pub struct RwBind {
pub host: PathBuf,
pub sandbox: PathBuf,
}Expand description
A single read-write bind mount. The exact counterpart of RoBind
for the rw_binds field — same wire shape, same ergonomics, same
From<(PathBuf, PathBuf)> convenience.
§Trust semantics
RwBind is a deliberate trust widening. The crate’s default
posture — work_host: None with a sandbox-private tmpfs /work,
and ro_binds containing only /nix/store — is what
IsolationPolicy::from_effects produces, and it’s the shape
that keeps the sandbox meaningful.
The moment a caller adds an RwBind to the policy, the stage
inside the sandbox can write to the corresponding host path. The
crate does not — cannot — validate whether that’s a sensible
thing to share. Binding /home/user RW gives the stage the
caller’s entire home directory; binding a project workdir RW is
the whole point of an agent-coding tool. Both use exactly the
same mechanism. The policy decision lives with the caller.
No from_effects variant produces an RwBind. The EffectSet
vocabulary has no FsWrite(path) variant (noted in the
module-level rustdoc), so effects alone can’t drive the shape.
Consumers that want RW binds construct the policy directly and
take responsibility for the trust decision.
Fields§
§host: PathBufHost-side path. Must exist; bwrap will fail otherwise.
sandbox: PathBufPath inside the sandbox where the host dir/file appears.