monty 0.0.19-beta.2

A sandboxed, snapshotable Python interpreter written in Rust.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

//! Filesystem mounting system for sandboxed execution.
//!
//! Provides [`MountTable`], which maps virtual paths to real host directories
//! with configurable access modes. When sandbox code calls filesystem methods
//! like `Path.read_text()`, the mount table intercepts the operation, resolves
//! the virtual path, and executes it according to the mount mode.
//!
//! # Security
//!
//! **The monty runtime MUST NEVER read, write, or obtain any information about
//! any file or directory outside the specific directory that is mounted.**
//!
//! Enforced by [`path_security::resolve_path`] via path canonicalization,
//! boundary checks, and symlink escape detection.
//!
//! # Mount Modes
//!
//! - [`MountMode::ReadWrite`] — full read/write access to the host directory
//! - [`MountMode::ReadOnly`] — reads work, writes raise `PermissionError`
//! - [`MountMode::OverlayMemory`] — reads fall through to host; writes stored in memory

pub use error::MountError;
pub use mount_mode::MountMode;
pub use mount_table::{Mount, MountTable};
pub use overlay_state::OverlayState;

mod common;
mod direct;
mod dispatch;
mod error;
mod mount_mode;
mod mount_table;
mod overlay;
mod overlay_state;
mod path_security;