Struct SandboxPolicy 

pub struct SandboxPolicy {
    pub max_memory_mb: u64,
    pub max_cpu_secs: u64,
    pub max_procs: u32,
    pub max_open_fds: u32,
    pub max_file_sz_mb: u64,
    pub network: NetworkMode,
    pub extra_fs_read: Vec<PathBuf>,
    pub extra_fs_write: Vec<PathBuf>,
    pub extra_env: Vec<String>,
    pub strict: bool,
    pub session_workdir: Option<PathBuf>,
}

Policy applied to a sandboxed process.

Fields

max_memory_mb: u64

Address-space cap in MB where resource limits are supported.

max_cpu_secs: u64

CPU-time cap in seconds where resource limits are supported.

max_procs: u32

Child process cap where resource limits are supported.

max_open_fds: u32

Open file descriptor cap where resource limits are supported.

max_file_sz_mb: u64

Maximum file size in MB where resource limits are supported.

network: NetworkMode

Network access granted to sandboxed subprocesses.

extra_fs_read: Vec<PathBuf>

Additional filesystem paths the sandboxed process may read. Appended to the built-in system allowlist.

extra_fs_write: Vec<PathBuf>

Additional filesystem paths the sandboxed process may read and write. Appended to the per-session workdir.

extra_env: Vec<String>

Additional environment variable names allowed through the env scrub. Appended to the built-in allowlist (PATH, LANG, …). Names only, values come from the parent process’s environment.

strict: bool

When true, missing requested layers become hard errors.

session_workdir: Option<PathBuf>

Per-session writable directory. Filled in by the caller right before harden().

Trait Implementations

impl Clone for SandboxPolicy

fn clone(&self) -> SandboxPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for SandboxPolicy

fn default() -> SandboxPolicy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxPolicy

fn deserialize<__D>( __deserializer: __D, ) -> Result<SandboxPolicy, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxPolicy

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.