List of all items

Structs

• audit::AuditEvent
• audit::SecurityPosture
• checkpoint::CheckpointMetadata
• checkpoint::CheckpointResourceLimits
• checkpoint::CriuRuntime
• container::ConsoleSize
• container::Container
• container::ContainerConfig
• container::ContainerLifecycle
• container::ContainerState
• container::ContainerStateManager
• container::ContainerStateParams
• container::CreatedContainer
• container::GpuPassthroughConfig
• container::HealthCheck
• container::ProcessIdentity
• container::ProviderConfigMount
• container::RootfsOverlayConfig
• container::SecretMount
• container::VolumeMount
• container::WorkspaceConfig
• filesystem::ContextPopulator
• filesystem::DeviceNodeSpec
• filesystem::GpuDeviceSet
• filesystem::GpuMountResult
• filesystem::LazyContextPopulator
• filesystem::TmpfsMount
• image::ImageBase
• image::ImageCommitOptions
• image::ImageConfig
• image::ImageDiff
• image::NucleusImageManifest
• isolation::ContainerAttach
• isolation::IdMapping
• isolation::NamespaceCommandRunner
• isolation::NamespaceConfig
• isolation::NamespaceManager
• isolation::SubidRange
• isolation::UserNamespaceConfig
• isolation::UserNamespaceMapper
• network::BridgeConfig
• network::BridgeNetwork
• network::CredentialBrokerConfig
• network::EgressPolicy
• network::PortForward
• network::UserspaceNetwork
• oci::OciBundle
• oci::OciCapabilities
• oci::OciConfig
• oci::OciConsoleSize
• oci::OciContainerState
• oci::OciCpu
• oci::OciDevice
• oci::OciHook
• oci::OciHooks
• oci::OciIdMapping
• oci::OciIntelRdt
• oci::OciLinux
• oci::OciMemory
• oci::OciMount
• oci::OciNamespace
• oci::OciPids
• oci::OciProcess
• oci::OciResources
• oci::OciRlimit
• oci::OciRoot
• oci::OciSeccomp
• oci::OciSeccompArg
• oci::OciSeccompSyscall
• oci::OciUser
• resources::Cgroup
• resources::CgroupFreezeGuard
• resources::DeviceAllowSpec
• resources::IoDeviceLimit
• resources::ResourceLimits
• resources::ResourceStats
• security::CapabilityManager
• security::CapabilitySets
• security::CapsPolicy
• security::GVisorOciRunOptions
• security::GVisorRuntime
• security::LandlockManager
• security::LandlockPolicy
• security::SeccompDenyLogger
• security::SeccompManager
• security::SeccompProfile
• security::SeccompTraceReader
• telemetry::CleanupEvent
• telemetry::ContainerControlEvent
• telemetry::ContainerEventMetadata
• telemetry::EventSink
• telemetry::ExitStatusEvent
• telemetry::GpuEventSummary
• telemetry::SecurityEventMetadata
• telemetry::WorkspaceMountEvent
• topology::DependencyEdge
• topology::DependencyGraph
• topology::DependsOn
• topology::DnsRecord
• topology::NetworkDef
• topology::ReconcilePlan
• topology::ServiceDef
• topology::ServiceVolumeMount
• topology::TopologyConfig
• topology::VolumeDef

Enums

• audit::AuditEventType
• checkpoint::CheckpointState
• container::GpuVendor
• container::KernelLockdownMode
• container::NetworkModeArg
• container::OciStatus
• container::ReadinessProbe
• container::RootfsMode
• container::RuntimeSelection
• container::SeccompMode
• container::ServiceMode
• container::TrustLevel
• container::UsernsModeArg
• container::VolumeSource
• container::WorkspaceMode
• error::NucleusError
• filesystem::ContextMode
• filesystem::FilesystemState
• isolation::NamespaceProbe
• isolation::NamespaceState
• network::BridgeDriver
• network::NatBackend
• network::NetworkMode
• network::NetworkState
• network::Protocol
• resources::CgroupState
• security::GVisorNetworkMode
• security::GVisorPlatform
• security::SecurityState
• telemetry::ControlEventType
• topology::ReconcileAction

