Enum Resource 

#[non_exhaustive]
pub enum Resource {
    AddressSpace,
    CoreDump,
    CpuTime,
    Data,
    FileSize,
    LockedMemory,
    OpenFiles,
    PendingSignals,
    Processes,
    Stack,
}

A per-process resource whose limit the launch sets on the command.

Each variant names the kernel’s RLIMIT_* resource it sets and the unit its values are counted in. Two carry sandbox-specific caveats:

• Processes is the kernel’s RLIMIT_NPROC, which counts processes per real user id across the whole system, not per namespace or per sandbox. Under the single-identity map the command’s real uid outside the sandbox is the calling user’s, so the limit counts the caller’s other processes too, and the cap is a ceiling on the pair rather than on the sandbox alone. A range identity map gives the sandbox distinct host ids, so the count is the sandbox’s own.
• AddressSpace counts mapped address space, not resident memory, so a command that maps far more than it touches — many runtimes and allocators do — hits it long before its real memory use approaches the value.

The kebab-case spelling of each variant is the name a profile’s [rlimit] table and the command line’s --rlimit flag both use: address-space, cpu-time, open-files, and so on.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

AddressSpace

RLIMIT_AS: the total mapped address space, in bytes.

CoreDump

RLIMIT_CORE: the size of a core dump, in bytes.

CpuTime

RLIMIT_CPU: CPU time consumed, in seconds. Exceeding the soft limit raises SIGXCPU; exceeding the hard limit is fatal.

Data

RLIMIT_DATA: the data segment — the heap and anonymous mappings — in bytes.

FileSize

RLIMIT_FSIZE: the largest file the command may create, in bytes. A write beyond it raises SIGXFSZ.

LockedMemory

RLIMIT_MEMLOCK: memory that may be locked into RAM, in bytes.

OpenFiles

RLIMIT_NOFILE: one greater than the highest file descriptor the command may open.

PendingSignals

RLIMIT_SIGPENDING: signals that may be queued for the command’s real user id.

Processes

RLIMIT_NPROC: processes and threads for the command’s real user id. The fork-bomb ceiling; see the caveat above.

Stack

RLIMIT_STACK: the main thread’s stack, in bytes.

Implementations

impl Resource

pub const ALL: &'static [Resource]

Every resource a limit can be set on, in the order they are documented.

The roster grows as the kernel’s does, so this is a slice rather than a fixed-length array: a consumer that presents the resources — a help text, a form, a completion script — picks up an addition without a change. Pair it with spelling for the names a profile and the command line accept.

pub fn spelling(self) -> &'static str

The name a profile’s [rlimit] table and the --rlimit flag spell this resource with: the kebab-case form of the variant.

Distinct from Display, which renders the kernel’s own RLIMIT_* name because that is what an error about the kernel’s refusal should say.

Trait Implementations

impl Clone for Resource

fn clone(&self) -> Resource

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Resource

impl Debug for Resource

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Resource

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for Resource

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Resource

impl Hash for Resource

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for Resource

fn cmp(&self, other: &Resource) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for Resource

fn eq(&self, other: &Resource) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for Resource

fn partial_cmp(&self, other: &Resource) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for Resource

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Resource