cuttlefish-host 0.0.2

Wasmtime host that drives cuttlefish proc-blocks and enforces capabilities
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

//! The wasmtime host: drives proc-blocks and enforces what they may reach.
//!
//! This crate is where the project's security boundary actually lives. The
//! compile-time capability check in `cuttlefish-core` exists to give spec
//! authors good error messages; the checks in [`caps`] are what a malicious or
//! malfunctioning block actually runs into, and they fail closed.
//!
//! Three pieces, in the order a job meets them:
//!
//! - [`caps`] — what a job may reach. Deny-by-default, and canonicalizing to
//!   defeat traversal and symlink escapes.
//! - [`handles`] — files held open on the guest's behalf, served as bounded
//!   windows so that bulk data never enters guest memory.
//! - [`runner`] — the reactor loop: the host drives the guest one command at a
//!   time, which is what makes cancellation free and every iteration
//!   observable.
//!
//! Inference reaches the runner only through [`infer::InferBackend`], so the
//! whole loop is testable with no model present.

#![forbid(unsafe_code)]
#![warn(missing_docs)]

pub mod caps;
pub mod handles;
pub mod infer;
pub mod runner;