Struct IsolationPolicy 

pub struct IsolationPolicy {
    pub ro_binds: Vec<RoBind>,
    pub rw_binds: Vec<RwBind>,
    pub work_host: Option<PathBuf>,
    pub network: bool,
    pub env_allowlist: Vec<String>,
}

What the sandbox does and doesn’t let a stage reach.

Derived from a stage’s EffectSet via IsolationPolicy::from_effects. Callers rarely construct this manually; it’s shaped so the stage executor can translate it into backend-specific flags (bwrap args in Phase 1, unshare+landlock+seccomp in Phase 2). Serde-enabled so downstream consumers (e.g. the noether-sandbox binary) can exchange policies over IPC.

Fields

ro_binds: Vec<RoBind>

Read-only bind mounts. Always includes /nix/store so Nix-pinned runtimes resolve inside the sandbox.

rw_binds: Vec<RwBind>

Read-write bind mounts. Empty by default; never populated by Self::from_effects (effects alone don’t carry enough information to justify a trust widening — see RwBind).

Interaction with ro_binds and work_host (mount order)

bwrap processes bind flags in argv order; a later flag whose sandbox path sits under an earlier flag’s sandbox path shadows the earlier one for that subtree. build_bwrap_command emits binds in this fixed order:

1. rw_binds (this field) — --bind <host> <sandbox> per entry.
2. ro_binds — --ro-bind <host> <sandbox> per entry.
3. work_host — --bind <host> /work (if Some), else --dir /work (sandbox-private tmpfs).

Why RW-then-RO: the agentspec-ish pattern is “this agent operates on my ~/projects/foo directory RW, but its .ssh subdirectory stays RO.” With RW emitted first, the narrower RO shadows the broader RW — which is the default-ergonomic outcome. Reversing the order would make the RW bind silently override an attempt to protect a subpath.

work_host renders after both vectors, so a work_host that happens to sit under an earlier bind wins at /work. This matches the pre-existing behaviour on ro_binds alone and is the mapping the executor expects.

work_host: Option<PathBuf>

Scratch directory strategy for /work inside the sandbox.

• None (recommended, and the default from Self::from_effects) → bwrap creates /work as a sandbox-private tmpfs via --dir /work. No host-side path exists; cleanup happens automatically when the sandbox exits; a malicious host user can’t race to write predicatable filenames into the work dir before the stage runs.
• Some(host) → --bind <host> /work. Host dir must exist and be writable by the sandbox’s effective UID (65534 by default). Only for callers that need to inspect the work dir after execution — e.g., an integration test.

network: bool

Inherit the host’s network namespace (true) or unshare into a fresh empty one (false). Only true when the stage has Effect::Network.

env_allowlist: Vec<String>

Environment variables to pass through to the sandboxed process. Everything else in the parent environment is cleared.

Implementations

impl IsolationPolicy

pub fn from_effects(effects: &EffectSet) -> Self

Build the policy for a stage with the given effects.

Defaults to a sandbox-private /work (tmpfs, no host-side state). Callers that need a host-visible work dir can swap in Self::with_work_host.

pub fn with_work_host(self, host: PathBuf) -> Self

Override the sandbox’s /work to bind a caller-provided host directory. The directory must already exist and be writable by the sandbox effective UID (65534). Consumers mostly leave the default (tmpfs).

Trait Implementations

impl Clone for IsolationPolicy

fn clone(&self) -> IsolationPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IsolationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IsolationPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for IsolationPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.