Struct RunHook 

pub struct RunHook {
    pub agent_token: String,
    pub env: HashMap<String, String>,
    pub identity_seed: Option<String>,
    pub identity_host_public_key: Option<String>,
}

The caller’s own payload, carrying the per-VM secret and an optional launch environment.

Passing the token at launch is what keeps it out of the shared image snapshot. It is safe because the platform forwards no external traffic until this hook returns 200.

env rides the same channel because the channel is the only per-VM one the platform offers, and a launch environment is the same kind of thing as the token: something a caller knows at launch and cannot bake into a shared image. The whole payload shares one 4096-byte budget, so a caller who fills env with credentials is spending the token’s room; microvms-core refuses an over-budget payload locally, before the call.

Fields

agent_token: String

env: HashMap<String, String>

Base environment applied to every subsequent exec, under the per-request env. Absent and empty mean the same thing, which is why this is a plain map rather than an Option: there is nothing a caller could express by sending "env": {} that omitting the key does not already say.

identity_seed: Option<String>

The VM’s own identity seed, base64 of 32 bytes, or None.

An Option rather than a defaulted value because the absence is information here, unlike env: a VM launched without a seed has no key to prove anything with, and the tunnel must refuse --verify-identity against it (close code 4401) rather than downgrade silently. See super::identity for why the material travels on this channel at all.

identity_host_public_key: Option<String>

The launching host’s public key, base64 of 32 bytes, or None.

The other half of mutual authentication: the daemon pins this, so a handshake proves the peer is the host that launched this VM rather than anyone who came to hold the agent token. Separate from the seed because a caller could deliver one without the other, and the daemon reports which half is missing.

Implementations

impl RunHook

pub fn parse(raw: &str) -> Result<Self, RunHookError>

Reads the caller’s payload, ignoring keys this version does not know.

Unknown keys are ignored on purpose: a newer client sending a field this daemon has never heard of must still be able to bootstrap it, because the alternative is a 400 at the run hook and the platform terminating the VM before any traffic is forwarded. Forward compatibility here is the difference between an ignored field and a dead launch.

Hand-walked rather than serde_json::from_str::<RunHook> so every refusal is one of the named variants above. serde’s own messages quote values, and the values here are secrets.

Trait Implementations

impl Debug for RunHook

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RunHook

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RunHook

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for RunHook

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for RunHook

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.