Module control 

The control-plane client, with the signed transport and the build services.

Modules

artifact

The build artifact: a zip of the daemon binary, a Dockerfile, and — when the caller passes ProjectFiles — the project’s dependency files.

connector

Managed connector intents and customer-managed VPC egress connector validation.

context

A task’s build context, and reading one from a directory (#221, IMAGE-7).

ensure

Content-addressed build-or-reuse for an image: what Sandbox::ensure_image does (#221).

image

Image create, the build wait, and the stalled-build probe (TRAP-1, TRAP-2).

microvm

Launch, the launch wait, the lifecycle calls, and the proxy token (TRAP-5, TRAP-8).

ops

The wire shapes, transcribed member-for-member from the pinned service model.

project

A project directory’s dependency files: the pairing rule, and reading the pair from a directory (#74, #264).

services

The STS and S3 calls ensure_image makes, and their SigV4 implementation.

sweep

Prefix-scoped cleanup. Discovery finishes before mutation so deletion cannot move a pagination cursor past another resource. Keep entries protect both an image and its VMs.

token

Idempotency tokens, unique per attempt by construction (TRAP-1).

transport

The control plane’s calls, the transport port, and the signed transport.

Structs

BaseImage

A base image: the platform ARN, the Dockerfile FROM that pairs with it, and whether it declares a WORKDIR.

BuildContext

A build context: the files beside the Dockerfile in the artifact, sorted by name.

ContextEntry

One file of a build context: its path relative to the context root, its mode, and its bytes.

ControlPlane

The control-plane client.

CreateImageRequest

Everything CreateMicrovmImage needs, with the traps closed in the type.

EnsureImageRequest

Everything Sandbox::ensure_image needs.

EnsuredImage

What Sandbox::ensure_image returns.

Image

A built image, and the log group the service created alongside it.

Microvm

A launched MicroVM, as the service last described it.

MicrovmFilter

The optional filters ListMicrovms accepts.

ProjectFiles

A project’s dependency files: the lockfile plus the manifest that owns it.

ProxyToken

The minted proxy token, as a header map (TRAP-7).

RunHookPayload

A runHookPayload that is known to fit the service ceiling.

RunMicrovmRequest

Everything RunMicrovm needs.

SignedBuildServices

STS and S3 over SigV4, with the default credential chain.

SweepFailure

A failed resource operation. Other candidates are still processed.

SweepOptions

Options for an explicitly scoped sweep. The default only discovers resources.

SweepReport

An inventory and confirmed cleanup outcomes. Dry runs populate only the inventory.

SystemClock

The control plane’s name for TokioClock, kept so control::SystemClock::new() and SystemClock::default() still resolve. The production clock: tokio’s monotonic clock and the system’s wall clock.

WaitOpts

How long to wait and how often to poll.

WrapOptions

What wrap_dockerfile needs besides the task text.

Enums

ConnectorIntent

Lambda-managed connector intents. Customer-managed VPC connectors use explicit ARNs.

Ecosystem

An ecosystem whose dependency files may enter the build artifact (#74).

EgressPosture

Conservative network posture inferred from launch options.

Constants

DEFAULT_AGENT_PORT

Compatibility alias for the shared daemon listener default.

PLATFORM_HONOURS_OMITTED_EGRESS

Compatibility constant: omitting an egress connector does not block internet access. Isolation requires a VPC egress connector and a VPC without an internet gateway or NAT gateway. A launch flag cannot establish the VPC’s routing configuration.

Traits

BuildServices

The seam ensure_image reaches STS and S3 through.

Clock

The clock every wait here measures its deadline on. It’s the crate’s one Clock, so the plane and the sessions it hands out read the same time source. Time, injectable so a wait or a refresh boundary is a test rather than a wait.

Functions

artifact_content_hash

The sha256 of the artifact’s inputs, as lowercase hex.

build_artifact

Zips binary with dockerfile — and, when given, the project’s dependency files — into the bytes codeArtifact.uri will point at.

default_dockerfile

A Dockerfile that makes the daemon the container CMD.

egress_posture_for

The egress posture a launch with these options reports, or the refusal it raises (BIND-11, BIND-13). Pure: no AWS call, no credentials.

hooks_block

The Hooks block with all six hooks enabled and both timeout families set.

read_project_files

The one manifest+lockfile pair in dir, read into ProjectFiles, or the refusal project_ecosystem makes: no pair, a half pair, or two ecosystems.

require_duration_in_range

Rejects a maximumDurationInSeconds outside the service range.

require_idle_duration

Rejects an idlePolicy.maxIdleDurationSeconds under the model’s min: 60.

require_non_blank

Rejects a NonBlankString value the service would reject.

require_valid_identifier

Rejects a MicrovmIdentifier/MicrovmImageIdentifier the service would reject.

require_valid_image_name

Rejects an image name the service would reject, before the artifact upload.

require_valid_log_group

Rejects a logging.cloudWatch.logGroup the service would reject, before the artifact upload.

require_valid_log_stream

Rejects a caller-supplied logging.cloudWatch.logStream prefix the resolved name could not legally carry, before the artifact upload.

require_valid_port

Rejects a port the PortNumber or HooksPortInteger shapes would reject. Minimum 1.

require_valid_role_arn

Rejects a RoleArn the service would reject, before the artifact upload.

require_valid_tags

Rejects a tag map the service would reject, naming the key and the half that failed.

require_valid_version

Rejects a Version/NonBlankString value the service would reject.

wrap_dockerfile

A task Dockerfile with the agentd stanza appended: the one call a harness needs to go from the Dockerfile a task brings to one this client can build (#220).

wrap_dockerfile_preserving_user

Preserve the final Dockerfile USER as the default identity for workload execs.