Enum MountProof 

pub enum MountProof {
    Proven,
    Failed(String),
}

Whether this host’s runtime actually shares a bind-mounted directory with the container, as opposed to accepting the -v flag and sharing nothing.

A runtime that cannot see the host path does NOT fail. Docker creates an empty directory inside its VM, mounts that, and exits 0. The declared write set then silently does not exist: a worker writes into a VM that is destroyed at teardown, and the validator judges a tree where nothing landed. Nothing in the run reports an error.

Measured on an M4 Pro (2026-08-25) with Colima 0.10.3 and Docker 29.2.1. Colima’s default mount set is the home directory alone, macOS puts TMPDIR under /var/folders, and a probe file written on the host before the run was invisible inside the container with exit code 0 throughout. The same hazard reaches any host whose daemon does not share its filesystem: Docker Desktop’s file-sharing list, a remote DOCKER_HOST, a rootless daemon in its own mount namespace.

Variants

Proven

A sentinel written on the host was read inside the container, and a sentinel written inside the container was read back on the host.

Failed(String)

The round trip did not close. Carries the operator-facing reason.

Trait Implementations

impl Clone for MountProof

fn clone(&self) -> MountProof

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MountProof

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for MountProof

impl PartialEq for MountProof

fn eq(&self, other: &MountProof) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for MountProof