitive;
pub(crate) mod qualification;
pub(crate) mod recovery;
pub(crate) mod registry;
pub(crate) mod report;
pub(crate) mod seccomp_evidence;
pub(crate) mod secret;
pub(crate) mod support;