Struct SandboxState 

pub struct SandboxState {
    pub fs: Vec<FsCapState>,
    pub unix_sockets: Vec<UnixSocketCapState>,
    pub net_blocked: bool,
    pub resource_limits: Option<ResourceLimits>,
}

Serializable representation of sandbox state

Fields

fs: Vec<FsCapState>

Filesystem capabilities

unix_sockets: Vec<UnixSocketCapState>

AF_UNIX socket capabilities (may be absent in states persisted by older nono builds; #[serde(default)] preserves backward compat).

net_blocked: bool

Whether network is blocked

resource_limits: Option<ResourceLimits>

Resource ceilings (memory and max processes). Absent in states from older nono builds; #[serde(default)] keeps those loadable. Plain numbers, so unlike paths they need no re-validation.

Implementations

impl SandboxState

pub fn from_caps(caps: &CapabilitySet) -> Self

Create state from a capability set

pub fn to_caps(&self) -> Result<CapabilitySet>

Convert state back to a capability set

Paths are re-validated through the standard constructors (new_dir/new_file) which canonicalize paths and verify existence. This prevents crafted JSON from injecting arbitrary paths that bypass validation.

Returns an error if any path no longer exists or fails validation.

pub fn to_json(&self) -> Result<String>

Serialize state to JSON

pub fn from_json(json: &str) -> Result<Self, Error>

Deserialize state from JSON

Trait Implementations

impl Clone for SandboxState

fn clone(&self) -> SandboxState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SandboxState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.