Module model 

The isoloom format, version 1: what an environment looks like from outside (machines, networks, who reaches whom, the ports that answer) and, per machine, how each kind of target produces it (docker: and/or vm:).

Structs

Boot

How a VM boots, instead of the way its image does. Paths are on the hypervisor’s host (the hypervisor reads them, not Isoloom), so they are absolute. Vagrant’s libvirt provider boots every field and its QEMU provider firmware_format; the other targets refuse a machine with one.

Bridged

How a network is bridged to the host (see super::Network::bridged).

CloudServices

An environment of cloud services: a Terraform module applied into the user’s account.

Configuration

A machine’s configuration: an app’s steps (all of them install), or a catalogue entry’s phases, resolved from what the author wrote. Set by lowering, never written in a spec.

Constraints

What the network an environment runs in imposes, applied on every target: images pulled through the customer’s registry, packages through their mirrors, outbound HTTP through their proxy, time from their servers.

Controller

The controller’s settings (controller:), the fields a machine uses for the same things.

Declared

A check Isoloom runs itself. Exactly one of http, tcp, exec and script says what to check; from says where from; expect what counts as passing.

Device

A device of the host given to a container, at a path inside it.

DeviceFull

A device in full, as written.

Disk

A data disk a machine is given beside its own: on a VM, a disk of its own, formatted and mounted at boot (a raw one is left as it is); on the container targets, a volume at the mount (a claim of that size on Kubernetes). It goes with the machine.

Dns

How a machine resolves names.

DockerImpl

How a container produces a machine: an image, or one built from the project.

EnvironmentDns

The environment’s names in a private DNS zone (see super::Spec::dns).

External

An existing machine’s SSH endpoint, for the external target.

Generated

A container image Isoloom builds from a machine’s configuration (super::Configuration).

Gpus

The GPUs a machine is given. A container gets the host’s GPUs through its runtime; a VM gets them passed through by its hypervisor (Proxmox) or sized with them (a cloud’s GPU instance types).

GpusFull

gpus in full, as written (count may be a number or all).

Group

A group: the machines in it, and the fields they share.

Healthcheck

When a machine counts as healthy, besides its ports answering: a command that succeeds, or a page that answers. Each target waits for it where it waits for the machine (Compose’s depends_on and up --wait, Kubernetes’ readiness, the end of a VM’s set-up).

HttpCheck

A page a healthcheck requests, on the machine itself.

Ipv6

A network’s IPv6 side (see super::Network::ipv6).

Machine

A machine of the environment: where it sits on the networks, what it serves, and how each kind of target produces it (docker:, vm:, external:).

MachineFile

A file placed on the machine before its workload runs: a container gets it from its runtime (a Compose config, a Kubernetes ConfigMap), a VM from its set-up. On Compose, a project file with an owner or a mode is read into Compose’s environment by isoloom run and copied in.

Mirrors

Package mirrors (see Constraints::mirrors).

MountPart

A mount with its options.

Network

A network: an address block, whether it reaches the internet, and what routes it.

NetworkBoot

A network boot: what the network’s DHCP and TFTP server hand a booting machine.

NetworkDocker

A network on the Docker target.

OwnProcess

An official image’s own process: its entrypoint, and the command it runs.

Port

A port a machine answers on.

Provision

One environment-level provisioning step.

Proxy

An HTTP proxy (see Constraints::proxy).

Reach

Traffic allowed from one network to another (one way: answers come back), on some ports or all of them.

Resources

What a machine is given to run on; each left out takes its default.

SecretMount

A secret placed in a machine: which one, at what path, owned by whom, with what mode.

Shared

Fields several machines share, through common: or a group: everything about how a machine is built, nothing about what it is (its networks, ports and access stay its own).

SharedDocker

A shared docker: part: each field optional.

SharedVm

A shared vm: part: each field optional.

SharedVolume

A volume of the environment, mounted by one machine or several (see Spec::volumes): one named volume on Docker, one claim on Kubernetes (its users on its owner’s node), and on VMs the owner’s directory served over NFS to the others, mounted at their own paths. Declared here, a volume can also outlive the environment (persistent) or be one that exists already (external).

Spec

An environment spec. Field order in the file is kept (machines start in the order written).

Tc

Link impairment (Linux netem on the router’s interface into the network).

TmpfsMount

A memory-backed mount with its options.

Tool

A tool attached beside the environment. The built-in recipe shell (an empty block) is a toolbox on every network: tcpdump, nmap, curl, dig, netcat (a netshoot container on Docker, a Debian VM on local VMs). Any other name takes a container image (container targets).

Virtiofs

On Proxmox, the volume as a folder of the server, shared into each VM that mounts it (virtiofs, Proxmox VE 8.4 or later) instead of over NFS from its owner. Opt-in, because the folder lives on the server: Isoloom creates a directory mapping for it unless mapping names one made on the cluster, and the folder itself must exist on the node. Linux VMs only; every other target shares the volume as it always does.

