Crate microsandbox_types 

Shared task and wire contract types for microsandbox.

Re-exports

pub use modify::ChangeKind;

pub use modify::ConfigPlannedChange;

pub use modify::ModificationConflict;

pub use modify::ModificationDisposition;

pub use modify::ModificationPolicy;

pub use modify::ModificationWarning;

pub use modify::PlannedChange;

pub use modify::ResourceConvergenceState;

pub use modify::ResourceKind;

pub use modify::ResourceResizeStatus;

pub use modify::SandboxModificationPatch;

pub use modify::SandboxModificationPlan;

pub use modify::SecretChangeKind;

pub use modify::SecretModificationPatch;

pub use modify::SecretPlannedChange;

pub use modify::SecretSource;

Modules

modify

Sandbox modification contract shared by the SDKs, the CLI, and future backends.

Structs

CertCacheConfig

Per-domain certificate cache configuration.

CloudCreateSandboxRequest

Wire shape of a cloud sandbox create request body.

CloudCreateSandboxResponse

Wire shape of the cloud sandbox response returned by sandbox endpoints.

CloudErrorBody

Wire shape of the typed error body returned by cloud APIs on 4xx/5xx responses.

CloudErrorDetails

Nested cloud API error details.

CloudMessageResponse

Wire shape of the message response returned by mutation endpoints.

CloudNetworkSpec

Cloud network specification. Mirrors the domain NetworkSpec but omits the platform-controlled fields: interface overrides, host port mapping, DNS, TLS interception, and host-CA trust are set by the cloud, not the caller. deny_unknown_fields — posting an omitted field is an error, not a silent drop.

CloudPaginated

Wire shape of paginated list responses.

CloudSandboxResources

Cloud resource request.

CloudSandboxRuntimeOptions

Cloud guest runtime options. Mirrors SandboxRuntimeOptions but omits the platform-controlled fields: the hostname (pinned to the sandbox id) and the metrics-sampling knobs (metering integrity). deny_unknown_fields.

CloudSandboxSpec

Cloud sandbox specification carried on create routes.

DnsConfig

DNS interception and filtering settings. Carried in NetworkSpec::dns.

EnvVar

Environment variable entry.

HandoffInit

Fully-assembled handoff-init specification.

InterceptCaConfig

Certificate authority configuration for TLS interception.

InterfaceOverrides

Optional guest interface overrides. Unset fields are derived from the sandbox slot by the local network engine. Carried in NetworkSpec::interface.

MountOptions

Guest mount behavior shared by every volume mount kind.

NamedVolumeCreate

Creation metadata for sandbox-time named volume provisioning.

NetworkPolicy

Egress/ingress network policy: an ordered Rule list plus a per-direction default Action. Carried in NetworkSpec::policy.

NetworkSpec

Complete network specification for a sandbox.

OciRootfsSource

OCI root filesystem source.

PortRange

Inclusive guest-side port range for a Rule match.

PublishedPortSpec

A published port mapping between host and guest.

Rlimit

A POSIX resource limit.

Rule

A single egress/ingress policy rule. Evaluated first-match-wins per direction.

SandboxPolicy

Sandbox lifecycle policy.

SandboxResources

CPU and memory resources for a sandbox.

SandboxRuntimeOptions

Guest runtime options for a sandbox.

SandboxSpec

Backend-neutral sandbox task description.

ScopedUpstreamCaCert

A CA certificate PEM file trusted only for matching upstream hosts.

ScopedVerifyUpstream

An upstream certificate verification override for matching hosts.

SecretEntry

A single secret entry.

SecretInjection

Where in the HTTP request a secret can be injected.

SecretsConfig

Placeholder-based secret injection for a sandbox’s TLS-intercepted egress.

SnapshotSpec

Inputs to create a snapshot.

TlsConfig

TLS interception configuration. Carried in NetworkSpec::tls.

VolumeSpec

Configuration for creating a named volume.

Enums

Action

Action to take on traffic matched by a Rule (or a policy default).

CloudRootfsSource

Cloud root filesystem source.

CloudSandboxStatus

Sandbox lifecycle status returned by the cloud control plane.

Destination

Traffic destination filter for a Rule.

DestinationGroup

Pre-defined destination category for a Destination::Group match.

Direction

Direction a Rule applies to.

DiskImageFormat

Disk image format for virtio-blk root filesystems and volume mounts.

HostPattern

Host pattern for a secret allowlist.

HostPermissions

Host permission propagation policy for a virtiofs-backed volume mount.

LogSource

Source tag on a captured log entry.

NamedVolumeMode

Sandbox-time behavior for a named volume mount.

Patch

Rootfs patch applied before VM startup.

PortProtocol

Transport protocol for a published port.

Protocol

Protocol filter for a Rule.

PullPolicy

Controls when an OCI registry is contacted for manifest freshness.

RlimitResource

POSIX resource limit identifiers.

RootfsSource

Root filesystem source for a sandbox.

SandboxLogLevel

Runtime log verbosity for sandbox specs.

SecretConfigError

Invalid secret configuration.

SecurityProfile

Sandbox-level in-guest security profile.

SnapshotDestination

Where to place a new snapshot artifact.

StatVirtualization

Stat virtualization policy for a virtiofs-backed volume mount.

TypesError

Errors returned by shared microsandbox contract helpers.

ViolationAction

Action when a secret placeholder is detected going to a disallowed host.

VolumeKind

Storage kind for a named volume.

VolumeMount

A volume mount specification for a sandbox.

Constants

DEFAULT_METRICS_SAMPLE_INTERVAL_MS

Default metrics sampling interval in milliseconds.

DEFAULT_SANDBOX_MEMORY_MIB

Default guest memory in MiB in a sandbox specification.

DEFAULT_SANDBOX_VCPUS

Default number of virtual CPUs in a sandbox specification.

MAX_HOSTNAME_BYTES

Maximum UTF-8 byte length for a guest hostname (Linux __NEW_UTS_LEN).

MAX_SANDBOX_NAME_BYTES

Maximum UTF-8 byte length for a sandbox name.

MAX_SECRET_PLACEHOLDER_BYTES

Maximum supported secret placeholder length in bytes.

Functions

hostname_from_sandbox_name

Derive a guest hostname from a sandbox name while fitting within MAX_HOSTNAME_BYTES.

validate_hostname

Validate an optional explicit guest hostname before it is forwarded to the guest agent.

validate_sandbox_name

Validate that a sandbox name is safe: alphanumeric / dot / hyphen / underscore, 1..=128 bytes, and must start alphanumeric.

Type Aliases

TypesResult

The result type for shared microsandbox contract operations.