Struct Plan 

pub struct Plan {

    pub cmd: Vec<String>,
    pub binary_path: Option<PathBuf>,
    pub env: HashMap<String, String>,
    pub stdin: Option<Vec<u8>>,
    pub cwd: String,
    pub mounts: Vec<Mount>,
    pub user_files: Vec<UserFile>,
    pub workspace_size: u64,
    pub timeout: Duration,
    pub memory_limit: u64,
    pub max_pids: u32,
    pub max_output: u64,
    pub network_blocked: bool,
    pub syscalls: Option<Syscalls>,
    pub landlock: Option<Landlock>,
}

Complete sandbox execution plan.

This is the low-level API for full control over sandbox execution. Most users should use the high-level evalbox crate instead.

Example

use evalbox_sandbox::{Plan, Mount, Executor};

let plan = Plan::new(["python3", "-c", "print('hello')"])
    .mount(Mount::ro("/usr/lib"))
    .timeout(Duration::from_secs(60))
    .memory(256 * 1024 * 1024)
    .network(false);

let output = Executor::run(plan)?;

Fields

cmd: Vec<String>

binary_path: Option<PathBuf>

Pre-resolved binary path. If set, sandbox uses this instead of resolving cmd[0]. This allows evalbox to do binary resolution before calling sandbox.

env: HashMap<String, String>

stdin: Option<Vec<u8>>

cwd: String

mounts: Vec<Mount>

user_files: Vec<UserFile>

workspace_size: u64

timeout: Duration

memory_limit: u64

max_pids: u32

max_output: u64

network_blocked: bool

syscalls: Option<Syscalls>

Custom syscall filtering configuration.

landlock: Option<Landlock>

Custom Landlock configuration.

Implementations

impl Plan

pub fn new(cmd: impl IntoIterator<Item = impl Into<String>>) -> Self

pub fn env(self, key: impl Into<String>, value: impl Into<String>) -> Self

pub fn stdin(self, data: impl Into<Vec<u8>>) -> Self

pub fn cwd(self, cwd: impl Into<String>) -> Self

pub fn mount(self, mount: Mount) -> Self

pub fn mounts(self, mounts: impl IntoIterator<Item = Mount>) -> Self

Add multiple mounts from an iterator.

pub fn binary_path(self, path: impl Into<PathBuf>) -> Self

Set pre-resolved binary path.

When set, the sandbox uses this path directly instead of resolving cmd[0]. This is used by evalbox to pre-resolve binaries before calling sandbox.

pub fn file(self, path: impl Into<String>, content: impl Into<Vec<u8>>) -> Self

pub fn executable( self, path: impl Into<String>, content: impl Into<Vec<u8>>, ) -> Self

Add an executable binary to the workspace.

pub fn timeout(self, timeout: Duration) -> Self

pub fn memory_limit(self, limit: u64) -> Self

pub fn max_pids(self, max: u32) -> Self

pub fn max_output(self, max: u64) -> Self

pub fn network_blocked(self, blocked: bool) -> Self

pub fn network(self, enabled: bool) -> Self

Enable or disable network access.

This is the inverse of network_blocked: network(true) enables network, network(false) blocks network (default).

pub fn memory(self, limit: u64) -> Self

Set memory limit (alias for memory_limit).

pub fn syscalls(self, syscalls: Syscalls) -> Self

Set custom syscall filtering configuration.

pub fn landlock(self, landlock: Landlock) -> Self

Set custom Landlock configuration.

pub fn exec(self) -> Result<Output, ExecutorError>

Execute this plan (convenience method).

Equivalent to Executor::run(self).

Trait Implementations

impl Clone for Plan

fn clone(&self) -> Plan

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Plan

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Plan

fn default() -> Self

Returns the “default value” for a type.