Struct ContainerExecutor 

pub struct ContainerExecutor { /* private fields */ }

Executor that runs CLI commands inside ephemeral Docker containers

Each invocation creates a fresh docker run --rm container with a read-only root filesystem, all capabilities dropped, and no-new-privileges enforced. A writable scratch directory is bind-mounted at /scratch for temporary files.

Implementations

impl ContainerExecutor

pub const fn new(config: ContainerConfig) -> Self

Create a new container executor with the given configuration

pub async fn execute( &self, binary_name: &str, args: &[&str], input: Option<&str>, timeout: Duration, max_output_bytes: usize, ) -> Result<CliOutput, RunnerError>

Execute a CLI command inside an ephemeral container

The container is created with security hardening flags:

• --rm to auto-remove after exit
• --read-only root filesystem
• --cap-drop=ALL to drop all Linux capabilities
• --security-opt=no-new-privileges to prevent privilege escalation
• A writable /scratch tmpfs for temporary files

If input is provided, it is written to a temp file inside the scratch mount and piped as stdin to the command.

Errors

Returns RunnerError if:

• The scratch directory cannot be created or written to
• The docker command fails to spawn or times out
• The container exits with a non-zero code

Trait Implementations

impl Clone for ContainerExecutor

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContainerExecutor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.