Struct LinuxSandboxSecurityContext 

pub struct LinuxSandboxSecurityContext {
    pub namespace_options: Option<NamespaceOption>,
    pub selinux_options: Option<SeLinuxOption>,
    pub run_as_user: Option<Int64Value>,
    pub run_as_group: Option<Int64Value>,
    pub readonly_rootfs: bool,
    pub supplemental_groups: Vec<i64>,
    pub privileged: bool,
    pub seccomp: Option<SecurityProfile>,
    pub apparmor: Option<SecurityProfile>,
    pub seccomp_profile_path: String,
}

LinuxSandboxSecurityContext holds linux security configuration that will be applied to a sandbox. Note that:

1. It does not apply to containers in the pods.
2. It may not be applicable to a PodSandbox which does not contain any running process.

Fields

namespace_options: Option<NamespaceOption>

Configurations for the sandbox’s namespaces. This will be used only if the PodSandbox uses namespace for isolation.

selinux_options: Option<SeLinuxOption>

Optional SELinux context to be applied.

run_as_user: Option<Int64Value>

UID to run sandbox processes as, when applicable.

run_as_group: Option<Int64Value>

GID to run sandbox processes as, when applicable. run_as_group should only be specified when run_as_user is specified; otherwise, the runtime MUST error.

readonly_rootfs: bool

If set, the root filesystem of the sandbox is read-only.

supplemental_groups: Vec<i64>

List of groups applied to the first process run in the sandbox, in addition to the sandbox’s primary GID.

privileged: bool

Indicates whether the sandbox will be asked to run a privileged container. If a privileged container is to be executed within it, this MUST be true. This allows a sandbox to take additional security precautions if no privileged containers are expected to be run.

seccomp: Option<SecurityProfile>

Seccomp profile for the sandbox.

apparmor: Option<SecurityProfile>

AppArmor profile for the sandbox.

seccomp_profile_path: String

👎Deprecated

Seccomp profile for the sandbox, candidate values are:

• runtime/default: the default profile for the container runtime
• unconfined: unconfined profile, ie, no seccomp sandboxing
• localhost/: the profile installed on the node. is the full path of the profile. Default: “”, which is identical with unconfined.

Trait Implementations

impl Clone for LinuxSandboxSecurityContext

fn clone(&self) -> LinuxSandboxSecurityContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LinuxSandboxSecurityContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LinuxSandboxSecurityContext

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for LinuxSandboxSecurityContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Message for LinuxSandboxSecurityContext

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode<B>(&self, buf: &mut B) -> Result<(), EncodeError>

where B: BufMut, Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited<B>(&self, buf: &mut B) -> Result<(), EncodeError>

where B: BufMut, Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode<B>(buf: B) -> Result<Self, DecodeError>

where B: Buf, Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited<B>(buf: B) -> Result<Self, DecodeError>

where B: Buf, Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge<B>(&mut self, buf: B) -> Result<(), DecodeError>

where B: Buf, Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited<B>(&mut self, buf: B) -> Result<(), DecodeError>

where B: Buf, Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl PartialEq for LinuxSandboxSecurityContext

fn eq(&self, other: &LinuxSandboxSecurityContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for LinuxSandboxSecurityContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for LinuxSandboxSecurityContext