Struct OciConfig 

pub struct OciConfig {
    pub oci_version: String,
    pub root: OciRoot,
    pub process: OciProcess,
    pub hostname: Option<String>,
    pub mounts: Vec<OciMount>,
    pub linux: Option<OciLinux>,
    pub hooks: Option<OciHooks>,
    pub annotations: HashMap<String, String>,
}

OCI Runtime Specification configuration

This implements a subset of the OCI runtime spec for gVisor compatibility Spec: https://github.com/opencontainers/runtime-spec/blob/main/config.md

Fields

oci_version: String

root: OciRoot

process: OciProcess

hostname: Option<String>

mounts: Vec<OciMount>

linux: Option<OciLinux>

hooks: Option<OciHooks>

annotations: HashMap<String, String>

Implementations

impl OciConfig

pub fn new(command: Vec<String>, hostname: Option<String>) -> Self

Create a minimal OCI config for Nucleus containers

pub fn with_resources(self, limits: &ResourceLimits) -> Self

Add resource limits to the config

pub fn with_no_new_privileges(self, enabled: bool) -> Self

Configure the OCI noNewPrivileges process flag.

pub fn with_terminal(self, size: ConsoleSize) -> Self

Configure the process as terminal-attached with an initial console size.

pub fn with_env(self, vars: &[(String, String)]) -> Self

Add environment variables to the OCI process config.

pub fn with_home_tmpfs( self, home: &Path, identity: &ProcessIdentity, ) -> Result<Self>

Add or replace the private sandbox home tmpfs mount.

pub fn with_workdir(self, workdir: &Path) -> Result<Self>

Set the OCI process working directory.

pub fn with_sd_notify(self) -> Self

Add sd_notify socket passthrough.

pub fn with_secret_mounts(self, secrets: &[SecretMount]) -> Self

Add bind mounts for secrets.

pub fn with_process_identity(self, identity: &ProcessIdentity) -> Self

Set the process identity for the OCI workload.

pub fn with_inmemory_secret_mounts( self, stage_dir: &Path, secrets: &[SecretMount], ) -> Result<Self>

Add a read-only bind mount of an in-memory secret staging directory at /run/secrets, plus compatibility bind mounts for each staged secret to its requested container destination.

pub fn with_volume_mounts(self, volumes: &[VolumeMount]) -> Result<Self>

Add bind or tmpfs volume mounts.

pub fn with_gpu_passthrough( self, gpu: &GpuPassthroughConfig, set: &GpuDeviceSet, identity: &ProcessIdentity, ) -> Result<Self>

Add GPU passthrough: OCI device entries for each GPU device plus read-only bind mounts for driver support files, and inject the NVIDIA environment variables. runsc creates the device nodes and installs the matching cgroup device rules inside its sandbox.

pub fn with_provider_config_mounts( self, home: &Path, provider_configs: &[ProviderConfigMount], ) -> Result<Self>

Add explicit provider CLI config bind mounts under the sandbox home.

pub fn with_workspace_mount(self, workspace: &WorkspaceConfig) -> Result<Self>

Add the first-class workspace bind mount.

pub fn with_context_bind(self, context_dir: &Path) -> Self

Bind mount the host context directory into the container.

The gVisor integration path expects /context to be writable so test workloads can write results back to the host.

pub fn with_rootfs_binds(self, rootfs_path: &Path) -> Result<Self>

Add rootfs bind mounts from a pre-built rootfs path.

pub fn with_namespace_config(self, config: &NamespaceConfig) -> Self

Replace the default namespace list with an explicit configuration.

pub fn with_host_runtime_binds(self) -> Self

Add read-only bind mounts for host runtime paths.

This mirrors the native fallback path for non-production containers so common executables such as /bin/sh remain available inside the OCI rootfs when no explicit rootfs is configured.

pub fn with_user_namespace(self) -> Self

Add user namespace configuration

pub fn without_network_namespace(self) -> Self

Remove the OCI network namespace entry so runsc inherits the process network namespace that Nucleus prepared before exec.

pub fn without_user_namespace(self) -> Self

Remove the OCI user namespace entry so runsc inherits a namespace that Nucleus already created and mapped before exec.

pub fn with_rootless_user_namespace(self, config: &UserNamespaceConfig) -> Self

Configure gVisor’s true rootless OCI path.

gVisor expects UID/GID mappings in the OCI spec for this mode, and its rootless OCI implementation does not currently support a network namespace entry in the spec. We still control networking through runsc’s top-level --network flag.

pub fn with_hooks(self, hooks: OciHooks) -> Self

Set OCI lifecycle hooks on the config.

pub fn with_rlimits(self, limits: &ResourceLimits) -> Self

Set process rlimits from the Nucleus runtime defaults and configured limits.

Mirrors the RLIMIT backstops applied in-process for native containers (runtime.rs), expressed as OCI config so gVisor can enforce them.

pub fn with_seccomp(self, seccomp: OciSeccomp) -> Self

Set the linux.seccomp section from an OCI seccomp config.

pub fn with_cgroups_path(self, path: String) -> Self

Set the linux.cgroupsPath field.

pub fn with_sysctl(self, sysctl: HashMap<String, String>) -> Self

Set sysctl key-value pairs on the linux config.

pub fn with_annotations(self, annotations: HashMap<String, String>) -> Self

Set annotations on the OCI config.

Trait Implementations

impl Clone for OciConfig

fn clone(&self) -> OciConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OciConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OciConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OciConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.