Traits

• error::StateTransition

Functions

• audit::audit
• audit::audit_error
• audit::audit_with_posture
• audit::redact_command
• container::generate_container_id
• container::gpu_environment
• container::parse_signal
• container::validate_container_name
• container::validate_hostname
• filesystem::audit_mounts
• filesystem::bind_mount_host_paths
• filesystem::bind_mount_rootfs
• filesystem::copy_workspace_in
• filesystem::create_dev_nodes
• filesystem::create_minimal_fs
• filesystem::discover_gpu_at
• filesystem::is_immediate_nix_store_object_path
• filesystem::major_of
• filesystem::mask_proc_paths
• filesystem::minor_of
• filesystem::mount_gpu_passthrough
• filesystem::mount_home_tmpfs
• filesystem::mount_procfs
• filesystem::mount_provider_configs
• filesystem::mount_secrets
• filesystem::mount_secrets_inmemory
• filesystem::mount_volumes
• filesystem::mount_workspace
• filesystem::normalize_container_destination
• filesystem::normalize_provider_config_destination
• filesystem::normalize_volume_destination
• filesystem::overlay_mount_rootfs
• filesystem::read_rootfs_attestation
• filesystem::resolve_container_destination
• filesystem::resolve_gpu_devices
• filesystem::resolve_volume_destination
• filesystem::snapshot_context_dir
• filesystem::support_paths
• filesystem::switch_root
• filesystem::sync_workspace_out
• filesystem::validate_agent_toolchain_rootfs_path
• filesystem::validate_bind_mount_source
• filesystem::validate_bind_mount_source_policy
• filesystem::validate_production_rootfs_path
• filesystem::validate_provider_config_source
• filesystem::validate_workspace_host_path
• filesystem::verify_context_integrity
• filesystem::verify_context_manifest
• filesystem::verify_rootfs_attestation
• image::commit_container_image
• image::copy_image_diff_to_upper
• image::load_image
• isolation::current_username
• isolation::current_userns_container_ranges
• isolation::in_nontrivial_userns
• isolation::subgid_range_for_user
• isolation::subid_range_for
• isolation::subuid_range_for_user
• isolation::uid_is_mapped_in_current_userns
• network::validate_egress_cidr
• network::validate_egress_domain
• resources::base_device_specs
• resources::install_device_allowlist
• security::generate_from_trace
• security::load_json_policy
• security::load_toml_policy
• security::sha256_hex
• telemetry::init_tracing
• topology::execute_reconcile
• topology::generate_hosts_entries
• topology::inject_hosts
• topology::plan_reconcile

Type Aliases

• error::Result
• filesystem::DirectoryManifest

Constants

• container::CREDENTIAL_BROKER_CONTAINER_ID_ENV
• container::CREDENTIAL_BROKER_TOKEN_ENV
• container::DEFAULT_GPU_DRIVER_CAPABILITIES
• container::DEFAULT_GPU_VISIBLE_DEVICES
• container::DEFAULT_HOME_PATH
• filesystem::PROC_NULL_MASKED
• filesystem::PROC_READONLY_PATHS
• filesystem::PROC_TMPFS_MASKED
• filesystem::ROOTFS_ATTESTATION_FILE
• filesystem::ROOTFS_STORE_PATHS_FILE
• image::IMAGE_DIFF_DIR
• image::IMAGE_MANIFEST_FILE
• image::IMAGE_ROOTFS_ATTESTATION_FILE
• image::IMAGE_SCHEMA_VERSION
• image::IMAGE_SIGNATURE_FILE
• image::IMAGE_STORE_PATHS_FILE