Struct Container 

pub struct Container { /* private fields */ }

Container runtime that orchestrates all isolation mechanisms

Execution flow matches the formal specifications:

1. Create namespaces (Nucleus_Isolation_NamespaceLifecycle.tla)
2. Create and configure cgroups (Nucleus_Resources_CgroupLifecycle.tla)
3. Mount tmpfs and populate context (Nucleus_Filesystem_FilesystemLifecycle.tla)
4. Drop capabilities and apply seccomp (Nucleus_Security_SecurityEnforcement.tla)
5. Execute target process

Implementations

impl Container

pub fn new(config: ContainerConfig) -> Self

pub fn run(&self) -> Result<i32>

Run the container (convenience wrapper: create + start)

pub fn create(&self) -> Result<CreatedContainer>

Create phase: fork the child, set up cgroup/bridge, leave child blocked on the exec FIFO. Returns a CreatedContainer whose start() method releases the child process.

pub fn trigger_start( container_id: &str, state_root: Option<PathBuf>, ) -> Result<()>

Trigger a previously-created container to start by opening its exec FIFO. Used by the CLI start command.