Struct SecurityConfig 

pub struct SecurityConfig {
    pub strict_policy: bool,
    pub disable_policy: bool,
    pub disable_suffix: bool,
    pub allowed_directories: Vec<String>,
    pub encryption: bool,
    pub encryption_key_path: Option<String>,
    pub sandbox_backend: String,
    pub sandbox_image: Option<String>,
    pub sandbox_memory: Option<String>,
}

Fields

strict_policy: bool

Abort agent startup on tamper or suspicious content (default: false).

When true, TamperDetected and SuspiciousContent are fatal errors that prevent the agent from starting. When false (default), the agent warns and falls back to hardcoded-only security.

disable_policy: bool

Skip loading and injecting the LocalGPT.md workspace security policy (default: false).

When true, the user’s signed LocalGPT.md content is not loaded or injected into the context window. The hardcoded security suffix still applies unless [disable_suffix] is also set.

disable_suffix: bool

Skip injecting the hardcoded security suffix (default: false).

The suffix is a compiled-in reminder that tells the model to treat tool outputs and retrieved content as data, not instructions. When disabled, the user policy (if any) still applies.

Warning: Setting both disable_policy and disable_suffix to true removes all end-of-context security reinforcement. The system prompt safety section still exists, but may lose effectiveness in long sessions due to attention decay (“lost in the middle” effect).

allowed_directories: Vec<String>

Restrict file tools to these directories (empty = unrestricted). Paths are canonicalized at startup. Symlinks are resolved before checking.

encryption: bool

Enable encryption at rest for sessions and config secrets (default: false).

encryption_key_path: Option<String>

Path to the encryption key file. Default: data_dir/encryption.key (~/.local/share/localgpt/encryption.key)

sandbox_backend: String

Container sandbox backend: “disabled” (default), “auto”, “docker”, “podman” “auto” tries Docker then Podman, falls back to kernel sandbox.

sandbox_image: Option<String>

Docker image for container sandbox (default: “ubuntu:24.04”)

sandbox_memory: Option<String>

Memory limit for sandbox container (e.g., “512m”, “1g”)

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> SecurityConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.