Struct RunHookPayload 

pub struct RunHookPayload(/* private fields */);

A runHookPayload that is known to fit the service ceiling.

The type is the guard: there is no way to build one over 4096 bytes, so no call site has to remember to check. See the module docs for the measurement and for why the service model’s own documentation string disagrees with its shape.

Implementations

impl RunHookPayload

pub fn for_agent_token(agent_token: &str) -> Result<RunHookPayload, Error>

The payload carrying an agent token, as the daemon expects to find it.

{"agent_token": "<token>"} — and the platform wraps this whole string as the value of runHookPayload, which is the extra parse the daemon does.

Checked even though this function builds the JSON itself, because the token is caller-supplied: someone passing a JWT or a signed blob rather than a bearer token is exactly who this catches.

pub fn for_launch( agent_token: &str, env: &HashMap<String, String>, ) -> Result<RunHookPayload, Error>

The payload carrying an agent token and a launch environment.

{"agent_token": "<token>", "env": {...}}, and the platform wraps that whole string as the value of runHookPayload — the extra parse the daemon does. The daemon applies env as the base environment of every subsequent exec, under the per-request env.

This is where the 4096-byte refusal fires for a launch env. The check is on the serialized payload rather than on the map, because the ceiling is on the string: JSON escaping, the key names, and the punctuation all count, so a caller who measured their own values would measure the wrong thing. And it is local rather than left to the service for the same reason super::super::control::image’s require_workdir and require_matching_from are local: the service’s answer arrives as a ValidationException on a member the caller did not know they were filling, after the call, and botocore does not enforce it client-side at all (measured; docs/PLATFORM.md). env is what makes this reachable in practice — one bearer token has always fit with room to spare, and a map of credentials does not.

The env is omitted from the JSON entirely when it is empty, so a caller who passes no launch env produces byte-for-byte the payload RunHookPayload::for_agent_token always produced. A pinned daemon that has never heard of env therefore sees no change, and the two constructors do not have two different budgets.

pub fn for_launch_with_identity( agent_token: &str, env: &HashMap<String, String>, identity: Option<&LaunchIdentity>, ) -> Result<RunHookPayload, Error>

RunHookPayload::for_launch, optionally carrying the tunnel identity material.

The two identity fields are the VM’s own seed and the launching host’s public key, under the keys protocol::identity declares — the daemon pins one and derives from the other, which lets microvm tunnel --verify-identity prove possession of the launch-pinned key under protocol::identity’s trust assumptions. None produces byte-for-byte the payload the other constructors always built, so a caller who never asks for identity cannot be affected by the field existing (the same compatibility rule env follows).

The material costs protocol::identity::IDENTITY_PAYLOAD_BYTES of the shared 4096-byte budget — two 44-character base64 values plus JSON framing — and the ceiling check below covers it like everything else in the payload.

pub fn new(payload: impl Into<String>) -> Result<RunHookPayload, Error>

An arbitrary payload, if it fits.

Public because the run-hook body is the caller’s channel and this crate does not own what goes in it; the ceiling is the only thing it enforces.

pub fn as_str(&self) -> &str

The payload’s bytes as the wire will carry them.

pub fn len(&self) -> usize

The size in bytes, which is what the ceiling measures.

pub fn is_empty(&self) -> bool

Whether the payload is empty. The model’s minimum is 0, so an empty payload is legal.

Trait Implementations

impl Clone for RunHookPayload

fn clone(&self) -> RunHookPayload

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RunHookPayload

Prints the size and nothing else.

The payload is the platform’s only per-VM secret channel — its whole purpose is to carry the agent token — so a derived Debug would print that token into every log line that formats one, and into every line that formats the RunMicrovmRequest holding it. RunMicrovmRequest keeps its derive: with this impl in place, the derived one prints RunHookPayload(<N bytes>) for that field, so the safety is inherited rather than restated. The length is kept because it is the number every TRAP-5 diagnosis needs.

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for RunHookPayload

impl PartialEq for RunHookPayload

fn eq(&self, other: &RunHookPayload) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RunHookPayload