cuttlefish_host/lib.rs
1//! The wasmtime host: drives proc-blocks and enforces what they may reach.
2//!
3//! This crate is where the project's security boundary actually lives. The
4//! compile-time capability check in `cuttlefish-core` exists to give spec
5//! authors good error messages; the checks in [`caps`] are what a malicious or
6//! malfunctioning block actually runs into, and they fail closed.
7//!
8//! Three pieces, in the order a job meets them:
9//!
10//! - [`caps`] — what a job may reach. Deny-by-default, and canonicalizing to
11//! defeat traversal and symlink escapes.
12//! - [`handles`] — files held open on the guest's behalf, served as bounded
13//! windows so that bulk data never enters guest memory.
14//! - [`runner`] — the reactor loop: the host drives the guest one command at a
15//! time, which is what makes cancellation free and every iteration
16//! observable.
17//!
18//! Inference reaches the runner only through [`infer::InferBackend`], so the
19//! whole loop is testable with no model present.
20
21#![forbid(unsafe_code)]
22#![warn(missing_docs)]
23
24pub mod caps;
25pub mod handles;
26pub mod infer;
27pub mod runner;