Struct SandboxConfig 

pub struct SandboxConfig {
    pub kind: Backend,
    pub network: bool,
    pub writable: Vec<PathBuf>,
    pub readable: Vec<PathBuf>,
    pub env: Vec<String>,
    pub image: String,
    pub memory_mb: Option<u64>,
    pub cpus: Option<f64>,
}

Fields

kind: Backend

network: bool

Let confined commands reach the network.

Off by default, and this is the single most valuable line in the file: with it off, shell stops being an exfiltration route, which is what lets the trifecta interlock relax rather than tighten.

writable: Vec<PathBuf>

Extra paths mounted writable, on top of the workspace.

readable: Vec<PathBuf>

Extra paths mounted read-only. Use for a toolchain or a cache that lives outside the workspace.

env: Vec<String>

Environment variables passed through by name. Nothing else survives — an allowlist, because the interesting variables are the secret ones.

image: String

Container image for the docker backend.

memory_mb: Option<u64>

Memory ceiling in megabytes (docker only).

cpus: Option<f64>

CPU ceiling (docker only), e.g. 2.0.

Trait Implementations

impl Clone for SandboxConfig

fn clone(&self) -> SandboxConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxConfig

where SandboxConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.