Enum ServiceMode 

pub enum ServiceMode {
    Agent,
    StrictAgent,
    Production,
}

Service mode for the container.

Determines whether the container runs as an ephemeral agent sandbox, a fail-closed agent sandbox, or a long-running production service.

Variants

Agent

Ephemeral agent workload (default). Allows degraded fallbacks.

StrictAgent

Ephemeral agent workload with fail-closed isolation, but without production service rootfs, health, sd_notify, or NixOS semantics.

Production

Long-running production service. Enforces strict security invariants:

• Forbids degraded security, chroot fallback, and native host network mode
• Allows gvisor-host only with explicit gVisor runtime and hostinet opt-in
• Requires cgroup resource limits
• Requires pivot_root (no chroot fallback)
• Requires explicit rootfs path (no host bind mounts)

Implementations

impl ServiceMode

pub fn label(self) -> &'static str

pub fn enforces_strict_isolation(self) -> bool

pub fn requires_user_namespace_mapping(self) -> bool

pub fn requires_cgroup_enforcement(self) -> bool

pub fn requires_explicit_bridge_dns(self) -> bool

Trait Implementations

impl Clone for ServiceMode

fn clone(&self) -> ServiceMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ServiceMode

impl Debug for ServiceMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ServiceMode

fn default() -> ServiceMode

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ServiceMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ServiceMode

impl PartialEq for ServiceMode

fn eq(&self, other: &ServiceMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ServiceMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ServiceMode

impl ValueEnum for ServiceMode

fn value_variants<'a>() -> &'a [Self]

All possible argument values, in display order.

fn to_possible_value<'a>(&self) -> Option<PossibleValue>

The canonical argument value.

fn from_str(input: &str, ignore_case: bool) -> Result<Self, String>

Parse an argument into Self.