Struct SandboxConfig 

pub struct SandboxConfig {
    pub fs_read: PathPolicy,
    pub fs_write: PathPolicy,
    pub net_outgoing: NetPolicy,
    pub net_incoming: NetPolicy,
    pub env_vars: Option<HashSet<String>>,
    pub working_dir: Option<PathBuf>,
    pub isolate_temp: bool,
}

Configuration for the sandbox environment.

Fields

fs_read: PathPolicy

Policy for filesystem read access.

fs_write: PathPolicy

Policy for filesystem write access.

net_outgoing: NetPolicy

Policy for outgoing network requests.

net_incoming: NetPolicy

Policy for incoming network connections.

env_vars: Option<HashSet<String>>

Allowed environment variable names (None = all denied).

working_dir: Option<PathBuf>

Working directory for the script.

isolate_temp: bool

Whether to isolate temp directory.

Implementations

impl SandboxConfig

pub fn locked() -> Self

Create a completely locked-down sandbox configuration.

pub fn permissive() -> Self

Create a permissive sandbox configuration (use with caution).

pub fn with_read_paths<I, P>(self, paths: I) -> Self

where I: IntoIterator<Item = P>, P: Into<PathBuf>,

Allow reading from specific paths.

pub fn with_write_paths<I, P>(self, paths: I) -> Self

where I: IntoIterator<Item = P>, P: Into<PathBuf>,

Allow writing to specific paths.

pub fn with_allowed_hosts<I, S>(self, hosts: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Allow outgoing requests to specific hosts.

pub fn with_env_vars<I, S>(self, vars: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Allow access to specific environment variables.

pub fn with_working_dir<P: Into<PathBuf>>(self, path: P) -> Self

Set the working directory.

pub fn with_temp_isolation(self) -> Self

Enable temp directory isolation.

pub fn can_read(&self, path: &Path) -> bool

Check if reading from a path is allowed.

pub fn can_write(&self, path: &Path) -> bool

Check if writing to a path is allowed.

pub fn can_connect(&self, host: &str) -> bool

Check if connecting to a host is allowed.

pub fn can_access_env(&self, name: &str) -> bool

Check if an environment variable is accessible.

Trait Implementations

impl Clone for SandboxConfig

fn clone(&self) -> SandboxConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxConfig

fn default() -> SandboxConfig

Returns the “default value” for a type.