capsule_runtime/
lib.rs

1// `security::harden_process_dumpable` needs one `unsafe { libc::prctl(...) }` call on Linux;
2// `#[allow(unsafe_code)]` on that item overrides this crate-level default of `deny` rather
3// than `forbid`, since `forbid` cannot be overridden by a narrower `allow` anywhere in the crate.
4#![deny(unsafe_code)]
5
6pub(crate) mod a2a;
7pub(crate) mod agent;
8pub mod artifact;
9pub mod bindings;
10pub(crate) mod cgroup;
11pub mod containment;
12pub(crate) mod egress_proxy;
13pub mod errors;
14pub(crate) mod hooks;
15pub(crate) mod identity;
16pub(crate) mod inference_import;
17pub mod limits;
18pub(crate) mod murmur_md;
19pub mod network_namespace;
20pub(crate) mod network_policy;
21pub(crate) mod otel;
22pub(crate) mod outgoing;
23pub mod plan;
24pub(crate) mod reachability;
25pub mod resources;
26pub mod runtime;
27pub(crate) mod sandbox;
28pub mod sealed;
29pub mod security;
30pub(crate) mod shell;
31pub mod staged_runtime;
32pub(crate) mod streaming;
33pub(crate) mod trace;
34pub mod types;
35
36pub use containment::{
37    check_containment_floor, containment_shortfall_reason, detect_achieved_containment,
38    detect_sealed_blocker, explain_scope, ScopeReport,
39};
40pub use network_namespace::{
41    check_egress_namespace, detect_egress_namespace_blocker, skip_without_egress_namespace,
42    EgressNamespaceBlocker,
43};
44pub use sealed::SealedBlocker;
45// `cgroup` is a private module, but the two test-support entry points below are consumed from
46// `murmur-cli`'s integration tests as well as from this crate's own, so they are re-exported here
47// rather than duplicating the delegation probe once per crate that has to skip on it.
48pub use cgroup::{cgroup_delegation_available, skip_without_host_support};
49// `reachability` is a private module, but both of its entry points are consumed from
50// `murmur-cli`'s `mur doctor` as well as from `stage_session`, so they are re-exported here — the
51// same facade shape `check_staged_runtime_floor` has, without making the module's internals
52// (`shebang_interpreter_name`, the probe, the prefix helpers) part of any crate's API.
53pub use errors::{RuntimeError, UnreachableEntrypoint};
54pub use limits::ExecutionLimits;
55pub use murmur_artifact::{AfterTask, LifecycleConfig, LifecycleOverride, TaskAcceptance};
56pub use reachability::{
57    check_interpreted_entrypoints_reachable, warn_on_unreachable_toolchain_helpers,
58    ToolchainHelperWarning,
59};
60pub use resources::HostResourceLimits;
61pub use runtime::{
62    launch_session, stage_session, warn_on_interpreter_runtime_grants, warn_on_workdir_exec,
63};
64pub use staged_runtime::check_staged_runtime_floor;
65pub use types::{
66    capability_policy_from_runtime_manifest, ArtifactRequest, CapabilityPolicy,
67    InstalledArtifactSummary, LaunchResult, LockExpectation, ResolvedLockArtifact, StageRequest,
68    StagedSession,
69};
capsule_runtime/lib.rs

capsule_runtime/
lib.rs