Vlan

A VLAN of a LAN (see Network::vlans).

VmImage

A machine’s own image, per target, instead of the built-in one for its OS.

VmImpl

How a VM produces a machine: its OS, and the steps that set it up.

Enums

Appliance

A network appliance image (see DockerImpl::appliance). The images aren’t Isoloom’s to ship: the user builds them from software they are licensed for.

Arch

A machine’s CPU architecture. Every target has one: a container platform, a box architecture, a cloud instance family. Defaults to x86-64.

BaseImage

What a generated image starts from.

BootDevice

A device a VM boots from.

Check

One check: a script in the project (a string), or a declared probe (a map).

CloudProvider

A cloud an environment of cloud services deploys into.

CommandLine

A command line: a text the shell runs, or a list of arguments run as they are.

DeviceInput

A device as written: host[:guest[:permissions]], or a mapping.

Expect

What a declared check expects: an HTTP status code, or a word (any, blocked, open), or for exec the text the output must contain.

Filesystem

A data disk’s filesystem.

Firmware

The firmware a VM boots through.

FirmwareFormat

The format of a UEFI firmware file.

GpuCount

A number of GPUs, or every one the host has.

GpusInput

gpus as written: a count, all, or the full form.

Ipv6Addresses

How machines get their IPv6 address on a network.

MachineSecret

Where a machine’s secret goes: by name alone (/run/secrets/<name>, read-only, with the default mode of the machine’s kind), or with its path, owner and mode.

Mount

Where a machine mounts one of its volumes: a path, or a path and the folder of a shared volume it takes ({ path: /srv/www, subpath: www }).

Octets

A machine’s address on a network, as written: one last octet, or several (the first the primary one).

Protocol

A port’s transport protocol.

ScalarSchema

A text, a number or a boolean, read as text (environment values, sysctl values).

Seal

How strongly a machine’s offline seal holds. internet: false is enforced for every machine, but a privileged container can lift it from inside its own network namespace, so such a machine must declare seal: best-effort to acknowledge the seal is advisory for it (it is refused otherwise). Defaults to guaranteed.

SecretSource

Where the runner (isothrum up) reads a secret’s value: one store, written as a map with one key ({ env: DB_PASSWORD }). Another store is a new variant here and a reader of its own in the runtime.

Shape

The two ways a machine can be produced.

Target

Where an environment can run.

Tmpfs

A memory-backed mount: a path, or a path with a size and a mode ({ path: /run, size: 64m, mode: "1777" }).

Ulimit

A process limit (see Machine::ulimits): one value for the soft and hard limits, or both.

VirtiofsCache

How a VM caches a virtiofs folder (see Virtiofs::cache).

Winrm

How a Windows box answers WinRM. Most boxes (StefanScherer, gusztavvargadr) use plain HTTP on 5985 with basic auth; some (GOAD’s Windows Server 2025 box) only listen on HTTPS 5986. Isoloom can’t tell from the box name, so a non-default box declares it.

Constants

DEFAULT_FILE_MODE

The mode a file gets when the spec gives none: readable by everyone, written by its owner.

DEFAULT_GPU_DRIVER

The driver a machine’s GPUs use when the spec names none.

KNOWN_OS

The image table’s OS names, the ones every target maps to its own images (e.g. Windows from an evaluation ISO locally, a license-included image in the cloud). A spec writes the OS as <family>@<version> (crate::os); a parsed spec’s vm.os holds one of these names. In the order of crate::os::FAMILIES.

MAX_VIRTIOFS

The most virtiofs folders one Proxmox VM takes (the bpg provider’s limit on virtiofs).

REBOOT_STEP

The vm.provision step that restarts a Linux machine; the steps after it run once the machine is back.

SECRETS_DIR

Where secrets go when a machine names no path.

TOOL_RECIPES

Built-in tool recipes.

ULIMITS

The process limits Linux knows (ulimit, limits.conf, systemd’s Limit*).

Functions

after_drive

The path after its drive (\app\db of C:\app\db), when p is an absolute Windows path on a drive.

is_drive_path

Whether p is an absolute Windows path on a drive (C:\app\db, C:/app/db).

is_reboot

Whether a vm.provision step is the REBOOT_STEP rather than a file.

mapping_id

Whether id can name a Proxmox directory mapping: a letter, then letters, digits, - and _ (Proxmox’s configuration ids), at most 64.

seconds

Seconds in a duration written <number><unit>, one or more times (90s, 1m30s, 2h): units h, m and s. None when it isn’t one.

secret_variable

The environment variable a secret’s value is handed over in, to the tool that delivers it (ISOLOOM_SECRET_DB_PASSWORD for db-password). Secret names are kebab-case, so two secrets never share one.