Crate heimdall_core 

Reusable sandbox runtime behavior.

Structs

AgentPolicy

Host agent socket mount policy.

ExecRequest

Structured child execution request independent from CLI parsing.

Executor

Executes sandbox requests.

FilesystemPolicy

Filesystem sandbox policy expressed as cwd-relative gitignore-style pattern lists.

Enums

EnvPolicy

Child environment filtering policy.

Error

Errors returned by sandbox runtime operations.

NetworkMode

Child network isolation policy.

ProcMode

Child proc filesystem mount policy.

StdioPolicy

Child stdio handling policy.

Constants

SANDBOX_MISCONFIGURATION_EXIT_CODE

Exit code used when the sandbox cannot be configured safely.

Functions

restrict_fs_read_universe

Apply the Landlock read-rejection universe planned by the Linux sandbox. Apply a Landlock ruleset granting the handled reads beneath each root.

validate_cwd

Validate a child working directory.

validate_filesystem_policy

Validate filesystem pattern syntax and absolute virtual file targets.

Type Aliases

Result

Result type for sandbox runtime operations.